Back to Frameworks
Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019)
Bulgaria
vDecree No. 186 of 26 July 2019 (SG 59/2019), as amended by SG 36/2022 and SG 47/2022 (in force 24 June 2022); English translation held, read 2026-10-19
4 domains
43 controls
Bulgaria's minimum network and information security measures for public administration, essential service operators and digital service providers under the Cybersecurity Act: governance, policy, risk, asset, HR, supplier, change, access, hardening, web and DNS, logging, incident notification, backup, continuity and yearly internal audit duties, with the compliance inspection regime and the register of essential services.
Verified
Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) is a compliance framework from Bulgaria with 4 domains and 43 controls that map to 2 other frameworks. The largest domains are Chapter Two, Section II: protection (Articles 13 to 31) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) (26 controls), Chapter Two, Section I: management of network and information security (Articles 3 to 12) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) (12 controls), Chapter Two, Section III: resilience (Articles 32 to 34) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Maintained by Gerard Blokdyk
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Chapter Three: control through audits, inspections and surveys (Articles 35 to 37) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019)
1 controls
| Code | Title |
|---|---|
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::35 | Verify compliance with Chapter Two and adopted standards through internal audits at least yearly under BDS EN ISO 19011 and BDS EN ISO/IEC 17020, by qualified, impartial auditors who never audit their own work, following approved procedures, programmes and plans, documenting results and non-conformities with rectification deadlines, classifying results TLP-AMBER and providing them to the competent authority |
Chapter Two, Section I: management of network and information security (Articles 3 to 12) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019)
12 controls
| Code | Title |
|---|---|
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::10 | Contract network and information security requirements with every third-party supplier (access controls, proof of their own measures, supply chain transparency, consequences, liability for service failures, incident cooperation), assign an owner for supplier compliance and prepare a plan for supplier non-compliance |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::11 | Manage changes to critical information assets under internal rules: assess risk first, plan with deadlines and responsibilities, coordinate with affected process owners, obtain approval, notify interested parties at least three days ahead, test in a test environment, and hold a rollback plan |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::12 | Build security into projects and technical requirements for new or changed systems on the basis of risk assessment, and introduce new systems only in a planned way after documented tests prove availability, integrity and confidentiality are protected |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::3(1) | Senior accountability for network and information security: the head of the entity carries direct responsibility, establishes a management system aligned with BDS ISO/IEC 27001, resources it, controls it through audits and an annual review, and separates duties so nobody checks their own work |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::3(2)-(3) | Appoint a staff member or unit responsible for network and information security reporting directly to the head of the entity, with a counterpart in every territorial structure running distributed systems |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::4 | Adopt a network and information security policy stating strategic security objectives and the approach to reaching them, covering the topical sub-policies, reviewed at least yearly and updated when needed |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::5(1)-(2) | Maintain the prescribed documentation set (asset descriptions, network topology, information flows, cabling, system documentation, operating instructions and user rules), identified, current, approved, classified and restricted to those who need it |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::5(3)-(4) | Keep information that conclusively proves compliance with the ordinance, up to date and available only to staff who need it, to the national competent authority under Article 16(5) of the Cybersecurity Act and to bodies authorised by law or contract |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::6 | Classify information through internal rules on marking, use, processing, exchange, storage and destruction, extend the classification to the resources that handle it, mark documents, keep statutory classified-information markings out of the scheme, and use the Traffic Light Protocol for exchanges |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::7 | Run a documented, repeatable risk analysis and assessment at least yearly and on significant change, with an approved methodology, defined unacceptable-risk levels and named roles, and turn it into a risk mitigation plan with measures, resources, deadlines and owners |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::8 | Govern the lifecycle of systems and components through internal rules (acquisition, deployment, maintenance, relocation, decommissioning, destruction) and keep an asset description with identification, characteristics, services served, location, dates, version, documentation location and owner |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::9 | Secure human resources through internal rules on hiring, security duties on exit or role change, disciplinary procedures, documented responsibilities with deadlines, professional training and scheduled, traceable awareness briefings |
Chapter Two, Section II: protection (Articles 13 to 31) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019)
26 controls
