Contents
To assess the actual state of digital readiness of Bulgarian municipalities, Avigentis analysed the websites of Bulgarian municipalities from the standpoint of the requirements related to GDPR and NIS2.
The aim of the analysis is not merely to check for the presence of individual elements on municipal websites, but to assess the level of fulfilment of the criteria examined, relating to the mandatory requirements for personal data protection and to the additional recommendations and good practices for cybersecurity.
As a result of the audit and analysis of all municipalities for the first half of 2026, we see the following performance indicator:
What do the results show?
The results show that even the basic level of compliance cannot be considered fully achieved.
The 64% indicator for the mandatory minimum is particularly important. It shows that, within the methodology used, there is a significant number of criteria on which further improvement is needed.
What does the 64% indicator mean?
The indicator of 64% in the category “MANDATORY MINIMUM – GDPR / APPLICABLE REQUIREMENTS” means that, within the methodology of the analysis performed, the established level of fulfilment of the mandatory criteria examined is 64%.
Important clarification
This does not mean that a municipality is “64% compliant with GDPR” in the legal sense.
GDPR does not introduce an official compliance scale from 0 to 100%, and this percentage is not a certificate or an official assessment by the Commission for Personal Data Protection.
The indicator is, however, a very useful diagnostic tool. It allows the municipality’s management to understand quickly what share of the criteria examined has already been met and where potential risk areas remain.
The result should therefore be viewed as a GAP analysis, and not as a legal opinion on full or partial compliance with GDPR.
What does the 67% indicator mean?
The second category – “ADDITIONAL RECOMMENDATIONS – NIS2 / GOOD PRACTICES” – shows a result of 67%.
It assesses additional elements related to the level of cybersecurity maturity, the resilience of the digital infrastructure and practices consistent with the NIS2 approach.
This is particularly important because NIS2 requires not only the existence of formal documents, but a systematic approach to cyber risk management.
Why should the two indicators be considered together?
Cybersecurity cannot be reduced solely to the protection of personal data.
A municipality may have relatively well-organised GDPR documentation and still have an insufficient level of:
- server protection;
- access management;
- MFA;
- monitoring;
- backup;
- vulnerability management;
- incident response;
- supplier oversight;
- disaster recovery;
- cyber risk management.
Two dimensions of digital security
GDPR → protection of personal data
NIS2 → resilience and cybersecurity of the organisation
64% is not a reason to panic – it is a reason to act
The right response to this result is not to look for someone to blame. The result should be used as a starting point for a programme to raise the level of cybersecurity of the municipality.
Identifying critical non-conformities
Categorise the problems as Critical → High → Medium → Low and eliminate the most dangerous risks first.
Technical audit
Check servers, network infrastructure, firewall, VPN, Active Directory, user accounts, MFA, databases, backup, cloud, endpoint security, vulnerability management, logging and monitoring.
GDPR audit
Check the entire life cycle of personal data: collection → processing → storage → transfer → access → archiving → erasure.
NIS2 GAP analysis
Compare the actual state of the municipality with the requirements of the Cybersecurity Act (ZKS) and the relevant cyber risk management practices.
Roadmap for remediating the risks
Create a specific plan with priorities, owners, deadlines and a budget.
Sample action plan
| Priority | Problem | Risk | Action required | Deadline |
|---|---|---|---|---|
| Critical | Critical vulnerability | High | Remediation | 7 days |
| High | No MFA | High | Introducing MFA | 30 days |
| High | Insufficient backup | Very high | Changing the backup policy | 30 days |
| Medium | Shortcomings in the GDPR documentation | Medium | Updating the documentation | 60 days |
The website analysis is only the first level
It must be emphasised: an analysis of the municipality’s public website is not equivalent to a full audit under NIS2 or GDPR.
The website is only the external digital perimeter.
Information systems → databases → servers → employees → suppliers → cloud services → internal networks → personal data → backups.
That is precisely why the results of 64% / 67% should be viewed as an important indicator pointing to the need for a more in-depth review.
What should the next step be?
For a municipality, the right approach is not to wait for the first inspection or the first serious cyber incident.
GAP analysis → technical audit → GDPR audit → NIS2 assessment → risk management → corrective actions → follow-up audit
This creates a continuous cycle of improvement.
Conclusion
The indicators obtained from the Avigentis analysis:
should not be regarded as a final assessment. They should be a starting point for action.
“Can we prove that our information systems, personal data and digital municipal services are actually protected?”
This is precisely the question that a full-fledged and independent audit must answer.
NIS2 and GDPR are not just a matter of sanctions. They are a matter of protecting citizens, the continuity of municipal services, the accountability of management and public trust in the digital state.
For Bulgarian municipalities, 2026 is the moment not merely to “check the IT”, but to carry out a comprehensive independent NIS2 + GDPR audit, to create a risk register and a specific roadmap for remediating the non-conformities, with priorities, deadlines and responsible persons.
