Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) 19(4)-(6): Review all access at least yearly through the persons authorised to grant it, using administrator-provided lists of accounts and levels and recording confirmations or changes; limit privileged access to a defined period under monitoring; allow access to shared files and printers only from the entity's own network

What does 19(4)-(6) require?

Those authorised under the internal rules to request, change and terminate access must review access at least once a year, establishing whether everyone with access to the network, to particular systems and to applications is entitled to it by their duties, and whether external parties such as former employees or supplier representatives hold access and of what kind. System administrators provide the authorised persons with a list of all account holders and their access levels, and the authorised persons record either their confirmation or their instructions for change. Privileged access, meaning higher rights or access to systems a person's role does not call for, is restricted, granted only for a defined period and monitored while in use. Shared files and printers are reachable only from the network the entity controls.