Cybersecurity Act Amendment (2024)
Draft legislation expanding sector coverage and incident reporting requirements under NIS2. Introduces stricter requirements than NIS2 baseline, including sector-specific audits. Implementation delayed due to political factors.
| Jurisdiction | Bulgaria |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
- Expanded Sector Coverage: The Cybersecurity Act Amendment (2024) broadens the range of sectors covered, extending beyond the original NIS2 scope to include additional critical and essential service providers, such as digital infrastructure, cloud services, and sectors of national interest. This ensures a wider net of organizations must comply with cybersecurity obligations. Cyber Security Agency of Singapore – Cybersecurity Act QuoIntelligence – NIS2 Explained
- Stricter Incident Reporting: Organizations must report a broader range of cybersecurity incidents, including those affecting third-party suppliers and interconnected systems. The reporting timeline is stringent: initial notification within 24 hours, a detailed report within 72 hours, and a final report within one month. Ransomware payments must be reported within 72 hours, with detailed documentation required. Cyber Security Act 2024 Changes – Practice Protect Goodwin Law – NIS2 Compliance
- Mandatory Sector-Specific Audits: The amendment introduces compulsory, sector-specific cybersecurity audits for regulated entities. These audits assess compliance with technical and organizational measures, supply chain security, and incident response capabilities. Cyber Security Legislative Reforms – CISC Syteca – Cybersecurity Best Practices
- Supply Chain Security Obligations: Providers of essential services must obtain legally binding commitments from third-party vendors to meet cybersecurity standards, ensuring that requirements apply throughout the supply chain. RPC – 2024 Amendments to the Cybersecurity Act CSA – Cybersecurity Act
- Enhanced Management Accountability: Senior management is directly responsible for compliance, including approval and oversight of cybersecurity measures. Failure to comply can result in personal liability and significant administrative fines. Goodwin Law – NIS2 Compliance QuoIntelligence – NIS2 Explained
Compliance Challenges
- Complex Supply Chains: Organizations struggle to ensure third-party vendors comply with new cybersecurity standards, especially when contractual obligations and technical controls must be extended across borders and industries. RPC – 2024 Amendments to the Cybersecurity Act CSA – Cybersecurity Act
- Resource Constraints: Smaller entities face difficulties allocating sufficient budget and skilled personnel to implement robust cybersecurity measures, conduct regular audits, and maintain compliance documentation. eSecurity Planet – 2024 Cybersecurity Laws & Regulations Syteca – Cybersecurity Best Practices
- Incident Reporting Burden: The requirement to report incidents within tight deadlines (24–72 hours) is challenging, especially for organizations lacking mature incident detection and response capabilities. Practice Protect – Cyber Security Act 2024 Changes Goodwin Law – NIS2 Compliance
- Real Example: In the financial sector, a mid-sized accounting firm faced penalties after failing to report a ransomware payment within the mandated 72-hour window, highlighting the operational challenges of rapid compliance. Practice Protect – Cyber Security Act 2024 Changes
Implementation Best Practices
- Conduct a Regulatory Impact Assessment: Evaluate how the new requirements affect your organization and identify compliance gaps. eSecurity Planet – 2024 Cybersecurity Laws & Regulations
- Update Cybersecurity Policies and Incident Response Plans: Ensure policies reflect new reporting obligations, supply chain requirements, and audit protocols. Syteca – Cybersecurity Best Practices Goodwin Law – NIS2 Compliance
- Implement Continuous Monitoring and Regular Audits: Use automated tools for threat detection, vulnerability management, and compliance tracking. Syteca – Cybersecurity Best Practices
- Strengthen Supply Chain Security: Review and update contracts with third-party vendors to include cybersecurity obligations and incident reporting requirements. RPC – 2024 Amendments to the Cybersecurity Act
- Recommended Tools and Resources:
- NIST Cybersecurity Framework
- ENISA NIS2 Implementation Guidelines
Recent Updates
- Broader Incident Reporting: The amendment now requires reporting of incidents affecting not only the organization’s own systems but also those of suppliers and interconnected networks. CSA – Cybersecurity Act RPC – 2024 Amendments to the Cybersecurity Act
- New Classes of Regulated Entities: Entities of Special Cybersecurity Interest (ESCI), Foundational Digital Infrastructure (FDI), and Systems of Temporary Cybersecurity Concern (STCC) are now regulated, even if not previously designated as critical infrastructure. CSA – Cybersecurity Act
- Effective Dates and Deadlines:
- Most provisions commenced on December 20, 2024.
