THE NEED FOR LEGAL REGULATION OF CYBER / INFORMATION SECURITY
Information or cyber security is one of the key aspects of protecting data and systems in today’s digital environment, with the aim of preventing unauthorised access to, loss or compromise of confidential information. It covers a comprehensive set of measures, techniques, technologies and policies designed to preserve the integrity, confidentiality and availability of data, which matters for business processes and, more broadly, for society and the public interest.
Regulating information security is particularly important in light of the ongoing digitalisation of business and growing global connectivity, where the risks of cyber threats, attacks and data leaks are rising rapidly. In response to these challenges, legislators around the world, and in the European Union in particular, have set legal standards for the security of network and information systems, in order to protect not only personal data and privacy, but also the stability of key sectors of the economy and infrastructure.
Cyber security falls within the broader framework of information and communication technology law, a legal discipline that governs, among other things, relationships in the digital world, in particular the protection of data and information, communication technologies and privacy. This field inevitably overlaps with other areas of law, such as criminal law, where threats and attacks on information systems qualify as criminal offences. From a security perspective, it often also covers the rights and obligations relating to the use of cryptographic solutions, digital signatures and authentication mechanisms, which further broadens its reach.
The Serbian Information Security Law (Article 2, point 3) defines information security as follows:
“Information security is the ability of information and communication systems and networks to resist and/or mitigate, with a certain degree of reliability, any event that could compromise the availability, integrity, authenticity, non-repudiation and confidentiality of data stored, transmitted or processed, as well as of services provided or accessible through that ICT system.”
Basic Principles of Information Security
Information security is based on several basic principles. The first three are known as the Confidentiality, Integrity, Availability (CIA) triad, while authenticity and non-repudiation are equally important:
Confidentiality: Data confidentiality means that information is available only to those authorised to access it. This principle protects sensitive data from unauthorised disclosure or access, which is especially important for personal data and trade secrets. Mechanisms such as encryption and access control are used to achieve confidentiality.
Integrity: Data integrity ensures that information remains accurate and complete, without unauthorised changes. This principle requires data to be protected from intentional or accidental alteration during transmission or storage. Tools such as digital signatures and data integrity checks (hash functions) are used to preserve integrity.
Availability: Availability means that authorised users can access the information they need at any time. Maintaining the availability of data and systems is a key factor for uninterrupted business. Measures taken to preserve availability include backup systems, resource redundancy and disaster recovery plans.
Authenticity is the property of an ICT system that makes it possible to verify and confirm that information was created or sent by the person who claims to have done so.
Non-repudiation is the ability to prove that a certain action or event has taken place, so that it cannot later be denied.
Cyber Security Threats
Threats to information security are numerous and diverse, and their intensity grows as technology advances. The most common threats in practice include:
Malware: The spread of malware, including viruses, trojans and ransomware, can have serious consequences for the integrity and availability of data and can also give attackers unauthorised access to systems.
Phishing attacks: Phishing refers to attempts at fraud through fake e-mails or websites, aimed at getting users to disclose confidential information such as passwords or credit card numbers.
Distributed Denial of Service (DDoS): DDoS attacks seek to disable systems or networks by flooding servers or resources with huge volumes of fake traffic, making them unavailable to users.
Exploits: Attackers exploit vulnerabilities in software or hardware to gain unauthorised access to data or systems, which can lead to data theft or modification.
Protection Measures and Controls in Information Security
To protect information systems effectively, organisations introduce various technical and organisational measures. Some of the key measures include:
Encryption: Data encryption ensures that only authorised users can decrypt information, preventing unauthorised access to sensitive data.
Multi-factor authentication (MFA): Multi-factor authentication increases security by requiring users to confirm their identity using several methods, such as passwords, biometric data or one-time codes.
Firewalls and protection systems: Firewalls and related tools are the basic defence against unauthorised attempts to access networks and systems. Modern firewall systems and threat detection tools provide an additional level of protection, particularly against sophisticated attacks.
Endpoint detection and response (EDR): These systems enable real-time monitoring of activity and automatic response to threats, improving organisations’ resilience to cyber attacks.
Disaster recovery plans (DRP): Organisations establish recovery plans to ensure a rapid return to normal operations after incidents such as cyber attacks or natural disasters.
Legal Framework and Compliance
Legislative frameworks play a key role in regulating information security and ensuring that organisations comply with data protection standards. Two instruments are particularly important:
General Data Protection Regulation (GDPR): The Regulation sets strict requirements for the protection of personal data of natural persons and provides for high administrative fines for infringements, in particular in cases of inadequate protection or loss of data.
NIS 2 Directive: As a key piece of cyber security legislation, NIS 2 sets standards for the protection of critical infrastructure and services, particularly in sectors such as energy, transport, health and digital services. The Directive requires specific protection measures and establishes accountability for managing security incidents.
