NIS2 Pre-Audit Preparation Checklist

Sunwell Solutions · Based on NIS2 Directive as transposed into Bulgarian law (effective 17 February 2026)

Disclaimer: This checklist is for preparation purposes only and does not constitute legal advice. Confirm your specific obligations with a qualified legal or compliance advisor.

Governance & policies

Documented cybersecurity policy, formally approved and signed off by senior management

[Both]

Assigned cybersecurity roles and responsibilities — named individuals, not just job titles

[Both]

Board or management meeting minutes showing cybersecurity was discussed and reviewed

[Essential]

Record of cybersecurity training completed by senior management in the last 12 months

[Both]

Risk management

Current risk register covering cybersecurity risks, with risk owners assigned

[Both]

Evidence of a formal risk assessment conducted within the last 12 months

[Both]

Vulnerability management process documentation and evidence of recent scans

[Both]

Record of how security controls are reviewed following infrastructure or threat changes

[Essential]

Incident response

Documented incident response plan including detection, containment and recovery steps

[Both]

Evidence of incident response plan testing (tabletop or live test) in last 12 months

[Both]

CERT Bulgaria notification contact and 24/72-hour reporting workflow documented

[Both]

Log retention policy and evidence of centralised logging in place

[Essential]

Supply chain

Register of critical technology suppliers and service providers

[Both]

Evidence of security assessments or questionnaires completed for key vendors

[Both]

Contracts with critical suppliers containing cybersecurity requirements or SLAs

[Essential]

Access control & technical measures

MFA enforced on all administrative and privileged accounts — evidence of configuration

[Both]

Access review completed in last 6 months — evidence that least privilege is applied

[Both]

Network segmentation documentation showing separation of critical systems

[Essential]

Encryption policy covering data at rest and in transit

[Both]

Business continuity

Backup and recovery procedures documented with defined RTO and RPO targets

[Both]

Evidence of backup restoration test completed within the last 12 months

[Both]

Business continuity plan covering cyber incident scenarios, with named crisis contacts

[Both]

Crisis communication plan — who is notified internally and externally during an incident

[Essential]