The 12 measures under Art. 22 ZKS – for non-technical managers

On 13 February 2026, the updated Cybersecurity Act (ZKS) (State Gazette No. 17/13.02.2026), which transposes the European NIS2 Directive, entered into force. Art. 22 lists 12 specific measures that every obliged entity – municipality, port, hospital, water and sewerage operator – must apply.

The problem: the text was written by lawyers for lawyers. If you are a mayor, director or manager without an IT background, this article is for you. We explain each measure in plain language with concrete examples.

---

Measure 1: Policies on risk analysis and information security

What the law says (Art. 22, item 1): The organisation must have a written risk management policy.

What it means in practice: A document that says “here are our systems, here are the risks we see, here is what we are doing about them”. It does not need to be 100 pages long – but it must exist, be approved by management and be reviewed at least once a year.

What the Ministry of e-Government (MEU) wants to see: A signed and dated document, a list of critical systems, a risk assessment, responsible persons.

---

Measure 2: Incident handling

What the law says (Art. 22, item 2): Procedures for detecting, analysing and responding to cybersecurity incidents.

What it means in practice: If your website is hacked or your server is encrypted tomorrow – do you know whom to call? Do you have a plan? The procedure describes: who detects the incident, who decides what to do, and who notifies SERIKS (CERT-BG) within 24 hours (Art. 23 ZKS).

What the MEU wants to see: A written procedure, a contact list, evidence of at least one test exercise (tabletop test).

---

Measure 3: Continuity – backup, DRP, BCP

What the law says (Art. 22, item 3): Business continuity, backup management, disaster recovery.

What it means in practice: Three questions: Do you make backups? Have you tested whether the backup actually works? If the server room burns down tomorrow – can you keep working?

What the MEU wants to see: Evidence of regular backups (logs), at least one recovery test, a written BCP/DRP plan.

---

Measure 4: Supply chain security

What the law says (Art. 22, item 4): Management of risks from suppliers and subcontractors.

What it means in practice: Your IT supplier has access to your systems. The hosting company holds your data. If they are hacked – you are affected. You need: a list of all IT suppliers, contracts with security clauses, verification of their measures.

What the MEU wants to see: A supplier register, contracts with SLAs and cybersecurity clauses. Gmail/ABV for business e-mail = an automatic violation here.

---

Measure 5: Security in system development and maintenance

What the law says (Art. 22, item 5): Security in the acquisition, development and maintenance of network and information systems, including vulnerabilities.

What it means in practice: When you commission a new website or software – the technical specification must include security requirements. When your supplier releases an update – you must install it on time, not 2 years later.

What the MEU wants to see: A vulnerability management procedure, evidence of updates (patch management), security requirements in development contracts.

---

Measure 6: Assessing the effectiveness of the measures

What the law says (Art. 22, item 6): Policies and procedures for assessing whether the measures work.

What it means in practice: It is not enough to write a policy – you have to check whether you comply with it. This can be an internal audit, an external audit, or at least an annual review: “We wrote that we make a backup every day – do we really do it?”

What the MEU wants to see: Minutes of an internal review or audit, a list of findings and corrective actions.

---

Measure 7: Cyber hygiene and training

What the law says (Art. 22, item 7): Basic cyber hygiene practices and staff training.

What it means in practice: Employees must know: not to click on suspicious links, not to share passwords, to lock their computer. The training must be documented – not a verbal “we told them”.

What the MEU wants to see: Training minutes with the date, attendees and topics. At least once a year. The head of the organisation (mayor/director) must also have completed training – personal liability under Art. 21 ZKS.

---

Measure 8: Cryptography

What the law says (Art. 22, item 8): Policies and procedures on the use of cryptography, including encryption.

What it means in practice: The website must be on HTTPS. E-mails containing personal data must be encrypted. Databases with sensitive information must be encrypted. The WiFi network must use WPA3/WPA2, not be open.

What the MEU wants to see: HTTPS on all public systems, encrypted databases, an encryption policy.

---

Measure 9: Human resources security and access control

What the law says (Art. 22, item 9): HR security, access control policies and asset management.

What it means in practice: When an employee leaves – their account is deactivated the same day, not 6 months later. Each employee has access only to what they need for their work. There is a list of who has access to what.

What the MEU wants to see: An onboarding/offboarding procedure, an access matrix, evidence of deactivated accounts of former employees.

---

Measure 10: Multi-factor authentication (MFA)

What the law says (Art. 22, item 10): Use of MFA or continuous authentication, where appropriate.

What it means in practice: Administrator accounts must have MFA (password + SMS code or an app). For ordinary users – at your discretion following a risk assessment. The law does not require MFA everywhere – but it does require you to have justified your decision.

What the MEU wants to see: MFA enabled at least for administrator access. If it is not – a written justification of why it is not appropriate (with a risk analysis).

---

Measure 11: Change management

What the law says (Art. 22, item 11): Management of changes to network and information systems.

What it means in practice: Before you change anything in the system – you record what, why, when and who approves it. Not “Ivan updated the server on Friday evening without telling anyone”.

What the MEU wants to see: A change register (change log), an approval procedure, evidence of testing before deployment.

---

Measure 12: Reporting

What the law says (Art. 22, item 12 in conjunction with Art. 23): Notification of significant incidents.

What it means in practice: In the event of a serious incident – you notify SERIKS (cert@government.bg):

• 24 hours – early warning: “We have an incident.”
• 72 hours – notification: “Here is what happened and what we are doing.”
• On request – intermediate report.
• 1 month – final report with analysis and measures.

What the MEU wants to see: A reporting procedure, the SERIKS contact in the emergency contact list, a notification template.

---

Transitional period and deadlines

Until 1 June 2026, sanctions are reduced by 50% – the legislator is giving time to achieve compliance. After that date – full fines.

The ordinance under Art. 3(2) ZKS (the detailed technical requirements) is expected by October 2026. Until then, the current ordinance of 2019 and the direct requirements of Art. 22 apply.

---

What should you do now?

Do not wait for an MEU inspection. Start with three steps:

1. Free AI scan of your public website – detects the main violations in seconds → avigentis.eu/app
2. Download the 48-point checklist – covers all 12 measures in 8 regulatory blocks → Download PDF
3. Order an audit – you receive a report that serves as evidence of good faith before the MEU → avigentis.eu/kontakt

Avigentis EOOD is a cybersecurity consultant, not a guarantor. Responsibility for compliance with the ZKS lies with the entity (Art. 21 ZKS).