CYBERSECURITY ACT

CYBERSECURITY ACT

The Cybersecurity Act (promulgated SG No. 94 of 13.11.2018) is the first Bulgarian law focused entirely on the activities related to cybersecurity, cyber defence and the functions of the competent authorities in the field. It was adopted in fulfilment of the obligation to transpose Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

The law defines the requirements for:

• administrative authorities;
• operators of essential services* and digital service providers whose operation depends on networks and information systems;

• The Act affects public or private entities providing services in the field of:

   

• Energy (electricity, oil and gas);
• Transport (air, rail, water and land);
• Banking (credit institutions);
• Financial market infrastructures (central counterparties);
• Healthcare (healthcare facilities, including hospitals and private clinics);
• Online commerce, online search engine, cloud computing services;
• Digital infrastructure (DNS service providers, etc.)

* The sectors and subsectors of the operators of essential services are defined in Appendix No 1 of the Act.

Exceptions to the scope of the law:
1. Digital service providers, which are micro and small enterprises within the meaning of the Small and Medium-sized Enterprises Act, shall be among the entities excluded from the scope of the new Act.
2. the network and information systems of the Ministry of Defence, the Ministry of Interior, the State Agency for National Security, the State Intelligence Agency, the State Agency for Technical Operations, the Military Information Service and the National Security Service, which are not related to the provision of administrative services by electronic means and the exchange of electronic documents between administrative bodies;
3. Communication and information systems for processing classified information within the meaning of CIA;
4. Undertakings providing public electronic communications networks and/or services within the meaning of the LEC;
5. Certification service providers.

Main duties*:
• Take appropriate and proportionate measures to ensure network and information security;
• Minimising the impact of incidents affecting network and information security in order to ensure continuity;
• notify the sectoral computer security incident response team of incidents that have a significant impact on the continuity of services provided.
* Chapter Two of the Act contains a detailed and categorized description of the obligations.

Regarding the obligation to notify:
Notification of incidents should be made within two hours after the incident has been detected, and full information should be sent within 5 days.
The notifications shall be submitted in accordance with the Ordinance on the Minimum Requirements for Network and Information Security (promulgated SG No. 59 of 26 July 2019)