Runs an essential service, in Slovenia

Zakon o elektronskih komunikacijah (ZEKom-2), 115. in 116. člen, v besedilu iz 65. člena ZInfV-1 (Uradni list RS, št. 40/25) · Read the law's page

• If you are an operator under the Zakon o elektronskih komunikacijah (ZEKom-2), establish and maintain a documented information security management system (SUVI) and continuity management system (SUNP) in line with the information security law, and take appropriate, effective and proportionate technical, operational and organizational measures to protect the integrity, authenticity, confidentiality and availability of your network and information systems and to limit the effect of incidents on your customers (Article 115(1)).
• Treat the SUVI and SUNP as a business secret, review the emergency-communication part of the SUNP at least once a year, and obtain the prior approval of the competent bodies before adopting or changing it (Article 115(2) and (3)).
• If you operate a mobile communications network that you supply to critical infrastructure operators, essential service providers, government bodies or holders of key parts of the state security system, also observe the additional security requirements and restrictions of Article 116.

Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 20-22 · Read the law's page

• Article 62 defers only the adoption of the Article 21 and 22 risk-management measures, and does not mention Article 20. The Act entered into force on 19 June 2025: essential and important entities generally have eighteen months, to 19 December 2026, to adopt the measures, while an essential entity already designated as an essential-service operator and a state-administration body designated under the predecessor Zakon o informacijski varnosti, and an operator under the Zakon o elektronskih komunikacijah, have one year, to 19 June 2026.
• This binds you where you fall within Annex 1 or Annex 2's sector lists and, unless one of Article 6(2)'s no-threshold triggers applies, you have at least 50 employees and an annual turnover or balance-sheet total of at least EUR 10 million. A DNS service, TLD registry, cloud, data-centre, content-delivery-network, managed-service or managed-security-service provider, and an online marketplace, online search engine or social-networking-services platform, falls under Slovenian jurisdiction (Article 31(1)) only where its main establishment in the European Union is in Slovenia.
• Take technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems you use for your work or to provide your services, and to prevent or reduce the impact of an incident on the recipients of your services and on other services.
• Cover at minimum, on an all-hazards basis: management support for information and cybersecurity, personnel integrity checks before, during and after employment, basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, logging of events on your network and information systems, assigned responsibility for protecting the systems you run, a policy on cryptography (and on encryption where needed), traffic and communications management, and supply-chain security with minimum requirements for your key suppliers.
• Also cover physical and technical protection of the premises housing key systems, application-software security including vulnerability handling and disclosure, management and prevention of technical-vulnerability exploitation, malware protection and intrusion detection, and a policy on the cloud services you use; use multi-factor or continuous authentication where risk management needs it, and secure voice, video, text and emergency communications where suited to your activity.
• Have your responsible person, the individual who leads, supervises or manages the entity or a public-administration body's head, approve these measures and oversee their implementation, and complete cybersecurity risk-management training at least every four years.

Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 29-30 · Read the law's page

• This binds an essential or important entity within Priloga 1 or Priloga 2 on the same scope as this jurisdiction's companion risk-management row; Article 29(3) separately names a provider of an online marketplace, an online search engine or a social-networking-services platform, alongside a DNS, TLD, cloud, data-centre, content-delivery-network, managed-service or managed-security-service provider, for a variant significant-incident standard set in the Commission's NIS2 implementing acts.
• Treat an incident as significant where it has caused, or could cause, your organisation serious operational disruption or financial loss, or has affected, or could affect, another person by causing substantial material or non-material damage.
• Give your competent CSIRT group an early warning without delay, at latest within 24 hours of detecting a significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.
• Follow with a full notification without delay, at latest within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available threat indicators, then an interim report if the CSIRT group asks for one, and a final report at latest one month after the 72-hour notification, or a progress report and a final report within one month of resolution if the incident is still ongoing at that point.
• If you are a trust service provider, notify your competent CSIRT group of a significant incident affecting your services without delay, and at latest within 24 hours of detecting it, instead of waiting for the full notification (Article 30, paragraph 2).
• Without delay, inform the recipients of your services of a significant incident likely to adversely affect them, and communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response.