Cybersecurity for municipalities and public bodies

Three ways to start

What the Act requires of a public administration

• Administrative bodies are covered by the Act (Art. 4(1)) and are essential entities regardless of size (Art. 4a(1)(4)). Every municipality is covered through its mayor as an executive body. The judiciary and organisations that provide administrative services electronically are also covered (Art. 4(7)–(9)).
• The national competent authority for administrative bodies is the Ministry of Innovation and Digital Transformation (Art. 16(2)).
• The head of the body approves the risk-management measures and oversees their implementation (Art. 21(1)).
• Management completes cybersecurity training every two years and organises training for staff (Art. 21(2) and (3)).
• For a breach of Art. 21 the head of the body can be fined personally — EUR 500 to 5 000 (Art. 29(4)).
• The authority can order the administration to announce the breach publicly (Art. 27i(1)(7)). If an enforcement measure is not complied with, the sanction on the organisation is EUR 2 500 to 12 000 (Art. 28(1)).
• A significant incident is reported to СЕРИКС: an early warning within 24 hours and a notification within 72 hours of establishing it (Art. 23(5)).
• Minimum measures are set by an ordinance under Art. 3 of the Act. As of 30 September 2026 the 2019 ordinance is in force; the statutory deadline for the new one falls around mid-October 2026. We check what applies at the time of the engagement.

Your IT specialist or contractor keeps the systems running every day. The Act also requires something else: management decisions, a risk assessment and evidence that the measures work. We take on that part — together with them, not instead of them.

General information, not a legal opinion. Separate legal support can be agreed for a specific legal question. Regulatory reference

The whole path — and who delivers each part

You do not need to commission everything at once. Detail on each step: Bulgarian Cybersecurity Act programme.

Related obligations we help with: personal data and DPO, e-government, internal control, AI, whistleblowing, open data

Cybersecurity is not the only thing the law asks of a public administration. These areas connect with it and can be commissioned separately or together.

Area	Basis	What you receive	Who is responsible	Boundary
Personal data and the data protection officer	GDPR (General Data Protection Regulation) and the Bulgarian Personal Data Protection Act. Public authorities must as a rule have a data protection officer (GDPR Art. 37(1)(a)); courts acting in their judicial capacity are excepted.	An external data protection officer or support for your internal one; a review of processing, access, retention periods and processor contracts; impact assessments where risk is high — for example video surveillance or biometrics; one process for personal-data breaches and cyber incidents; training. (audit and impact assessment)	The team’s legal specialist and the security lead	An external data protection officer is independent and does not also hold roles that decide the purposes and means of processing. An impact assessment is required where risk is high, not for every system. We take on the role for many municipalities at once — each with a designated responsible person.
E-government	The Bulgarian E-Government Act and its ordinances — electronic administrative services, electronic documents and information systems.	Assessment and acceptance of electronic services and information systems: a review of services, identification, signing and document flow; architecture, integrations and interoperability; technical requirements for new systems; an acceptance plan and checks for delivered software.	Development, architecture and DevOps specialists, led by the security lead	We do not replace the supervisory bodies. Legal questions are settled with the legal specialist.
Internal control and IT risk	The Public Sector Financial Management and Control Act requires risk management and effective internal control.	IT and cyber risks in the organisation’s risk register; segregation of duties; control of privileged access, changes and suppliers; measures against payment fraud through changed bank details; evidence for internal auditors.	The security lead	We do not perform full financial control or statutory internal audit — our role is the specialist IT-risk work.
Artificial intelligence	The EU AI Act also applies to public bodies that use or provide AI systems.	An inventory of the tools and systems in use; roles, risk and applicable obligations; rules for data, approval and human oversight; AI literacy; supplier assessment; preparation for a fundamental rights impact assessment where use is high-risk.	The security lead, the legal specialist and the human-factors specialist	Obligations for high-risk systems apply from 2 December 2027 (Annex III) and from 2 August 2028 (regulated products, Annex I).
Whistleblowing channels	The Bulgarian Whistleblower Protection Act.	Internal rules, training for the responsible staff, a secure technical environment, restricted access and confidentiality checks.	The team’s legal specialist and the security lead	Public bodies may not outsource the receipt, registration or examination of reports. We help you build and run the internal process (reporting channel).
Open data and access to information	The Access to Public Information Act and the re-use rules, including high-value datasets.	A data inventory and classification, preparation for publication, anonymisation, a re-identification risk review, API security.	Data and security specialists, with the legal specialist on legal questions	Decisions on access and restrictions are the organisation’s and are prepared with the legal specialist.

More on artificial intelligence: AI use and governance review. The people behind the roles are introduced on the team page.

Procurement and budget

We help prepare the technical specification: activities and stages, deliverables, acceptance, on-site visits, what is expected from your IT team or contractor and how sensitive information is handled. First steps are usually below the threshold for award without a procedure under Art. 20(4) of the Public Procurement Act. We also prepare a justification of the expense — what the Act requires, what comes next and what each stage delivers — for next year’s budget and for the internal procurement documents. Details about Dyasol as a contractor are in the supplier information.

Discuss your case

Details: systems in scope, example, boundaries

The systems that are usually in scope

For example: records-management and electronic document flow; local taxes and fees; portal and electronic administrative services; accounting and payroll; the organisation’s email and domain; video surveillance and building access; systems maintained by an external IT contractor.

Many municipalities have no IT department of their own and rely on an external contractor. The responsibility stays with management — so we also set out what the contractor must do and how it is verified.

Example: part of the matrix for one municipality

Fictional data — an illustration of the format, not a client case.

Requirement	Status	Evidence	Gap	Action
Management approves the measures (Art. 21(1))	Policy exists, no decision	Draft policy from 2025	No mayor’s act	Approval order; annual review
Management training (Art. 21(2))	Not held	—	No record	Session by quarter end; attendance list and test
Backups of the records-management system	Done by the contractor	Support contract	Restore never tested	Restore test with a written record
Reporting a significant incident (Art. 23(5))	No procedure	—	No contacts or criteria	Procedure, СЕРИКС templates, exercise
External IT contractor access	Shared admin account	—	No named access or review	Named accounts, multi-factor sign-in, six-monthly review

Boundaries

• We are not a certification body and do not replace supervision.
• Technical containment of an incident and round-the-clock response are not part of the standard support — they are provided through a vetted partner under a separate contract.
• For large critical-infrastructure operators we take on a defined, agreed part of the programme.
• Classified information and system accreditation are not a standard service — we take them on only after checking the required clearances and available specialists.