site.btaCybersecurity Act Amendments Pass on First Reading

The National Assembly passed government-sponsored amendments to the Cybersecurity Act on first reading Thursday by a vote of 128-2 and 56 abstentions.

The bill has been drafted in implementation of Bulgaria's commitments as an EU member state, the Council of Ministers wrote in its reasoning for the changes. By October 17, 2024, Bulgaria was supposed to transpose into its national legislation provisions of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, also known as the NIS 2 Directive, and to make arrangements for the implementation of the directive.

The bill is aimed at incorporating Bulgaria's cybersecurity into that of the EU, including by adopting the updated EU risk assessment requirements. It seeks to fill existing gaps and to remedy inconsistencies in Bulgarian law by establishing rules for the capacity for risk assessment, the reporting of incidents, testing and awareness raising. The proposed revisions are expected to strengthen the common realization that cyber incidents and the lack of adequate response can endanger the stability of public and private entities.

Under the NIS 2 Directive, it is necessary to increase the sectors subject to cybersecurity obligations from eight to 18. The extended list includes 11 sectors of high criticality (energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management /business-to-business/, public administration, and space), as well as seven other critical sectors (postal and courier services, waste management, the manufacture, production and distribution of chemicals, the production, processing and distribution of food, manufacturing, digital providers, and research).

The maximum period of 28 days has been set for proposals between the first and the second reading of the amendments.