Three abbreviations keep appearing in tenders, supplier questionnaires and client contracts: ISO 27001, GDPR and NIS2. Owners of Serbian companies often ask the same question: do these apply to us, or only to companies inside the European Union?
The honest answer is: it depends on what you do and for whom. This article explains the three frameworks in plain language and shows where the real pressure comes from. It is general information, not legal advice. For binding answers, ask a lawyer who knows data protection and your sector.
ISO 27001: a standard you choose
ISO/IEC 27001 is an international standard for an information security management system. It is voluntary. A company builds a system of policies, risk assessment and controls, and an independent body can certify it.
- Who it is for: any company that wants to prove it handles information securely, especially IT providers, finance, healthcare and anyone working with large clients.
- What it requires: a risk assessment, a defined scope, documented policies, chosen security controls, internal audits and continuous improvement.
- Why it matters commercially: large clients and tenders increasingly ask for the certificate or at least evidence of similar practices.
GDPR: the EU data protection regulation
GDPR protects the personal data of people in the EU. It can apply to a company outside the EU when that company offers goods or services to people in the EU or monitors their behavior. Serbia has its own Law on Personal Data Protection, which follows the same logic and many of the same principles, so the practical work is similar.
- Know your data: what personal data you hold, why, where it is stored and who can access it.
- Legal basis and transparency: a clear reason for processing, and a privacy notice people can understand.
- Security of processing: access control, encryption where sensible, backups and a procedure for data breaches, including notifying the authority within the legal deadline.
- Processors and contracts: written agreements with every supplier that handles personal data for you.
NIS2: the EU directive on cybersecurity
NIS2 is an EU directive that raises cybersecurity obligations for “essential” and “important” entities in sectors such as energy, transport, health, digital infrastructure, managed service providers and others. It is implemented through national laws of EU member states.
Serbia is not an EU member, so NIS2 does not apply to a Serbian company directly. Serbia has its own rules on information security, with specific duties for operators of ICT systems of special importance. Still, NIS2 matters to you in two practical ways:
- Supply chain pressure. An EU company that falls under NIS2 must manage the security of its suppliers. Expect questionnaires, contract clauses and audits from EU clients.
- A useful benchmark. Its measures are a sensible checklist even where it is not mandatory: risk management, incident handling, business continuity, supply chain security, vulnerability management, and use of multi-factor authentication.
The three side by side
| ISO 27001 | GDPR | NIS2 | |
|---|---|---|---|
| Type | International standard | EU regulation | EU directive |
| Mandatory? | No, voluntary | Yes, if it applies to you | Yes, for covered EU entities |
| Focus | Managing information security | Protecting personal data | Cyber resilience of key sectors |
| Proof | Independent certification | Documentation, records, accountability | Measures and reporting to authorities |
Where to start in a practical way
- Map your data and systems. You cannot protect what you have not listed.
- Do a risk assessment. Identify the few risks that could really hurt the business.
- Cover the basics. Patching, backups, multi-factor authentication, access control, endpoint protection and logging.
- Write short, usable policies and an incident response plan, and test them once.
- Choose your frame. If clients ask for a certificate, ISO 27001 is a natural path. If you process EU personal data, add the GDPR work to it.
Tip: one well-built security program can answer most questionnaires from all three directions. Doing the work once and mapping it to each framework is cheaper than three separate projects.
How we can help
Alficom aligns IT infrastructure with international standards through cyber resilience strategy and compliance services: attack surface analysis, ISO 27001 and GDPR frameworks, incident response planning and vulnerability management. If you are preparing for a client audit, we can begin with a gap analysis against the framework you need.