| Code | Title |
|---|---|
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::13 | Separate systems with different functions physically or logically from each other and from third-party systems, and separate subsystems at the final physical or logical level so an incident cannot spread |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::14 | Filter traffic between systems and subsystems on approved rules by address, protocol and port, review the rules for unauthorised change and update them against new threats, and block unneeded TCP and UDP ports |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::15 | Set clear policies, written into internal rules with matching measures, on personal devices inside the entity's network and on portable storage devices |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::16 | Set policies and internal rules for cryptographic mechanisms that protect the confidentiality and integrity of sensitive information according to its classification, matched to the threats and to regulatory requirements |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::17(1) | Protect administrative accounts: change vendor defaults before deployment, make them personal, use them only for administration, grant them only to administrators within their perimeter, give them unique high-complexity credentials under physical and logical protection, keep a list, suspend them when the holder is unavailable, and review them yearly |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::17(2)-(4) | Rotate administrator passwords at least yearly, on departure of anyone who knew them and after a breach; log every privileged operation per administrator profile under Articles 5 and 29; never store administrator passwords in the documentation, plain or hashed |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::18 | Administer systems only from a separate, secured administration environment isolated from other systems and from the internet and used for nothing else, or else protect the administration flows with authentication and encryption |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::19(1)-(3) | Grant access to systems only where strictly necessary: define role-based access rights and request, change and termination procedures in internal rules, enforce authentication, authorisation and audit with password complexity (mixed character classes, at least 8 characters for users and 12 for administrators, user passwords changed at least every six months), and give each user a personal profile with least privilege |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::19(4)-(6) | Review all access at least yearly through the persons authorised to grant it, using administrator-provided lists of accounts and levels and recording confirmations or changes; limit privileged access to a defined period under monitoring; allow access to shared files and printers only from the entity's own network |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::20 | Protect remote access and teleworking under the Article 19 rules with at least two-factor authentication, only high-protection channels such as VPN, and no FTP or Remote Desktop Connection exposure |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::21 | Protect hardware against technical failure and unauthorised access: maintain and monitor the manufacturer's environmental and mechanical conditions, run planned maintenance under the lifecycle policy, and place devices in physically and logically protected zones matching the information they handle |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::22(1)-(4) | Run only supplier-supported, security-current software and firmware approved by the head of the entity, keep a distribution library for fast recovery, and prevent the installation and use of unauthorised software and firmware |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::22(5)-(8) | Through internal rules keep the distribution library current and access-controlled, track newly published vulnerabilities and fixes for the software and firmware in use, verify the origin and integrity of updates before installing them under Article 11, configure devices to supplier recommendations and Annex 4, keep an offline, access-controlled copy of configurations, and check configurations regularly for unauthorised change |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::23 | Deploy anti-intrusion and anti-malware measures on every component where possible, keep them current, run full scans at least weekly where applicable, scan email, downloads and portable media before opening, and periodically assess and improve their effectiveness |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::24(1)-(3) | Secure web servers with a unique certificate from a trusted certification authority (SHA-2 or stronger, current, expired certificates revoked), HTTPS only over TLS 1.2 or 1.3 or newer, and encryption of exchanged information under the Article 16 rules within IETF restrictions |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::24(4)-(8) | Protect web applications with a web application firewall against CSRF, XSS, file inclusion and SQL injection, accept user input only at designated points, validate all client-supplied data including referrer and user-agent headers, reject special characters used in SQL, and HTML-encode client data before display |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::24(9)-(15) | Harden web services against denial of service and brute force (request and header limits, timeouts, failed-logon limits), suppress directory listings, set Secure and HttpOnly cookie flags, send the Annex 5 security response headers, publish a robots.txt, and rename the default CMS administration path |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::25 | Protect DNS: place multiple DNS servers in different networks, deploy DNSSEC, minimise queries per RFC 7816, forbid zone transfers, and publish DMARC and SPF records |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::26 | Provide physical protection for information assets against unauthorised access and against fire, flooding and chemical or physical changes in