- Additional requirements for new regulated entities will be phased in from April 4, 2025. CISC – Cyber Security Legislative Reforms
Related Regulations
| Regulation/Standard | Description | Interaction/Overlap | Official Link | |---------------------|-------------|---------------------|--------------| | NIS2 Directive | EU-wide cybersecurity requirements for essential/important entities | The Amendment builds on and exceeds NIS2, especially in sector coverage and audit requirements | NIS2 Directive (EU) | | Security of Critical Infrastructure Act (SOCI) | Australian law for critical infrastructure protection | The Amendment clarifies and expands SOCI obligations, especially for data storage and incident response | SOCI Act | | Cybersecurity Act (Singapore) | National framework for CII protection and incident response | The Amendment aligns with and extends Singapore’s approach to supply chain and third-party risk | CSA – Cybersecurity Act |
Industry Impact
- Critical Infrastructure: Operators face increased compliance costs due to expanded audit and reporting requirements, but benefit from improved resilience and government support. CISC – Cyber Security Legislative Reforms QuoIntelligence – NIS2 Explained
- Professional Services (e.g., Accounting): Firms must rapidly adapt to new reporting timelines and data protection standards, with penalties for non-compliance. Enhanced information sharing and CIRB reviews foster industry-wide improvements. Practice Protect – Cyber Security Act 2024 Changes
- Technology and IoT Manufacturers: New device security standards require design changes and compliance statements, impacting product development and supply chain management. Wotton + Kearney – Cyber Security Act 2024
Sources
- Cyber Security Agency of Singapore – Cybersecurity Act
- RPC – 2024 Amendments to the Cybersecurity Act
- CISC – Cyber Security Legislative Reforms
- Practice Protect – Cyber Security Act 2024 Changes
- Wotton + Kearney – Cyber Security Act 2024
- QuoIntelligence – NIS2 Explained
- Goodwin Law – NIS2 Compliance
- Syteca – Cybersecurity Best Practices
- eSecurity Planet – 2024 Cybersecurity Laws & Regulations
- NIST Cybersecurity Framework
- ENISA NIS2 Implementation Guidelines
- SOCI Act (Australia)
- NIS2 Directive (EU)
Recent developments
- — The European Commission presented an action plan to support the safe and responsible use of AI while strengthening Europe’s cybersecurity. The plan complements the EU’s existing cybersecurity framework, including the Cyber Resilience Act, NIS2, DORA, and the Cyber Solidarity Act.[6] (source)
- — The European Commission proposed a new cybersecurity package to strengthen resilience and capabilities against growing threats. The proposal includes amendments to NIS2 and measures to simplify compliance, streamline ransomware data collection, and strengthen supervision of cross-border entities.[6] (source)
- — Key amendments to Singapore’s Cybersecurity Act are now in force, including powers to designate essential service providers responsible for third-party-owned CII and to impose legally binding commitments on third-party owners. The update also notes that some provisions, including FDI and ESCI, remain pending commencement.[5] (source)
- — Several provisions of Singapore’s Cybersecurity (Amendment) Act 2024 entered into force, including major parts of the expanded regulatory framework. The changes broaden oversight and implement the 2024 amendment adopted by Parliament.[4] (source)
- — Singapore’s Parliament passed amendments to the Cybersecurity Act in May 2024. The amendment expands CSA oversight, updates CII-related obligations, and adds new regulated categories such as STCCs, ESCIs, and FDI.[1] (source)
- — A legal analysis of the 2024 amendment explains that the bill was passed on 7 May 2024 and strengthens incident reporting, expands coverage to virtual computers and third-party CII arrangements, and introduces civil-penalty mechanisms for some violations.[3] (source)
- — Singapore’s CSA introduced the Cybersecurity (Amendment) Bill for first reading. The bill was designed to update the 2018 Act and extend regulation beyond CII to STCCs, ESCIs, and FDI.[7] (source)
- — Australia’s Cyber Security Bill 2024 was introduced as part of a broader cyber package to implement measures from the 2023–2030 Cyber Security Strategy. It proposed mandatory security standards for smart devices, ransomware-payment reporting, and a Cyber Incident Review Board.[2] (source)
Related regulations
- Bulgaria NIS2 Transposition — Bulgaria, Active, effective 2025-03-01
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates