SloveniaZakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance
Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25, čl. 20-22
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- Article 62 phases the Article 21-22 risk-management measures in from the Act's entry into force on : essential and important entities generally have eighteen months, to , while an essential entity already designated as an essential-service operator and a state-administration body designated under the predecessor Zakon o informacijski varnosti, and an operator under the Zakon o elektronskih komunikacijah, have one year, to .
- This binds you where you fall within Annex 1 or Annex 2's sector lists and, unless one of Article 6(2)'s no-threshold triggers applies, you have at least 50 employees and an annual turnover or balance-sheet total of at least EUR 10 million; Article 29(3) separately names a provider of an online marketplace, an online search engine or a social-networking-services platform, alongside a DNS service, top-level domain (TLD) registry, cloud, data-centre, content-delivery-network, managed-service or managed-security-service provider, confirming these digital providers sit within the Act's scope.
- Take technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems you use for your work or to provide your services, and to prevent or reduce the impact of an incident on the recipients of your services and on other services.NIST CSF 2.0PR.IR-03
- Cover at minimum: management support for information and cybersecurity, personnel integrity checks before, during and after employment, basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, logging of events on your network and information systems, and, where relevant, supply-chain security, cryptography and encryption policy, and multi-factor or continuous authentication.NIST CSF 2.0GV.PO-01
- Have your responsible person, the individual who leads, supervises or manages the entity or a public-administration body's head, approve these measures and oversee their implementation, and complete cybersecurity risk-management training at least every four years.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Urad Vlade Republike Slovenije za informacijsko varnost (URSIV) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Articles 52 and 53 create a prekršek (misdemeanor, an administrative offence under Slovenia's minor-offences framework), not a kaznivo dejanje (criminal offence under the Kazenski zakonik).
Penalty structure
Article 52(1): an essential entity's failure to meet obligations under, among others, Articles 21, 22 and 24 carries a fine of 0.5 to 2 percent of the legal person's total annual turnover in the preceding business year, but not less than EUR 10,000 and not more than EUR 10,000,000, whichever amount is higher. Article 53(1), the mirror provision for an important entity, sets 0.3 to 1.4 percent of turnover, not less than EUR 7,000 and not more than EUR 7,000,000, whichever is higher. Article 52(2)-(3) and 53(2)-(3) separately fine a sole trader (EUR 5,000-25,000 essential tier, EUR 3,000-20,000 important tier) and the entity's responsible person individually (EUR 1,000-10,000 essential tier) for the same failure.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Urad Vlade Republike Slovenije za informacijsko varnost (URSIV, the Government Office for Information Security), acting through its information-security inspectors.
Settledness
- As of
- Guidance link
- https://www.gov.si/assets/vladne-sluzbe/URSIV/PR/ZInfV-1_Odgovori-na-vprasanja.pdf
- Guidance body
- Urad Vlade Republike Slovenije za informacijsko varnost (URSIV)
- Open questions
- Does Article 62(2)'s one-year transition for an entity already designated as an essential-service operator or a state-administration body under the predecessor Zakon o informacijski varnosti also reach a digital-infrastructure or digital-provider entity the predecessor Act separately regulated, or does every digital provider newly reached by Priloga 2 fall under Article 62(1)'s general eighteen-month clock instead?
What this law does
Article 22(1) requires an essential or important entity to adopt technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems it uses for its work or to provide its services, and to prevent or reduce the impact of an incident on the recipients of its services and other services.
Article 22(2) requires those measures to follow an all-hazards approach covering at minimum management support for information and cybersecurity, personnel integrity checks before, during and after employment (cross-referencing Article 23), basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, the logging duty of Article 24, supply-chain security with minimum requirements for key suppliers, cryptography and encryption policy, and further items through point 17 of paragraph 2.
Article 20 assigns responsibility for these measures to the entity's odgovorna oseba (responsible person, the individual who leads, supervises or manages a legal person's business, or is otherwise legally charged with ensuring its lawful operation, or the head of a public-administration body), who must approve the Article 22 measures, oversee their implementation, complete cybersecurity risk-management training at least every four years, and ensure regular staff training.
Article 6(1) binds an entity within Priloga 1 (Annex 1, highly critical sectors) or Priloga 2 (Annex 2, other critical sectors) that has at least 50 employees and an annual turnover or balance-sheet total of at least EUR 10 million; Article 6(2) drops that threshold for, among others, a public electronic-communications or trust-service provider, a top-level domain (TLD) registry or DNS provider, a sole national provider of the service, and a public-administration body.
Article 62(1) gives essential and important entities eighteen months from the Act's entry into force to adopt these measures.
Article 62(2) gives an essential entity already designated as an essential-service operator under Article 6 of the predecessor Zakon o informacijski varnosti, and a state-administration body designated under that Act's Article 9, one year from the Act's entry into force to adopt them, and until that year ends the security requirements, security documentation, security measures and associated supervision and penal provisions of the predecessor Act and of the regulation referred to in Article 69(2) continue to apply to them.
Article 62(3) gives an essential or important entity that is an operator under the Zakon o elektronskih komunikacijah (Electronic Communications Act) the same one year, and until that year ends the security measures of Chapter VII of that Act and the general act on the security of networks, services and data named in Article 69(3) continue to apply to it. The Act entered into force on , so the eighteen months run to and the one year to .
This Act, the ZInfV-1, by its own Article 69(1) repeals the predecessor Zakon o informacijski varnosti (Uradni list RS, št. 30/18, 95/21, 130/22, 18/23 and 49/23), Slovenia's NIS1-era transposition, together with four implementing regulations and two general acts that carried the risk-management and security-documentation duties under it.
Article 29(3) of this Act, in the companion notification row, confirms that a provider of an online marketplace, an online search engine or a social-networking-services platform is among the essential or important entities this Article 6 scope reaches, naming them for variant notification treatment; that same population is bound by this row's Article 22 risk-management duty.
When LexLint raises it
When your app profile says your app runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .