NIS2 in force · February 2026

Cybersecurity without compromise — protection and NIS2 readiness

The law splits companies into essential entities and important entities — this determines both the obligations and the size of the fines. For the first time the management body carries personal liability and must take cybersecurity training at least every two years. Incident reporting is mandatory: an early warning within 24 hours, a full notification within 72 and a final report within one month.

We apply real technical measures, prepare you for audit and reduce the risk of cyberattack. Not just documentation.

10M € Max NIS2 fine

24h Notification deadline

18 Affected sectors

What the service includes

Full Protection from Threats to Audit Readiness

Six practical measures that reduce risk and build real cyber resilience.

Risk Assessment

We identify vulnerabilities in your network, systems and processes before attackers do.

Multi-Factor Authentication

MFA for email, ERP, remote access and admin accounts — stops 99% of mass attacks.

Backup and Disaster Recovery

Tested full recovery plan after ransomware or hardware failure — no data loss.

Network Segmentation

We isolate critical systems — if breached, the attack doesn't spread across the whole network.

Team Training

Practical training against phishing, social engineering and insider threats — people are the last line of defence.

NIS2 Audit Documentation

We document roles, processes and controls in the required format — ready for regulatory inspection.

Process

How we build your protection

A systematic approach from assessment to audit readiness in five steps.

Audit

Free assessment of current protection level and vulnerabilities.

Priorities

We determine which measures deliver the greatest impact for your risk.

Implementation

We implement technical measures — MFA, backup, segmentation, monitoring.

Training

We train your team to recognize threats and respond correctly.

Documentation

We prepare the audit package with roles, processes and control evidence.

Results

Concrete results for your business

Measurable indicators of real protection after implementing measures.

99% Fewer mass attacks

MFA blocks most automated attacks with stolen credentials.

< 4h Recovery after incident

A tested backup plan means work resumes in hours, not days.

100% NIS2 readiness

We document everything needed for regulatory inspection and audit.

⚠️ NIS2 is in force from February 2026. Have you checked if you're in scope?

On our first visit we perform a free check whether your company falls in scope — and what you need to do immediately.

+359 877 610 850 Free NIS2 Check

Questions about NIS2 and Cybersecurity

Which companies are required under NIS2 in Bulgaria?

Companies with more than 50 employees or over €10M turnover in 18 sectors: health, finance, energy, transport, manufacturing, IT services, couriers and more. We check for free whether your company is in scope.

What are the fines for non-compliance with NIS2?

Up to €10M or 2% of annual turnover for essential entities. Up to €7M or 1.4% for important entities. Management bears personal liability.

When did NIS2 enter into force in Bulgaria?

The Cybersecurity Act transposing NIS2 was adopted by the National Assembly on 5 February 2026. Companies must act immediately — assessment, technical measures and audit preparation.

How much does NIS2 implementation cost?

Pricing is on individual request — it depends on the law's technical requirements for your organisation (sector, size, measures needed). We start with a free on-site assessment, after which you get a concrete quote.

Do you handle only documentation or also technical implementation?

Full implementation — MFA, encryption, backup, firewall, staff training, documentation and audit preparation. Not just consulting — real deployment.

See our NIS2 service pricing or learn about subscription IT support.