the air, proportionate to the assets, and monitor that the measures work |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::27 | Where industrial control systems underpin the essential services provided, protect them with appropriate measures in line with the regulations that apply to them |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::28 | Operate automated event detection on critical systems by analysing flows, protocols and files at key points, positioned to see all traffic between the entity's systems and third parties, and organise monitoring and response to its alerts through internal rules |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::29(1)-(3) | Log on application servers for critical activities, infrastructure and security devices, ICS engineering stations, network equipment and administrator workstations at least authentication, profile management, access rights, security policy changes and system operation events, timestamp each entry exactly, and synchronise all clocks to UTC with NTP version 4 and ISO 8601 representation |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::29(4)-(6) | Restrict log access, read-only, to monitoring and incident staff and to lawful investigators of serious and computer crimes, archive logs for at least twelve months under the Article 32 backup rules, and be able to correlate and analyse logs from different sources to detect security events |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::30(1)-(2) | Regulate incident handling through internal rules covering reporting, the incident log and its keepers, logging, verification, classification and prioritisation of signals with feedback to the reporter, functional and hierarchical escalation, status information, closure, evidence collection for legal action, and access rights to the log |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::30(3)-(4) | Maintain current response plans for the incidents with the gravest impact (incident lead, notifications, measures and owners, consultation, monitoring during the incident, evidence collection) and a communication strategy for staff, partners, suppliers, clients, media and public authorities |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::31 | Notify the sectoral CSIRT of incidents within the Cybersecurity Act deadlines through the security officer, using the Annex 7 form (initial data within two hours, full report within five working days), with the sectoral team passing Annex 8 statistics to the national CSIRT, and protect and TLP-classify any emailed notification |
Chapter Two, Section III: resilience (Articles 32 to 34) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019)
4 controls
| Code | Title |
|---|---|
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::32(1)-(3) | Set backup and archiving rules aligned to the security policy that fix what is backed up, the technology, backup type, frequency, number of copies, retention per copy, storage location, protection against unauthorised access, usage scenarios and the approver, all determined with the information owner and matched to the recovery time objective |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::32(4) | Execute backups to the risk of loss and rate of change, label copies with content, system, method, date and time, encrypt or at least password-protect copies of sensitive information, store copies on separate machines and where possible in separate secure networks, hold one offline copy of critical operational information off site, and test copies regularly for adequacy and recovery time |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::33 | Provide redundancy proportionate to risk to sustain in-scope services: backup systems, backup devices, load balancing of critical devices or systems, and backup data centres |
| bulgaria-ordinance-on-minimum-requirements-for-network-and-information-security-2019::34 | Hold emergency and continuity action plans for events that could disrupt services, stating the circumstances, activation thresholds, the approver of activation and the restoration procedures to a defined level; test them at least yearly, keep them current, restrict them to those who execute them, and store them in two locations including one away from the systems |
Maps to 2 other frameworks
43 total controls
ISO 27002:2022
38 source controls mapped|42 target controls covered
88%
NIS2 Directive
2 source controls mapped|2 target controls covered
5%
Coverage is not the same as your position
This page shows what Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) and who does it apply to?
Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) is a compliance framework from Bulgaria with 4 domains and 43 controls. Bulgaria's minimum network and information security measures for public administration, essential service operators and digital service providers under the Cybersecurity Act: governance, policy, risk, asset, HR, supplier, change, access, hardening, web and DNS, logging, incident notification, backup, continuity and yearly internal audit duties, with the compliance inspection regime and the register of essential services. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) actually require?
Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) has 43 controls organised across 4 domains. The largest domains are Chapter Two, Section II: protection (Articles 13 to 31) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) (26 controls), Chapter Two, Section I: management of network and information security (Articles 3 to 12) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) (12 controls), Chapter Two, Section III: resilience (Articles 32 to 34) – Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) do I already cover?
Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) maps to 2 other compliance frameworks. The top mapping partners are ISO 27002:2022 (88% coverage), NIS2 Directive (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019)?
Start your Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 43 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,049 frameworks.
Get Started Free →Free forever, no credit card required