How the EU and national expertise will support Cyber Balkans II

European experts can offer experience in implementing cybersecurity legislation, establishing incident response teams and developing operational procedures. But solutions used in EU member states may not suit the institutional and legal conditions of Western Balkan countries.

Gorazd Božič, Head of Slovenia’s national incident response team SI-CERT, said local experts play a crucial role in identifying what can work in practice.

He also stressed the importance of connecting Western Balkan cybersecurity teams with European and international networks. Smaller national teams cannot develop every capability independently, making access to external expertise and operational support particularly valuable.

EU experience can also help countries anticipate challenges in implementing legislation such as the NIS2 Directive. Božič noted that EU member states themselves continue to face practical difficulties in applying new requirements.

Nebojša Jokić, who supported Serbia’s cybersecurity reforms during the first Cyber Balkans project, described how EU and Serbian experts worked together on its legal framework.

The work included reviewing the draft Law on Information Security and preparing four draft bylaws covering important ICT systems, cybersecurity measures, security documentation and verification, and incident reporting.

Local experts contributed knowledge of Serbian legislation and institutional procedures. EU experts brought experience in interpreting and implementing NIS2 requirements.

The teams worked through joint meetings, draft exchanges and consultations with the responsible ministry.

The project also organised workshops where representatives of Serbian institutions examined cybersecurity risks and dependencies in their sectors. These sessions helped prepare institutions for their future responsibilities under the legislation.

Jokić stressed that technical assistance should not simply deliver finished documents. Beneficiary institutions need to participate throughout the process to understand and implement the results.

A new component of Cyber Balkans II will focus on cybersecurity workforce development, led by HAUS, the Finnish Institute of Public Management.

Kerttu Auvinen, Component Manager at HAUS, outlined two objectives:

• Attract more people into cybersecurity careers to address shortages of qualified professionals.
• Strengthen continuous professional development within public institutions.

HAUS will draw on Finland’s experience in developing public-sector capabilities and its comprehensive security approach, which involves government, businesses, academia and civil society.

Auvinen highlighted Finnish initiatives that combine expert training, peer learning and organisational development. One public-sector programme has involved approximately 500 civil servants over three years.

Cyber Balkans II is considering similar approaches, including institutional mentoring, activities for young cybersecurity professionals and cooperation with ENISA on cybersecurity skills.

The activities are still being developed with national partners. Auvinen emphasised that the aim is to strengthen institutions’ long-term capacity, rather than focus exclusively on individual training.

The panel also examined why regional cyber threat information sharing remains limited despite the availability of technical platforms.

Božič drew on EU experience, where established incident response networks still face difficulties in exchanging information consistently.

The main obstacles are trust, limited participation and staff turnover. Institutions may have access to platforms such as the Malware Information Sharing Platform (MISP), but these tools are useful only when members contribute information and use them regularly.

Participants also raised concerns about the limited capacity of smaller national incident response teams to collect and analyse threat intelligence.

Božič suggested using practical scenarios to demonstrate how information sharing works, encouraging institutions to contribute data and building cooperation through regular contact.

The discussion also highlighted the need for institutional leadership to support information exchange, particularly where political or administrative considerations discourage regional cooperation.

The panel identified four areas for continued work:

• incident response,
• cyber threat information sharing,
• workforce development,
• closer cooperation with European cybersecurity networks.

The project will retain a flexible approach, combining international and local expertise with direct involvement from national institutions.

Jokić argued that the longer-term measure of success should be whether institutions can continue developing their capabilities independently. Auvinen emphasised cooperation and learning between institutions, while Božič stressed the importance of sharing practical experience, including approaches that have failed.

The common conclusion was that international assistance works best when national institutions help shape the work and retain the skills needed to sustain it.