On October 19 and 20, in Belgrade, the National CERT, in cooperation with DCAF, organized a two-day training session on the application of the Rulebook on the general methodology for risk assessment in ICT systems of special importance. This training marks the beginning of preparations for a series of lectures and drill sessions to be conducted by the National CERT and DCAF in the coming period.

Participants included representatives from the inspection service of the Ministry of Information and Telecommunications, the Office for IT and e-Government, the National CERT and independent operators of ICT systems. The training serves as another example of successful inter-institutional cooperation, which is essential for the consistent implementation of regulations in the field of information security.

Risk assessment is one of the key obligations mandated by the new Law on Information Security for operators of ICT systems of special importance, the deadline for fulfilling this requirement being April 30, 2027. While operators of such ICT systems have previously determined protective measures based on risk assessments, the new requirement stipulates that they must now conduct these assessments in accordance with the general methodology and formally adopt a risk assessment document, unless they already possess a risk assessment that complies with this general methodology.

The Ministry of Information and Telecommunications, the Office for IT and e-Government, and the National CERT will share the knowledge and experience gained from this training with operators through upcoming lectures and training sessions. The goal of these drill sessions is to support operators of ICT systems of special importance in meeting new legal obligations and to enhance information security at the national level.

The training was held within the framework of the Joint Programme on Good Cybersecurity Governance in the Western Balkans, funded by the United Kingdom and Germany.