Is a bank, in Serbia

Zakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 13-14, 24-25 · Read the law's page

• Notify the single incident-reporting system, through the Ministry's or the Office for Information Security's website, of an incident that may significantly disrupt information security, without delay and at the latest within 24 hours of becoming aware of it.
• If you operate a banking or financial-market ICT system, send that notification to the National Bank of Serbia, and also to the Securities Commission if it supervises you; if you provide an electronic-communications or postal service, send it to the Regulatory Body for Electronic Communications and Postal Services instead.when it serves a financial business
• Notify the users of your service, without delay, of an incident that causes or may cause a harmful effect on providing or using your service, together with any measures they can take to reduce or remove the harmful effect.
• While the incident continues, submit a status report to the single incident-reporting system every three days for a medium-level incident, or every 24 hours for a high or very high-level incident.
• Submit a final report within 15 days after the incident ends, covering its type, cause, duration, scope of impact, any cross-border effect, and the steps you took to remedy it.
• Report a near-miss that constitutes a serious threat, and submit an annual statistical return covering all incidents and near-misses in your ICT system to the National CERT authority by 28 February of the following year.
• This duty reaches the same priority and important ICT system operators as this law's security-measures duty, including a business that provides an information society service under Serbia's e-commerce law.

Zakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 5-12 · Read the law's page

• Apply for registration of your ICT system in the Ministry's registry of priority and important ICT systems.
• Adopt a risk-assessment act for the ICT system you operate, covering your exposure to risk, your size as an operator, the likelihood and severity of an incident, and its potential social and economic impact, and revise the act at least once a year.
• Adopt a security act built on that risk-assessment act, setting the principles, methods and procedures for reaching and keeping an adequate level of system security and the authority and responsibility for security and resources, and check your applied protection measures against it at least once a year, alone or with outside experts, producing a report on the check.
• Take technical, operational, organisational and physical protection measures across the areas Article 10 lists, including multi-factor authentication or a continuous-authentication solution, secured voice, video and text communication, and secured communication channels for emergencies.
• If your ICT system belongs to a financial institution or capital-market institution supervised by the National Bank of Serbia or the Securities Commission, to a register of obligations to financial institutions, or to a digital-asset service provider, also follow the sector-specific information-security rules that apply to it instead of relying on Article 10 alone; the National Bank of Serbia issues those rules for the operators it supervises.when it serves a financial business
• This duty reaches you if the Ministry responsible for information security classifies your information and communication (IKT) system as a priority or an important ICT system of special importance; classification is automatic by sector for a list Articles 5 and 6 set out, which includes, among important systems, a business that provides an information society service under Serbia's e-commerce law, and the Government has not yet issued the bylaw that is to add general and sectoral criteria, including a size threshold, for either tier.