Sunwell Solutions · Based on NIS2 Directive as transposed into Bulgarian law (effective 17 February 2026)
Governance & policies
Documented cybersecurity policy, formally approved and signed off by senior management
[Both]Assigned cybersecurity roles and responsibilities — named individuals, not just job titles
[Both]Board or management meeting minutes showing cybersecurity was discussed and reviewed
[Essential]Record of cybersecurity training completed by senior management in the last 12 months
[Both]Risk management
Current risk register covering cybersecurity risks, with risk owners assigned
[Both]Evidence of a formal risk assessment conducted within the last 12 months
[Both]Vulnerability management process documentation and evidence of recent scans
[Both]Record of how security controls are reviewed following infrastructure or threat changes
[Essential]Incident response
Documented incident response plan including detection, containment and recovery steps
[Both]Evidence of incident response plan testing (tabletop or live test) in last 12 months
[Both]CERT Bulgaria notification contact and 24/72-hour reporting workflow documented
[Both]Log retention policy and evidence of centralised logging in place
[Essential]Supply chain
Register of critical technology suppliers and service providers
[Both]Evidence of security assessments or questionnaires completed for key vendors
[Both]Contracts with critical suppliers containing cybersecurity requirements or SLAs
[Essential]Access control & technical measures
MFA enforced on all administrative and privileged accounts — evidence of configuration
[Both]Access review completed in last 6 months — evidence that least privilege is applied
[Both]Network segmentation documentation showing separation of critical systems
[Essential]Encryption policy covering data at rest and in transit
[Both]Business continuity
Backup and recovery procedures documented with defined RTO and RPO targets
[Both]Evidence of backup restoration test completed within the last 12 months
[Both]Business continuity plan covering cyber incident scenarios, with named crisis contacts
[Both]Crisis communication plan — who is notified internally and externally during an incident
[Essential]