Cybersecurity questions and answers

Diverto MK is a cybersecurity company registered as ДИВЕРТО ИНФОРМАЦИСКА СИГУРНОСТ ДООЕЛ Скопје. Our office is at Arhiepiskop Dositej 8 in Skopje, and we have worked in information security since 2007. We provide a 24/7 managed SOC, incident response, penetration testing, AI security, readiness for NIS2, ISO 27001 and DORA, and staff training.

Vlatko Cvetanoski is Chief Executive Officer and has more than 20 years in information security. Dimitar Blazevski, Chief Technology Officer, is responsible for security architecture and technical strategy. Stefan Trajkovski, Head of Security Operations, leads the SOC and our managed security services.

No. Our office and SOC are in Skopje, but monitoring, external testing and part of our consulting happen remotely, so it does not matter whether your systems sit on your premises, in a data center or in the cloud. When the work calls for it, we come on site.

Yes. Diverto MK is a partner of the Faculty of Computer Science and Engineering (FINKI) at Ss. Cyril and Methodius University in Skopje.

A Security Operations Center (SOC) is a team, with processes and tools, that continuously monitors an organization’s systems, detects attacks and coordinates the response. Our SOC in Skopje runs 24/7: it correlates signals from endpoints, servers, cloud, network and identity, enriches them with threat intelligence and has AI draft the first analysis. An analyst then makes the decision and approves every action.

It depends on scope: how many applications, APIs, IP addresses or network segments we test, how much we know in advance (black, grey or white box), whether you need a retest after fixes, and any special conditions such as testing outside business hours. That is why we do not publish a price list. After a short scoping call you receive a written proposal with a fixed price.

A scan is automated: a tool looks for known vulnerabilities and produces a list that includes false positives. A penetration test is led by a person who confirms the findings, chains weaknesses together the way an attacker would and shows how far an attack can really go. You get a report with evidence, CVSS ratings and prioritized recommendations.

That risk is managed up front. Before we start, we agree in writing on scope, time windows, systems excluded from testing and emergency contacts. We announce risky tests and run them in an agreed window, and if we see instability, we stop and tell you right away.

Yes: security awareness training and phishing simulations. North Macedonia’s NIS2-aligned law lists basic cyber hygiene practices and training among its mandatory measures and requires regular training for management and staff. ISO/IEC 27001:2022 covers the same ground in control 6.3.

The Law on Security of Network and Information Systems (an unofficial English title) applies from 1 January 2026. It covers public sector institutions and medium and large entities in energy, transport, banking, financial market, health, digital infrastructure and B2B ICT service management. Size is determined under the Company Law. Some entities are covered regardless of size, for example providers of public electronic communications services, trust service providers, DNS providers and critical infrastructure operators. For sectors such as manufacturing, food, chemicals, waste management and digital providers, the law only starts to apply on EU accession. The Government published the lists of essential and important entities in June 2026; if you meet the criteria but are not listed, you must notify the competent authority yourself.

You notify the competent CSIRT immediately, and at the latest within three hours of becoming aware of a significant incident or significant cyber threat. Then come an early warning within 24 hours, an incident notification within 72 hours, an intermediate report on request, and a final report within one month of the notification. If the incident is still ongoing, you submit a progress report, then the final report within one month of resolution. These deadlines are not the same as under the NIS2 Directive, which has no three-hour step.

An essential entity can be fined up to 2% of its total annual revenue in the previous business year, and an important entity up to 1.4%. The responsible person can be fined up to EUR 5,000, and a court that fines an essential entity also bans it from carrying out its activity for three months to two years. Fines are imposed by a court in misdemeanor proceedings, not by MKD-CIRT or the Ministry of Digital Transformation.

No. We are not a certification body or a licensed auditor. We assess where you stand, implement controls and documentation, and support you during the audit. ISO/IEC 27001:2022 certificates are issued by a certification body of your choice, ideally an accredited one, and audits under the law are carried out by auditors licensed by the Ministry of Digital Transformation or by other institutions the law permits.

Not directly. DORA, Regulation (EU) 2022/2554, has applied to financial entities in the EU since 17 January 2025, and North Macedonia is not an EU member. It still matters for local subsidiaries of EU banking and insurance groups, which follow group requirements, and for ICT providers that serve EU financial entities.

Email info@diverto.mk or call +389 75 340 034, Monday to Friday, 09:00 to 17:00. In the first conversation we learn what you need and agree on scope. You then receive a written proposal with scope, timeline and price, and work begins once we have agreed on the rules and contacts.

Call +389 75 340 034 or email info@diverto.mk with “urgent incident” in the subject line. If you are a client of our SOC, use your agreed escalation channel, which is available 24/7. Meanwhile, isolate affected systems from the network, but do not power them off or wipe them, so the evidence is preserved. If you are an essential or important entity, keep the three-hour deadline for the first notice in mind.

Yes. We communicate and report in Macedonian or English, whichever you prefer. International companies receive reports, case timelines and management summaries in English, and we prepare Macedonian versions for the authorities when needed.

Yes. We fit the scope to your size and risk, not the other way around. The NIS2-aligned law covers medium and large entities, but smaller companies may still receive security requirements from regulated customers. A penetration test or a short review of basic controls is a good place to start.