Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) 19(1)-(3): Grant access to systems only where strictly necessary: define role-based access rights and request, change and termination procedures in internal rules, enforce authentication, authorisation and audit with password complexity (mixed character classes, at least 8 characters for users and 12 for administrators, user passwords changed at least every six months), and give each user a personal profile with least privilege

What does 19(1)-(3) require?

Users and automated processes receive access to information and communication systems only when it is strictly necessary for their duties or technical operations. To keep access to authorised users, devices and processes the entity defines in its internal rules the access rights to specific assets by position and the procedures for requesting, changing and ending access. It applies mandatory authentication, authorisation and audit measures across networks and systems; where passwords are used they must mix upper and lower case letters, digits and special characters, be at least eight characters for user profiles and twelve for administrator profiles, and user passwords are changed regularly, at intervals no longer than six months. User profiles are individual, and daily work is done with the lowest level of access the job needs.