In 2025, Serbia adopted a new Information Security Law (Official Gazette of the Republic of Serbia No. 91/2025), aligned with the principles of the NIS 2 Directive. The Law classifies ICT systems of special importance as priority or important systems and extends the range of obligated entities to new sectors, including the production of food, electronics, medicines, medical devices and motor vehicles, courier services, certain digital services and scientific research. The criteria for designating operators, including criteria relating to the size of businesses, are to be set out in more detail in a Government decree (Article 6(4) of the Law). Operators must register in the register of ICT systems of special importance, implement technical, operational, organisational and physical protection measures, adopt a risk assessment act and an ICT system security act, and include the prescribed protection measures in contracts with third parties. An incident that may have a significant impact on information security must be reported without delay, and no later than 24 hours after becoming aware of it, with periodic reports while it lasts and a final report within 15 days after it ends. Fines are prescribed for operators and responsible persons for non-compliance.
Information security is therefore a key component of protecting data and systems today, not only in the business sector but also at the level of state institutions. Thorough implementation of technical and organisational measures, combined with compliance with legal requirements and standards, is essential to minimising the risk of cyber threats. Establishing appropriate protection mechanisms and complying with regulations such as the GDPR, the NIS 2 Directive and the Information Security Law enables organisations to ensure business continuity, protect confidential information and preserve the integrity of their systems.
We advise companies on compliance with the Serbian Information Security Law and the NIS 2 Directive, including assessing whether they are operators of ICT systems of special importance, drafting the risk assessment act and the ICT system security act, contractual security clauses with suppliers and incident reporting procedures. To discuss your obligations, please contact us.
NIS 2
The NIS 2 Directive on the security of network and information systems was adopted by the European Parliament and the Council of the European Union on 14 December 2022. NIS 2 replaces the previous NIS Directive from 2016, with the aim of improving resilience to cyber threats and ensuring better protection of critical network and information systems within the EU. The Directive entered into force in January 2023, and Member States had until 17 October 2024 to transpose its provisions into national law. Since 18 October 2024, Member States have been required to apply the national rules transposing NIS 2.
The main objective of the NIS 2 Directive is to harmonise the level of cyber security across Member States and to improve coordination in responding to cyber incidents. Organisations covered by the Directive must regularly assess the risks to their network and IT systems and apply appropriate technical and organisational measures to manage threats. These measures include risk analysis, vulnerability management and the use of cryptography and encryption. Organisations must also establish procedures for incident handling and crisis management, including the detection, analysis and classification of security incidents, with an obligation to report to the competent authorities in good time.
The NIS 2 Directive introduces a comprehensive and stricter cyber security framework in the European Union, with particular emphasis on strengthening resilience to cyber threats and improving the ability to respond quickly to incidents. Its provisions significantly broaden the range of entities to which it applies, while high fines and other sanctions ensure consistent application and compliance. Member States were required to transpose the Directive into national law by 17 October 2024 and to establish adequate supervision and enforcement mechanisms.
The NIS 2 Directive covers several key areas relating to improving cyber security and protecting critical network and information systems in the European Union. Its provisions broaden the range of entities required to comply with its standards, introduce stricter obligations for protection and incident reporting, and set significant sanctions for infringements.
Entities covered by NIS 2
Compared with NIS 1, NIS 2 broadens the range of entities subject to its provisions and divides them into two categories: essential entities and important entities. The Serbian Information Security Law similarly distinguishes between priority and important ICT systems of special importance.
The category of essential entities generally includes large entities in sectors such as energy, transport, financial services, health, water supply and digital infrastructure, such as internet service providers. Both categories are subject to the same basic risk management and incident reporting obligations, but essential entities are subject to more intensive supervision and higher maximum fines.
Important entities, on the other hand, include those engaged in postal and courier services, the production, processing and distribution of food, the manufacture of chemicals, waste management and the manufacture and distribution of ICT equipment.
Information security management obligations
All entities covered by the NIS 2 Directive must put in place appropriate technical and organisational measures to manage risks and protect their information systems. These measures include:
- regular assessment of risks related to network and information systems,
- vulnerability management and appropriate protection measures, including the use of cryptography and encryption,
- policies and procedures to ensure business continuity in the event of cyber incidents,
- systems for detecting, analysing and reporting security incidents.
Incident reporting obligation
The NIS 2 Directive sets strict deadlines for reporting significant cyber incidents to the competent authorities. Entities must submit an early warning within 24 hours of becoming aware of an incident, and an incident notification with an initial assessment within 72 hours. A final report, including information on the severity of the incident, its impact and the measures taken, must be submitted no later than one month after the incident notification. If the incident is still ongoing at that time, a progress report is submitted, followed by a final report within one month of handling the incident. These deadlines ensure a rapid response and minimise the harmful consequences for network and information systems.
Penalties under the Directive
Article 34 of the NIS 2 Directive provides for high fines for entities that fail to comply with its provisions. For essential entities, Member States must provide for a maximum fine of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, the maximum must be at least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher. National maximums may be higher. In addition to fines, further sanctions are possible for essential entities, such as the temporary suspension of a certification or authorisation to provide services, and a temporary prohibition on persons with managerial responsibilities, such as the CEO or legal representative, from exercising managerial functions.
Supervision of the application of the Directive
The NIS 2 Directive provides for specific mechanisms for supervising and enforcing the required measures. Member States have the power to monitor entities’ compliance with the Directive and to impose appropriate sanctions for infringements. Member States may introduce stricter measures than those provided for by the Directive, but may not introduce lower standards.
