Cybersecurity in the Western Balkans: Progress in legislation, gaps in implementation

For Albania and Montenegro, major cyberattacks in 2022 exposed weaknesses in national preparedness and prompted substantial reforms.

Albania has since expanded its National Cybersecurity Authority from 20 to 85 employees and adopted a new cybersecurity law aligned with the EU’s NIS2 Directive. In July 2026, Albanian authorities independently conducted a national cyber crisis simulation involving government institutions and critical infrastructure operators.

Montenegro has adopted new cybersecurity legislation, established the Cyber Security Agency and developed the Government Security Operations Centre (GSOC) with support from the first Cyber Balkans project. The new agency has begun supervising cybersecurity measures in the private sector, starting with banking.

Others have also made progress, although at different speeds:

• Bosnia and Herzegovina has taken steps to establish an operational government CERT within its Ministry of Security. Although its mandate was defined in 2018, formal staffing positions were only introduced in 2023. Two officials had been recruited by March 2026.
• Kosovo has strengthened its cybersecurity governance framework and is preparing to align its legislation with NIS2. Making its national cybersecurity agency fully operational remains a priority.
• Serbia has expanded its National CERT’s incident response and technical training capabilities. In August 2026, it conducted a joint cyber exercise using a cyber range platform provided through the first Cyber Balkans project.

The main challenge now is ensuring that new laws and institutions deliver effective cybersecurity protection.

In Bosnia and Herzegovina, disagreements between different levels of government have delayed the adoption of a national cybersecurity strategy. Davor Bagarić stressed that effective incident coordination depends on building trust between institutions, not simply establishing formal responsibilities.

Kosovo must translate NIS2 requirements into clear supervisory arrangements and risk management procedures.

Serbia faces the implementation of its new legal framework and the establishment of an Office for Information Security.

Montenegro has begun putting its supervisory responsibilities into practice. Samir Orahovac emphasised that oversight should help organisations identify and address weaknesses, rather than simply check legal compliance.

Finding and retaining qualified specialists is a challenge across the region.

Albania estimates a shortage of around 380 cybersecurity professionals among the critical and important entities assessed under its previous regulatory scope. The number of entities subject to cybersecurity requirements has since increased from 159 to 328, adding pressure on both regulators and operators.

Kosovo faces similar difficulties, with public institutions competing for specialists against domestic and international private sector employers.

Floreta Faber also highlighted the need to change how organisations approach cybersecurity. Many still rely on general IT staff to handle security responsibilities, despite the growing need for dedicated expertise.

The panellists identified closer cooperation with universities, practical training and better career opportunities as ways to address the shortage.

The expansion of cybersecurity requirements to more public and private sector organisations is increasing demand for technical expertise and financial resources.

Cybersecurity must be considered from the beginning of digitalisation projects, Faber argued, rather than treated as an additional cost once systems are operational.

For organisations with limited budgets, meeting cybersecurity requirements can be particularly difficult. Albania has responded by offering training on open-source security tools and helping institutions identify affordable solutions.

The discussion also highlighted the importance of cooperation with private operators, which own and manage many of the systems classified as critical infrastructure.

The first project supported national cybersecurity reforms through legislative assistance, technical training and practical exercises. Several results discussed by the panellists have already been incorporated into national operations.

Beyond individual country achievements, one of the project’s main contributions was bringing cybersecurity practitioners across the region into closer operational cooperation.

A regional information-sharing platform, hosted by Latvia’s national CERT, allows national teams to exchange threat intelligence, including indicators of compromise (IoCs).

Albania has regularly contributed information to the platform. Montenegro described how intelligence received from Albania about a cyberattack was shared with private sector organisations to help them protect their systems.

However, the platform remains underused. Albania called for more national CERTs to contribute regularly and make threat intelligence exchange part of their routine operations.

The project also organised restricted peer exchanges where practitioners could discuss real incidents, technical solutions and operational experience.

The panel also identified areas where countries could learn directly from one another:

• Albania: Incident response, digital forensics and practical experience in managing major cyberattacks.
• Serbia: The National CERT’s certification process and operational development.
• Montenegro: Its Council for Information Security, which brings government institutions and private sector representatives together to coordinate cybersecurity matters.
• Bosnia and Herzegovina: Its approach to defining CERT staffing positions within public administration.

These examples show that the region is increasingly able to draw on its own expertise, alongside international support.

The next phase will focus on addressing the gaps identified by national authorities, particularly in implementing EU-aligned legislation, strengthening institutions and developing the cybersecurity workforce.

Cyber Balkans II will support these priorities through policy assistance, technical training, cyber exercises and regional cooperation. Improving incident preparedness and making better use of existing information-sharing mechanisms will also be important.

The first project helped countries develop new capabilities and establish professional networks. The task now is to ensure these translate into stronger day-to-day cybersecurity and a more coordinated response when incidents occur.