NIS2 obligations in Montenegro

Competent authority & CSIRT Legal ref: Art. 5, 6

• The Ministry of Public Administration & govCERT (CSIRT) serve as the Competent Authority for public administration entities The Agency for Cybersecurity serves as the Competent Authority for all other essential and important entities. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 19, 22

• Corresponds to NIS2 ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 20

• The ministry responsible for the sector or sub-sector where essential and important entities are identified shall compile a list of all relevant authorities and entities within that sector or sub-sector and submit a request to them for data collection. Based on sectoral registry lists, the Ministry prepares a unified proposal for a list of essential and important entities and submits it to the Government. The following details are requested: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Address of registered office. ecs-org.eu · 28 Oct 2026 · secondary source
• Tax identification number. ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details of the legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• Information related to the jurisdiction or activities of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector or sub-sector classification. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 30 – 35

• In cases where a cyber threat or incident could significantly affect the continuity of service provision, entities should submit an initial notification to the Agency for Cybersecurity. The state administration authorities should submit an initial notification to the State Administration CSIRT. The initial notification shall be submitted no later than 24 hours from the moment of becoming aware of the cyber threat or incident via a dedicated form. Upon receipt of the initial notification, the Agency, or the CSIRT of the State Administration, analyses the impact of the cyber threat, serious cyber threat, or incident on the continuity of service provision and possible ways to respond to that cyber threat, or incident, and determines the level of the incident, which may be low, medium, or high. ecs-org.eu · 28 Oct 2026 · secondary source
• Low: 24 hours for the incident handling instructions by the Agency for Cybersecurity or CSIRT. ecs-org.eu · 28 Oct 2026 · secondary source
• Medium: 24 hours for the Agency for Cybersecurity or CSIRT to provide guidelines for responding to the incident and participate in resolving the incident. As the incident is ongoing, entities are obliged to submit to the Agency or the CSIRT of the State Administration, within 72 hours of submitting the initial notification, the first report on the duration of the incident and the measures taken to resolve it. ecs-org.eu · 28 Oct 2026 · secondary source
• High: Upon receiving the initial notification and assessing the level of significance, the Agency is obliged to notify the CSIRT of the State Administration, without delay, in writing. Entities are obliged to submit the first report on the duration of the incident to the Agency or the State Administration CSIRT within 72 hours of submitting the initial notification. If the incident continues beyond these deadlines, entities are obliged to submit, every 24 hours, to the Agency, or the CSIRT of the State Administration, continuous reports on the duration of the incident and the measures taken to resolve the incident. No later than 30 days from the date of resolution of the incident, entities are obliged to submit to the Agency, or the CSIRT, a final report. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 68, 69, 70

• From 500 to 20,000 EUR for failing to implement required security measures, meet ISO/IEC 27001 standards, verify compliance, or not report changes to the Competent Authority. Legal representatives face fines from 30 to 1,500 EUR (essential). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 to 10,000 EUR for similar failures, for failing to implement security measures and report data changes. Legal representatives face fines from 30 to 1,500 EUR (important). ecs-org.eu · 28 Oct 2026 · secondary source
• Entities also face sanctions between 500 and 5,000 EUR for breaches such as not appointing a security officer, failing to submit data or cyber incident reports within set deadlines, or not following the required incident reporting procedures. Repeated violations may lead to a temporary ban (3 to 6 months) on conducting business activities. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 16,18

• MEST ISO/IEC 27001 – national standardisation based on ISO/IEC 27001; An accredited legal entity will be issuing certificate on standards implementation for key entities ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Zakon o informacionoj bezbjednosti

What changed recently

No dated changes recorded.