Cooperation between Member States
The Directive promotes cooperation between EU Member States through mechanisms for sharing information on threats and incidents and through joint operational mechanisms for responding to cyber incidents. This includes a network of national cyber security centres that facilitate coordination and the exchange of information at EU level.
Effect of the Directive on entities outside the EU
The NIS 2 Directive also applies to certain entities established outside the EU that provide services within the EU, primarily DNS service providers, top-level domain name registries, domain name registration service providers, providers of cloud computing services, data centre services, content delivery networks, managed services and managed security services, as well as providers of online marketplaces, online search engines and social networking services platforms. These entities must bring their operations into line with the NIS 2 Directive, including by designating a representative in the EU responsible for implementing its provisions and communicating with the competent authorities within the Union. This may also be relevant for Serbian companies that provide such services to users in the EU.
Implementing NIS 2 Rules in Business Operations
Implementation of the NIS 2 Directive can be presented in three phases, or three levels of activity, through which entities in essential and important sectors can comply with its requirements. This is a practical model for organising compliance, not a division prescribed by the Directive itself. These levels cover different aspects of information security and risk management.
The first level involves establishing basic processes for managing the security of information systems. This includes identifying and managing risks, including those related to supply chains, as well as monitoring and controlling incidents. This level also requires policies and procedures that ensure business continuity in line with NIS 2 requirements.
The second level covers the application of technical and organisational measures based on risk assessment and business impact analysis. These measures may include advanced technologies such as multi-factor authentication, access control, business continuity solutions (such as IaaS, BaaS, DRaaS and anti-DDoS), as well as basic security solutions such as antivirus software, firewalls and EDR (Endpoint Detection and Response). Personnel measures must also be applied at this level, raising employee awareness through training on recognising cyber threats, for example through anti-phishing campaigns.
The third level involves establishing systems for continuous security monitoring and validation of security controls. This includes security operations centres (SOC) and managed detection and response (MDR) services, which enable round-the-clock monitoring of cyber threats throughout the year. Organisations may also use penetration testing, vulnerability assessments and exercises simulating various attack scenarios to improve the resilience of their IT systems. The choice of specific solutions, including SOC and MDR services or cloud solutions, depends on the risk assessment and the proportionality of measures and is not a universal obligation for all obligated entities.
The Need for New Professionals to Comply with Information Security Regulations
In addition to the very high costs of policies, procedures and new technological and information security protection systems, one of the key problems is staffing. In the EU, a need has arisen almost overnight for a large number of experts whom entities affected by the NIS 2 Directive will have to employ or engage. Even where funding for such engagement is not a problem (and it often is a challenge), the even bigger problem is where to find all these competent experts in such a short time.
As regards staffing requirements for obligated entities, the Information Security Law and the NIS 2 Directive require companies considered operators of ICT systems of special importance to fulfil a number of obligations and take a number of measures that require substantial knowledge and experience in ICT security, which directly affects the need to hire for specific cyber security positions. This applies to companies in sectors such as energy, finance, health, transport and digital infrastructure services, as priority operators, but also to companies in a number of other activities classified as important operators.
The staff responsible for this area in companies must have specific skills and knowledge to protect ICT systems. These are usually positions such as IT security manager, cyber security engineer and network security specialist. Legislation such as the NIS 2 Directive and Serbia’s new Information Security Law (adopted in 2025, Official Gazette of the Republic of Serbia No. 91/2025) do not directly prescribe the specific evidence of competence these staff must have, but a high level of professional education in information technology is expected. Certifications such as CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager) and CEH (Certified Ethical Hacker), although not directly prescribed, are internationally recognised standards of cyber security competence and are often required for these positions.
Operators are therefore required to ensure that persons who use or manage the ICT system are qualified for their work and understand their responsibilities, and to provide basic and, where necessary, advanced IT training for all employees and engaged persons with access to ICT systems.
This is particularly important for protection against social engineering attacks, where cyber security experts, as well as an additional team for employee training, play a key role. Education includes specific training and certifications in recognising social engineering attacks (for example, phishing awareness training).
In the context of NIS 2, the GDPR must also be mentioned. Although the Regulation has been in place for several years, the need to comply with it and implement it in business operations remains as relevant as ever. The Data Protection Officer therefore remains a key position for monitoring compliance with data protection legislation, such as the GDPR, and for the security of personal data. This person must have a deep understanding of data protection regulation, not only the GDPR and Serbia’s Personal Data Protection Law, but must also follow the latest guidance and opinions of the competent bodies and supervisory authorities. The entry into force of NIS 2 does not, therefore, push the General Data Protection Regulation aside; quite the opposite. Each in its own field, these regulations together form the regulatory framework for data security, and a headache for many who must bring their business into line with them.
The penalties for non-compliance with these regulations are significant. Under the NIS 2 Directive and the Information Security Law, companies may be fined and responsible persons may be held personally liable. Under the NIS 2 Directive, fines can reach several million euros, while the Serbian law prescribes fines in dinars for both operators and responsible persons.