Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) 3(1): Senior accountability for network and information security: the head of the entity carries direct responsibility, establishes a management system aligned with BDS ISO/IEC 27001, resources it, controls it through audits and an annual review, and separates duties so nobody checks their own work

What does 3(1) require?

The administrative authority, or the head of an entity in the other four groups, remains directly answerable for network and information security within the ordinance's scope even where work is outsourced. That person must put in place a comprehensive system of security management modelled on BDS ISO/IEC 27001 covering every area that touches network and information security, including the physical protection of systems; fund proportionate organisational, technical and technological measures; exercise control through the audits foreseen in Article 35 (first-party and independent third-party) and through a review of security and of the adequacy of measures at least once a year; and define, document and enforce who executes, who controls and who is kept aware of every process in the development, maintenance and operation of systems, so that nobody is the checker of their own work.