NIS2 compliance: from scoping to audit readiness

The law, the Закон за безбедност на мрежни и информациски системи, has no official English title and applies from 1 January 2026. It covers public-sector bodies, apart from certain security and defence bodies, and medium and large entities in seven sectors: energy, transport, banking, financial market, health, digital infrastructure and B2B ICT service management. Size follows the Company Law classification, not the EU SME definition. Some providers, such as electronic-communications, trust service and DNS providers, are covered regardless of size. Nine further sectors, including drinking water, food and manufacturing, are deferred until EU accession.

Essential entities include large entities in the listed sectors, public institutions, critical-infrastructure operators, trust service providers and DNS providers. They must appoint a cybersecurity officer and are supervised proactively, including on-site checks and audits. Important entities are mainly medium-sized entities in the listed sectors and are supervised only after the fact. Both must apply the ten measures, assess risk at least once a year and report significant incidents.

For a significant incident or significant cyber threat, you notify the competent CSIRT immediately and at the latest within three hours of becoming aware. An early warning follows within 24 hours and an incident notification within 72 hours. Intermediate reports are sent on request, and a final report is due one month after the notification. The three-hour first notice is stricter than the EU directive’s timeline, so internal escalation has to be fast. What counts as “significant” is set by each competent authority’s methodology, and we track these as they are adopted.

Fines for entities are based on total annual revenue in the previous business year, with higher maximums for essential than for important entities. They are imposed by a court in misdemeanour proceedings, not by MKD-CIRT or the Ministry. Responsible persons can also be fined personally, and for essential entities the court also imposes a temporary ban on carrying out the activity; a responsible person can be banned from their profession.

No. Audits under the law are carried out by auditors licensed by the Ministry of Digital Transformation or by other institutions the law permits, and Diverto is neither. We prepare you: we close the gaps, organize the evidence and stay with you through the audit and any corrective actions that follow.