meta_id 3217968

On June 5, 2026, the Office of the Government of the Republic of Slovenia for Information Security (URSIV) published guidelines for reporting information security incidents under the Information Security Act (ZInfV-1). The guidelines address new reporting obligations that came into effect following the entry into force of the Information Security Act on June 19, 2025. Under Article 29 of ZInfV-1, essential and important entities must report all incidents to the Computer Security Incident Response Team (CSIRT) that have a significant impact on the provision of their services and are classified as important incidents. URSIV developed the guidelines to clarify the incident reporting procedures required under the act. The guidelines contain key information on entity obligations, reporting procedures, and subsequent reporting requirements for important incidents. They are primarily intended for entities subject to ZInfV-1 that are required to report important incidents. However, entities that voluntarily report incidents, cybersecurity threats, and near-incidents, as well as other organisations seeking to contribute to more effective information and cybersecurity incident response, may also use the guidelines. Until an incident reporting platform is established, reports should be submitted to the competent CSIRT group by email. The guidelines are available as a downloadable PDF document (443 KB) on the Government of Slovenia website. REFERENCES: Office of the Government of the Republic of Slovenia for Information Security. "Napotki za priglašanje incidentov informacijske varnosti" (Guidelines for Reporting Information Security Incidents). June 5, 2026. Available at: https://www.gov.si/