Provides telecom services, in North Macedonia

Law on Security of Network and Information Systems, arts. 33 and 54 · Read the law's page

• This binds the same essential and important entities as this jurisdiction's companion row on entities covered and cyber security risk management measures (reached by declaring that you are an essential or important entity), from 1 January 2026 (article 62).
• Notify the competent computer incident response team immediately, and within three hours at the latest, from the moment you learn of a significant cyber security incident or a significant cyber threat that affects the provision of your services, with all the information that lets it establish the incident's cross-border impact (article 33(1)).
• Within 24 hours of learning of a significant cyber security incident, send the competent team an early warning that states, where appropriate, whether you suspect unlawful or malicious action or a cross-border impact (article 33(3), point 1).
• Within 72 hours of learning of a significant cyber security incident, send the competent team an incident notification that updates the early warning and gives your initial assessment of the incident's severity and impact and, where available, indicators of compromise (article 33(3), point 2).
• On the competent team's request, send an interim report on the status of the incident, and within one month of the incident notification send a final report that describes the incident, its severity and impact, the type of threat or root cause, the mitigation applied and any cross-border impact; if the incident is still ongoing at that point, send a progress report then and a final report within one month of its resolution (article 33(3), points 3 to 5).
• Where possible, inform the recipients of your services who may be affected by a serious cyber threat, immediately and by the next working day at the latest, of the measures or remedies they can take in response (article 33(2)).
• If you are a trust service provider, notify the competent team without undue delay and within 24 hours of learning of a significant cyber security incident that affects your trust services (article 33(4)).

Law on Security of Network and Information Systems, arts. 4, 8 and 31-32 · Read the law's page

• This binds the public-sector institutions listed in article 4(1), medium and large entities in the energy, transport, banking, financial market, health, digital infrastructure and business-to-business ICT service management sectors (article 4(2), points 1 to 7), and, whatever their size, providers of public electronic communications networks or services and trust service providers (article 4(3)), that the Law classifies as essential or important entities under article 8 (reached by declaring that you are an essential or important entity). It applies from 1 January 2026 (article 62).
• Take appropriate technical, operational and organisational measures, proportionate to the risk, to manage the risks to the network and information systems through which you provide your services, covering at least risk analysis, incident handling, business continuity, supply chain security, secure acquisition, development and maintenance including vulnerability handling, assessment of the measures' effectiveness, cyber hygiene and training, cryptography, and multi-factor authentication where needed (article 32(1) and (3)).
• Have your management bodies adopt a risk assessment under the methodology of article 8(3) and repeat it at least once a year, update your cyber security risk management measures, supervise their implementation, and arrange regular training for the members of those bodies and for your employees (article 31).
• If you do not meet the article 32(3) measures, take all necessary, appropriate and proportionate corrective action immediately and within 30 days at the latest (article 32(7)).