Resources

The Law on Information Security, aligned with the EU NIS2 Directive, brings concrete obligations for companies in Serbia — from risk assessment to incident reporting. Here you will find an overview of the legal framework, obligations by sector and the incident reporting procedure. If you are not sure whether this applies to your company, first try the free NIS2 check.

Latest: Serbia’s energy sector targeted by cyberattacks | Your online store is a target | NIS2 enforcement accelerates in the EU

Guide — Frequently Asked Questions about NIS2

Legal Framework

The main regulation is the Law on Information Security, which follows the logic of the EU NIS2 Directive (2022/2555) but with national terminology — instead of “essential” and “important” entities, the law uses the terms operator of a priority ICT system and operator of an important ICT system. Implementing regulations are being adopted gradually; until they are adopted, previously adopted regulations remain in force.

The law requires all operators, regardless of sector, to take three basic measures: adopt a risk assessment document, apply the prescribed protective measures, and report incidents to the competent authorities. Sector regulations (below) add specific requirements on top of this minimum.

Obligations by Sector

The law divides operators into priority and important operators, depending on the sector and company size — the same division used by our check tool. Select your sector to see which regulations and competent authorities specifically apply to your activity, in addition to the general obligations above.

Select a sector above to see which regulations specifically apply to your activity.

Priority sector

Energy

Companies in electricity, gas, oil, district heating and hydrogen are classed as operators of priority ICT systems. In addition to the general obligations under the Law on Information Security, the sector also has specific regulations on risk preparedness in supply.

Priority sector

Transport

Air, rail, water and road transport — infrastructure operators and carriers with significant traffic volumes are subject to priority obligations.

Priority sector

Banking and finance

Banks, insurance companies, pension funds, leasing and payment institutions have the most developed regulatory framework in Serbia — the National Bank of Serbia (NBS) prescribes detailed ICT standards independently of the Law on Information Security, and they apply in parallel.

  • NBS — Minimum ICT system management standards
  • NBS — Decision on minimum ICT system management standards for financial institutions
  • NBS — rules on entrusting activities to third parties (outsourcing)
  • NBS — technical authentication standards and video identification standards
Priority sector

Healthcare

Healthcare institutions, manufacturers and distributors of medicines, and institutions managing patient health data are subject to priority obligations — special protection of health data as a sensitive category of personal data also applies.

Priority sector

Digital infrastructure and ICT services

DNS providers, data centres, cloud providers, telecoms operators and companies managing ICT systems for others (MSP/MSSP) are at the heart of NIS2 obligations — this is the sector with the most direct impact on the security of the entire national digital infrastructure.

Priority sector

Public administration

Public administration bodies and local government units are covered regardless of size — the public sector receives special treatment under the law.

Important sector

Postal services

Postal and courier operators with a significant market share are subject to important-sector obligations.

  • RATEL — oversight of postal services
Important sector

Food production

Larger food manufacturers and distributors are subject to important-sector obligations, especially if they are part of a wider supply chain that includes priority entities.

Important sector

Chemical industry

Manufacture and distribution of chemicals — the obligation depends on company size and production volume.

Important sector

Digital providers

Online marketplaces, search engines and social network platforms — regardless of the physical location of the company, they may be subject to oversight if they offer the service to users in Serbia.

Incident Reporting — Step by Step

The law requires operators to report a significant security incident no later than 24 hours after becoming aware of it. Here is a practical procedure based on the law and the procedures of the National CERT:

1. Detection and Assessment

Determine whether the incident is real, assess the threat level (low, medium, high, very high), and record the time of detection, type of incident, affected systems and extent of damage. If the level is medium or higher, reporting to the National CERT is mandatory.

2. Initial Report (within 24 hours)

Complete the reporting form at cert.rs, including a description of the incident, estimated consequences, measures taken and an assessment of the threat level. If the incident has elements of a criminal offence, also report it to the Special Prosecutor’s Office for High-Tech Crime.

3. Periodic Reports

While the incident is ongoing, update the report through the same channel, quoting the report ID. If the incident affects service users, inform them of mitigation measures.

4. Final Report

After the incident has ended, submit a final report to the National CERT with a final root cause analysis, the corrective measures taken and evidence that the vulnerabilities have been remedied. This report serves as the basis for the annual compliance review.

Key Contacts

  • National CERT of Serbia — cert.rs, info@cert.rs, Palmotićeva 2, Belgrade
  • Ministry of Interior — High-Tech Crime Department — for incidents with elements of a criminal offence
  • Ministry of Information and Telecommunications (MIT) — mit.gov.rs, Information Security Sector
  • Commissioner for Information of Public Importance and Personal Data Protection — poverenik.rs

This page gives a general overview — every company has its own specifics. For an assessment specific to your company, try the free NIS2 check or request a consultation.

Powered by