Lessons from cybersecurity reforms in Albania, North Macedonia, and Bosnia and Herzegovina

Two years ago, North Macedonia had neither a dedicated cybersecurity law nor a national strategy or government computer emergency response team (CERT).

The establishment of the Ministry for Digital Transformation marked the start of a series of reforms. The country adopted a national cybersecurity strategy and legislation aligned with the EU’s NIS2 Directive.

The next step was to build the institutions needed to put these commitments into practice.

With support from Cyber Balkans, the ministry developed a four-year plan for establishing a government CERT. International and local experts worked alongside ministry officials, while junior specialists recruited through the project subsequently joined the ministry as permanent employees.

The government financed much of the necessary technology, with additional support from the project.

The government CERT began operating on 1 May 2026 and joined FIRST, the international incident response community, in June.

Tanja Milanovska Najdovski attributed the progress to political support, a clear plan and a team able to carry the work forward.

The focus has now shifted from establishing the CERT to improving its performance. Priorities include stronger threat detection, incident response procedures, information sharing and staff training.

Albania’s challenge was to determine which organisations should be subject to national cybersecurity requirements.

With support from eGA, the National Cybersecurity Authority (AKSK) developed a methodology for identifying operators of critical and important information infrastructure, approved in November 2024.

The process involved approximately 35–40 meetings with regulators and operators, as well as two public consultations. The methodology establishes measurable criteria based on dependence on digital systems and the potential consequences of service disruption.

• In 2024: 159 identified operators
• In June 2025: 215 identified operators
• In September 2026: 328 identified operators

The number of identified operators has more than doubled, giving authorities a clearer picture of which services require protection.

Rudin Hoxha highlighted three lessons:

• involve sector regulators from the outset,
• establish transparent criteria,
• review the methodology regularly as the economy changes.

He also stressed the importance of national ownership. International experts provided advice and experience, but Albanian authorities developed the methodology themselves.

Bosnia and Herzegovina’s fragmented governance structure has made nationwide cybersecurity reforms difficult. Previous attempts to develop legislation and a national strategy through a top-down approach had produced limited results.

The first Cyber Balkans project therefore supported a more targeted initiative: establishing a Malware Information Sharing Platform (MISP) for the banking sector.

The platform connects the Central Bank of Bosnia and Herzegovina and banking agencies operating at different levels of government. Each institution maintains its own MISP instance, allowing them to exchange cyber threat information while retaining control of their systems.

The platform was fully implemented in early 2026, becoming the country’s first interinstitutional MISP arrangement.

Adnan Kulovac explained that the main challenge was securing agreement between institutions, rather than implementing the technology.

The experience showed that practical cooperation is possible even within a complex governance structure. It could also serve as a model for extending information sharing to government institutions and other sectors.

The three cases highlighted several lessons for cybersecurity capacity-building:

• Start with national priorities. External assistance should address clearly identified institutional needs, rather than offer ready-made solutions.
• Build local ownership. Institutions must have the people, knowledge and responsibility to maintain results after project support ends.
• Invest in cooperation. Building trust between institutions and stakeholders is often as important as developing technical capabilities.
• Adapt the approach. North Macedonia benefited from strong government leadership, Albania from extensive stakeholder consultation, and Bosnia and Herzegovina from a sector-specific, bottom-up initiative.

Cyber Balkans II will build on these results. North Macedonia is focusing on improving the operational capabilities of its government CERT. Albania is reviewing its critical infrastructure methodology, while Bosnia and Herzegovina is exploring how to extend threat information sharing to other institutions.

The central lesson from Cyber Balkans I is that international support delivers lasting results when countries define their priorities, lead implementation and retain the expertise developed.