NIS2 readiness and implementation services help organisations translate applicable cybersecurity obligations into a governed programme of risk management, technical measures, incident readiness and evidence. The service is intended for organisations that may be essential or important entities, suppliers to covered organisations, or management teams that need a structured view of their Bulgarian NIS2 readiness.
This work turns compliance and risk ambiguity into fundable, evidenced, owned decisions.
We agree the precise scope up front. Depending on the objective, environment and authorised access, the engagement may cover:
Document assumptions about entities, services, sector and current Bulgarian requirements, with legal questions clearly identified.
Review management oversight, policies, risk records, control ownership and operating evidence.
Examine the controls relevant to the agreed scope and risk profile.
Prioritise legal, governance and technical actions with accountable owners and dependencies.
Review completed evidence and test incident and management decision processes through workshops or exercises.
Outputs are prepared for executives and for the technical teams doing the remediation. Depending on scope, they may include:
CTG confirms the decision to be supported, the evidence threshold, responsible stakeholders and the distinction between advisory work, implementation, legal interpretation and independent assurance. Findings are linked to owners, dependencies and measurable next actions.
The engagement may draw on Directive (EU) 2022/2555, the Bulgarian Cybersecurity Act as amended, ENISA guidance, ISO/IEC 27001 and NIST CSF where useful. Where we cite a standard, it explains our method only - it is not a certification, accreditation or official determination.
We confirm the timeline at scoping; it reflects the environment's complexity, the evidence on hand and access to the right people.
CTG provides cybersecurity assessment and implementation support, not formal legal advice or a regulatory determination. NIS2 is not a general certification scheme, and readiness work cannot guarantee that a competent authority will reach a particular conclusion.
NIS2 (Directive (EU) 2022/2555) was transposed into Bulgarian law by amendments to the Cybersecurity Act (Закон за киберсигурност), adopted by the National Assembly on 5 February 2026 and promulgated in State Gazette No. 17 on 13 February 2026. NIS2 is a legal obligation, not a certification: no organisation is NIS2 certified, and no consultancy can make a client NIS2 accredited. CTG helps you establish applicability (essential vs important entity), close governance and technical gaps, and build the evidence a competent authority may expect, including incident-reporting readiness (early warning within 24 hours, notification within 72 hours, final report within one month).
Discuss NIS2 Readiness and Implementation with CTG. In a focused scoping call we agree the objective, scope, evidence, delivery model and outputs, then send a proposal.
We agree the precise scope up front. Typical areas include potential applicability, entities, services and sector context, Management-body governance, training and oversight, Cyber-risk policies, ownership and treatment, and Incident handling and reporting readiness. The proposal documents what is out of scope, what access we need, what you provide and how success is judged.
Deliverables depend on the agreed objective and may include applicability and scope assessment, NIS2 gap and evidence matrix, Governance and responsibility model, and Prioritised remediation roadmap. We connect each key conclusion to its evidence, its impact, its priority and an accountable action.
CTG normally requests the policies, registers, governance records, technical evidence and previous assessments relevant to the agreed scope. The evidence request is tailored so that the customer does not collect material that will not be used.
No. CTG provides cybersecurity assessment and implementation support within the agreed scope. Formal legal interpretation, statutory assurance and accredited certification remain separate.
We confirm the timeline at scoping; it reflects the environment's complexity, the evidence on hand and access to the right people.
They address adjacent but separate needs. Scoping identifies whether NIS2 Readiness and Implementation, Cybersecurity Maturity Assessment, or a coordinated programme is the smallest useful approach without duplicating work.
CTG provides cybersecurity assessment and implementation support, not formal legal advice or a regulatory determination. NIS2 is not a general certification scheme, and readiness work cannot guarantee that a competent authority will reach a particular conclusion.
