Industries
Cybersecurity shaped around your sector
A bank does not carry the same obligations as a ministry or a mid-size company. Below we set out what the NIS2-aligned law and DORA mean for each of four groups, what they typically face, and how we help.
01
Banks and financial institutions
Banking and the financial market are among the sectors where North Macedonia’s NIS2-aligned law already applies to medium and large entities. If you are a subsidiary of an EU banking or insurance group, your group will also expect DORA compliance, even though the regulation does not apply directly in North Macedonia.
Challenges
- Two frameworks at once: the national law, plus group requirements under DORA, Regulation (EU) 2022/2554, which has applied in the EU since 17 January 2025.
- Tight deadlines: a first notice within three hours of becoming aware of a significant incident, then an early warning at 24 hours and an incident notification at 72 hours.
- Online banking, mobile apps and payment systems are constant targets, and customers feel every outage right away.
- Reliance on ICT suppliers and cloud services, which has to be managed as a supply-chain risk.
How we help
- A 24/7 managed SOC with a timeline for every case, so you can prepare reports for the competent CSIRT and for your group.
- Penetration testing and red teaming of e-banking, mobile apps and APIs as part of digital operational resilience testing.
- An assessment against DORA’s main areas: ICT risk management, ICT incident management and reporting, resilience testing, third-party risk and information sharing.
- One control framework based on ISO/IEC 27001:2022, mapped to both the national law and DORA, so you do not do the same work twice.
02
Public sector and critical infrastructure
Under the law, the Assembly, independent state bodies and regulators, the Government, ministries, state administration bodies, courts, municipalities and the City of Skopje are essential entities. So are owners and operators of critical infrastructure, regardless of size. The law is not mandatory for the Ministry of Interior, the National Security Agency, the Operational-Technical Agency, the Directorate for Security of Classified Information, the Intelligence Agency, the Ministry of Defence and the Public Prosecutor’s Office, and it does not apply to the National Bank.
Challenges
- A mandatory cybersecurity officer: institutions appoint one or more civil servants to the role, who report directly to management.
- Proactive supervision, including on-site checks by the competent authority and audits by auditors licensed by the Ministry of Digital Transformation or other institutions the law permits.
- Registration and reporting through the single cybersecurity portal, with a first notice within three hours of becoming aware of a significant incident.
- Procurement: the Ministry must require certified ICT products and services, as set by a ministerial rulebook, and it keeps a register of high-risk ICT vendors who are excluded from public procurement.
How we help
- A gap assessment against the law’s ten measures, and an annual risk assessment your management can review and adopt.
- Support for your cybersecurity officer: methodology, policies, incident records and evidence ready for supervision. We do not perform the official audit; we prepare you for it.
- 24/7 monitoring with case timelines, so the first notice and the follow-up reports go out on time.
- Regular training for management and staff, as the law requires, and phishing simulations that show where more support is needed.
03
Mid-size companies
If you are a medium or large company in energy, transport, banking, financial market, health, digital infrastructure or B2B ICT service management, the law already applies to you: medium entities are important, large ones are essential. Size follows the classification in North Macedonia’s Company Law, not the EU definition of small and medium-sized enterprises.
Challenges
- First you need to know whether you are in scope: your size under the Company Law, your sector, and whether that sector, such as manufacturing or food, is deferred until EU accession.
- Monitoring at night and over weekends needs a shift team, which is hard to justify for a lean IT department.
- Regulated customers must manage risk in their supply chain, so they may ask you, as a supplier, for evidence of your security.
- Policies and compliance paperwork take time your team does not have.
How we help
- A short call to check whether you are in scope and whether you would be an essential or an important entity.
- A first penetration test with a clear scope, a fixed quote and a report with findings in priority order.
- A 24/7 managed SOC instead of building your own shift team.
- A NIS2 or ISO/IEC 27001:2022 roadmap sized to your company: the measures that reduce the most risk first, the rest after.
04
International companies in North Macedonia
If your group is based in the EU or further afield and part of your business runs in North Macedonia, you need a local partner who knows the Macedonian rules and reports in English, in the format your group already uses.
Challenges
- Two regimes at once: group policies, and in the EU also NIS2 or DORA, plus the Macedonian law, whose deadlines differ from NIS2 because it requires a first notice within three hours of becoming aware of a significant incident.
- Foreign providers of cloud, data center, managed and managed security services without a registered seat in North Macedonia must register a representative with the Ministry of Digital Transformation.
- Your group security team expects findings and incidents in English, in its own structure and rhythm.
- The law, its bylaws and the procedures with the authorities are in Macedonian.
How we help
- A local SOC and incident response team in Skopje, in the same time zone as your office here, who can be on site when needed.
- Reports, case timelines and management summaries in English, with Macedonian versions for the authorities when required.
- Mapping of your group controls, for example under ISO/IEC 27001:2022, NIS2 or DORA, to the Macedonian law, so you can show compliance in both places.
- Penetration tests following OWASP, PTES and NIST SP 800-115, with findings rated using CVSS, in a format your group accepts.
Let’s talk about your security
Tell us what you need: 24/7 monitoring, testing or readiness for the NIS2-aligned law. In a short call we will agree on scope and next steps.
Mon–Fri 09:00–17:00 · SOC 24/7 · info@diverto.mk