Who has to report
The duty applies to the entities the law covers: public institutions, and essential and important entities in the sectors that apply now, namely energy, transport, banking, financial market, health, digital infrastructure and business-to-business ICT service management. Some providers are covered regardless of size, including public electronic-communications providers, trust service providers, DNS providers and domain registrars.
Size follows the classification in the Company Law, not the EU definition of small and medium-sized enterprises. Sectors 8 to 16 of the law, such as food, manufacturing and digital providers, are deferred until EU accession.
Who you report to
Entities register and report through the single cybersecurity portal run by the Ministry of Digital Transformation (MDT). Which authority handles your report depends on who you are:
- Private-sector entities in scope report to MKD-CIRT, the national CSIRT within the Agency for Electronic Communications (AEK).
- The Government, ministries, state administration bodies and municipalities fall under MDT, which runs MKD-GOV-CSIRT.
- Sector laws can appoint other competent authorities and CSIRTs for their sectors.
The deadlines
The three-hour first notice covers a significant incident and/or a significant cyber threat; the later reports cover significant incidents. The deadlines run from the moment you become aware, except where the table says otherwise.
| When | What |
|---|---|
| Immediately, at the latest within 3 hours | First notice to the competent CSIRT |
| 24 hours | Early warning |
| 72 hours | Incident notification |
| On request | Intermediate report |
| 1 month after the notification | Final report; if the incident is still ongoing, a progress report first, then the final report within one month of resolution |
Special deadlines
- Trust service providers report within 24 hours.
- If a serious cyber threat endangers the recipients of your services, tell them, where possible by the next working day at the latest, about the measures or remedies they can take.
What counts as significant
Each competent authority sets its own methodology for when an incident is significant. MDT publishes its methodology on its website, and its rulebook on the reporting procedure for the Government and municipalities was published in Official Gazette no. 141/2026. AEK adopted its rulebook on reporting to MKD-CIRT on 15 July 2026.
AEK’s thresholds for the private sector were in public consultation in July 2026, and when we checked in October 2026 their adoption had not been confirmed. Check the current version with MKD-CIRT.
Prepare before it happens
- Register on the cybersecurity portal and keep your contact details current.
- Decide who declares an incident significant and who files the notice, with a deputy for nights, weekends and holidays.
- Keep a short internal checklist (when you became aware, which systems are affected, what you have done so far) so the first notice goes out fast.
- Keep logs and evidence from the start: you will need the timeline for the 72-hour notification and the final report.
- Rehearse the procedure once a year, alongside the annual risk assessment and training the law requires from management.
- Agree in advance how you will inform the recipients of your services if a serious cyber threat endangers them.
How we help
Incident response & forensics: Plans, playbooks and exercises before an incident; containment, forensics and reporting support when one happens.