Cybersecurity stopped being an IT-department-only topic a long time ago. Under Bulgaria's new Cybersecurity Act, which transposes the EU's NIS2 Directive, accountability now rests personally with an organisation's leadership. That changes the conversation: the question is no longer whether your company has antivirus software, but whether you can prove you manage the risk.
What has changed
In his analysis for Digitalk, Alexander Glavchev describes three changes every business owner will notice:
- Connectivity, remote work and automated attacks have made security a basic necessity rather than an optional extra.
- The law places personal responsibility on the people who run organisations.
- Partners increasingly ask for proof of compliance before any work even begins.
That last point is probably the most visible in practice. Security questionnaires, requests for policies and evidence of backups and access control now show up even in relatively small contracts.
A checklist for small and mid-sized businesses
Whether a particular company falls within the scope of the law depends on its sector and size, so we're not offering a legal assessment here. There are, however, measures that make sense for any organisation with a website, an online store or customer data:
- Inventory. A list of your systems, domains, hosting and email services, and who has access to them.
- Two-factor authentication for admin accounts on your website, hosting, domain and email.
- Backups stored off your hosting and at least one real restore test.
- Updates to WordPress, your theme and plugins on a schedule, not "when there's time".
- An incident plan: who does what if the site goes down or is compromised.
- Suppliers: do you know which third-party services process your customers' data?
Where your website fits in
A website is often the most visible point of attack: outdated plugins, weak passwords, forms without spam protection and missing backups. From a web development perspective, security has to be part of the project from the build stage, not an add-on after the first incident. That's why in our services WordPress maintenance and security are a topic in their own right, not a footnote.
Related reading: AI agents acting as cybercriminals and why managers are a frequent ransomware target.
Source: Digitalk: Cybersecurity - new rules, new threats, new solutions (in Bulgarian). This article is an independent analysis by Penkov Studio.
