NIS2 expands EU cybersecurity obligations for essential and important entities in specified sectors. Scope, registration, supervision, management
Network & Information Security Directive (NIS2) covers legal assessment, document preparation and implementation support in Europe. It is typically relevant to businesses, investors and organisations operating or transacting in one or more countries. The precise rules, competent authority and procedure depend on the subject matter, jurisdiction and facts, with EU and national law considered together.
The applicable framework depends on the subject of the service, governing law and countries in which the structure or transaction has effect. EU law and current national legislation are assessed together.
Last reviewed: 22 September 2026
NIS2 expands EU cybersecurity obligations for essential and important entities in specified sectors. Scope, registration, supervision, management responsibility and sanctions depend on the Directive and the national law implementing it. For Bulgaria-specific matters, the current Cybersecurity Act and competent-authority guidance must be checked.
We help organisations determine whether they fall within scope, perform gap assessments against the Directive's risk-management and incident-reporting requirements, and implement the governance, technical, and operational measures needed for compliance.
Key deliverables include cybersecurity risk-management policies, supply-chain security procedures, incident-notification workflows meeting the 24-hour early-warning and 72-hour full-notification deadlines, and board-level training on management-body obligations.