With the increasing complexity and intensity of cyberattacks on a global scale, the EU member states, and in particular of Bulgaria, face a constant need to strengthen their capacities in the field of cybersecurity. In this context, the national cybersecurity system, whose architecture follows a “service-oriented” model, assigns specific responsibilities to the State Agency for National Security (SANS) regarding the protection and resilience of strategic facilities. The legislative framework, including the Cybersecurity Act and the SANS Act, entrusts the Agency with key functions for prevention, monitoring, response, and recovery in case of cyber incidents. The growing number and complexity of cyberattacks, including those targeting critical infrastructure, demonstrate the need for technological upgrades, modernization of the tools used, and enhancement of expert capacity within SANS. Additionally, the dynamic development of threats, including the emergence of new attack vectors through artificial intelligence, the use of cryptocurrencies to finance attacks, and the increasing role of state-sponsored hacker groups, impose new requirements on the institutional response. The expected results from the implementation of the project proposal will have a lasting impact on the work of SANS employees; the accumulated experience and information from the conducted training sessions will be used by agency staff in performing their official duties and will increase their work capacity. The project builds upon previously implemented activities, including the Cyber Incident Monitoring and Response Center established within SANS in 2023. Protection has been ensured for five strategic facilities designated by Council of Ministers Decree № 181/2009. The new project will expand the scope of protection and contribute to enhancing the resilience of the systems through the implementation of modern technologies and optimization of processes for analysis, response, and recovery.