What is the NIS2 Directive and does it apply in Serbia?

NIS2 is a European Union directive on the security of network and information systems. Although Serbia is not an EU member, the national Law on Information Security is aligned with NIS2 and introduces similar obligations for companies in certain sectors.

Which companies must comply with the Law on Information Security?

Companies in sectors such as energy, transport, banking, healthcare and digital infrastructure if they exceed the size threshold (usually 50+ employees or a corresponding annual turnover), as well as companies in special categories (critical infrastructure, sole service provider) regardless of size.

What are the consequences if a company does not meet its NIS2 obligations?

Non-compliance can lead to fines as well as reputational and business consequences, including the loss of trust of partners and clients who require compliance from their suppliers.

What if the check shows that my company is not covered?

It is still worthwhile improving your basic security infrastructure — legal obligations can be extended over time, and good security practice reduces the risk of cyber incidents regardless of any legal obligation.

NIS2 Check - Does the Law Apply to Your Company?

NIS2 Applicability and Security Posture Check

Answer the questions in two steps. The result is for information only and is based on the Serbian Law on Information Security and the NIS2 Directive — it does not replace an official assessment.

Step 1 — Does your company fall under NIS2?

Company name (for the report, optional)

Main business activity

Company size

Special categories (if applicable) Sole provider of a particular key service in Serbia iThe company is the only provider of a service essential to the functioning of the economy or society, with no realistic alternative on the market. Part of critical infrastructure (CER Directive) iInfrastructure whose interruption seriously endangers security, the economy or public health (e.g. energy systems, transport routes, hospitals). Qualified trust service provider / TLD registry / DNS provider iCompanies that issue electronic certificates/signatures, manage the .rs domain or provide DNS services key to the operation of the internet. Public administration body or local government unit iMinistries, agencies, municipalities, cities and other public authorities.

Step 2 — Current security infrastructure

Firewall at the network perimeter
Antivirus / EDR (Endpoint Detection & Response) on all devices
Backup and disaster recovery (tested, incl. offsite/cloud copy)
Multi-factor authentication (MFA) for critical accounts
Network segmentation (VLANs for critical systems)
Vulnerability and update management (patch management)
Information security policy (written ISMS document)
Incident response plan
Access control — principle of least privilege (RBAC)
Data encryption (at rest and in transit)
Employee security training (security awareness)
SIEM / centralised logging and monitoring
Business continuity and disaster recovery (BCP/DRP)
Supply chain security (supplier/partner checks)

This is an informational self-assessment, not an official legal classification. The final assessment is made by the competent authority / a professional consultant.

For a detailed assessment and a compliance plan tailored to your company, request a free consultation.