Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) 11: Manage changes to critical information assets under internal rules: assess risk first, plan with deadlines and responsibilities, coordinate with affected process owners, obtain approval, notify interested parties at least three days ahead, test in a test environment, and hold a rollback plan

What does 11 require?

The entity adopts internal rules for changing critical information assets, meaning its systems, supporting infrastructure, processes, activities, configurations, software and firmware, so that changes do not cause incidents. Before a change the entity runs a risk analysis and assessment under Article 7. Each change is planned with deadlines and responsibilities for the steps before, during and after; coordinated in advance with everyone responsible for in-scope processes; approved by the head of the entity or an authorised person; communicated to interested parties at least three days before it is made; and tested in a test environment. A rollback plan to return systems to their prior state is prepared so that an incident caused by the change is short-lived.