The State of Critical Infrastructure Protection in Bosnia and Herzegovina

The previous column in this space looked at one specific gap: the absence of a state-level inventory of critical infrastructure. That gap is real and it matters, but it is also only one layer of a larger picture, and looking at it in isolation risks suggesting that a finished law would, on its own, fix the underlying condition. It would not. Bosnia and Herzegovina's critical infrastructure protection problem is not a single missing document. It is a stack of missing layers, legal, institutional, technical, and regional, each of which would need to function even if the others already did. 

The Legal Layer: Fragmented Rather Than Absent 

It is not accurate to say BiH has no critical infrastructure legislation at all. Republika Srpska has a functioning entity-level law, complete with a risk-analysis methodology, mandatory security plans, designated security coordinators, and an inspection regime with enforcement powers. What does not exist is a state-level equivalent, a Federation-level one, or any mechanism reconciling the RS framework with whatever eventually gets written for the rest of the country. A working group under the Council of Ministers has been trying to draft that state-level law since June 2025 and missed its own December 2025 deadline. The practical result is a country where one entity has a legal definition of critical infrastructure and an enforcement mechanism behind it, while the rest of the country operates on informal consensus about what probably counts. 

The Institutional Layer: No National CERT, No Central Coordinator 

Underneath the legal gap sits an institutional one that is arguably more consequential day to day. Bosnia and Herzegovina still does not have a functioning state-level CERT, the team that would normally coordinate incident response, threat intelligence sharing, and technical guidance across sectors during a live event. The laws that would establish information security governance and cybercrime jurisdiction at the state level remain stalled alongside the critical infrastructure law, for reasons reporting has attributed to a lack of political will rather than technical disagreement. Saša Mrdović, a computer security professor at the University of Sarajevo's Faculty of Electrical Engineering, has noted that critical infrastructure security has internationally recognized standards that can bring risk down to an acceptable level; the issue in BiH is not a shortage of available methodology; it is the absence of an institution mandated to apply it consistently across entities. 

The Technical Layer: OT Systems Weren't Built to Be Defended 

Even where legal and institutional frameworks exist elsewhere, they run into a harder problem specific to critical infrastructure: the operational technology running the power grid, water treatment, and industrial control systems in this region was largely built for reliability and physical safety, not for a threat model that includes remote network intrusion. This is not unique to BiH. A 2026 industry threat report tracking cyber incidents with physical consequences on critical infrastructure found that while total incidents with physical impact fell from 76 in 2024 to 57 in 2025, state-sponsored and hacktivist attacks with physical consequences doubled over the same period, from 7 to 14, with several tied directly to the Russia-Ukraine conflict and pro-Russian actors targeting Western infrastructure. That pattern has already reached the region directly: Polish energy grid systems and a Norwegian dam were hit by destructive malware, and Polish water treatment facilities were targeted more recently. None of this is abstract for BiH specifically, a regional power grid collapse on June 21 this year knocked out electricity across Albania, Montenegro, Bosnia and Herzegovina, and part of Croatia simultaneously, a reminder that the country's grid is not an isolated system whose failure modes stop at its own border, whatever the cause of a given incident turns out to be. 

What Has Already Happened, Not Just What Could 

BiH's exposure is not hypothetical either. Institutions in Republika Srpska, including the entity's Integrated Health Information System and Tax Administration, have already suffered breaches that put credential data and other sensitive information into circulation on dark web and local forums. Tens of millions of cybersecurity threats were logged against the country in a single recent year, according to industry monitoring cited in regional reporting. Ognjen Peštelić, a security expert quoted in that same reporting, described a specific and uncomfortable gap: governments across the region moved quickly after the pandemic and the war in Ukraine to adopt strategies protecting the energy, oil and gas, healthcare, and banking sectors, and BiH did not keep pace, in his assessment failing to treat cyber defense as a matter tied to the country's basic statehood. 

The Regional Comparison That Keeps Getting Sharper 

Every neighboring jurisdiction moving toward EU accession is being asked to demonstrate the kind of sectoral risk mapping and inventory work that BiH's own accession assessments flag as absent, alongside underfunded and understaffed regulatory bodies for cybersecurity and digital governance more broadly. Croatia already has a state law defining national critical infrastructure sectors, mandatory risk analyses, and a formal EU contact point. Serbia dealt with a threat to a gas pipeline earlier this year that BiH analysts pointed to directly as a preview of a scenario the country currently has no coordinated way to answer. BiH's ranking on the National Cyber Security Index, 82nd globally and lowest in Europe, alongside states like Kiribati and Uganda, is not a reputational statistic. It is a reasonably direct proxy for how many of these layers are actually functioning versus how many exist only as stated intentions. 

What "Protection" Would Actually Require 

Put together, the picture is not one gap waiting on one law. It is a legal framework that exists in one entity and nowhere else, an institutional layer missing its central coordinating body, a technical layer built for a different threat model than the one it now faces, and a regional context where neighboring incidents are no longer abstract warnings but events the country's own grid has already been pulled into. A finished state-level critical infrastructure law would close one of these gaps. It would not, on its own, produce a CERT, retrofit control systems, or reconcile entity-level legislation that already conflicts with what a state law will eventually say. Each layer has to be built, and none of them substitutes for the others, which is the more honest way to describe where the country currently stands: not undefended by choice, but undefended by a long accumulation of layers nobody has yet finished building. 

References: 

Al Jazeera Balkans (2024, January 14). Koliko je Bosna i Hercegovina ranjiva na cyber napade. 

Al Jazeera Balkans (2024, September 17/29). 'Katastrofalno opasni' cyber-napadi sve češće prijete i Balkanu. 

Detektor.ba (2025, October 3; 2026, April 8). Reporting on BiH's stalled CERT and critical infrastructure legislation. 

Fokus.ba (2025, September 23). Bosna i Hercegovina bi uskoro mogla dobiti zakon o zaštiti kritične infrastrukture. 

Waterfall Security Solutions (2026). Threat Report 2026, as cited in ICT Business. 

tportal.hr (2026, June 11). Hakeri ne miruju: Pogledajte najgore napade u 2026. godini. 

Zakon o bezbjednosti kritičnih infrastruktura u Republici Srpskoj. 

National Cyber Security Index, e-Governance Academy (Estonia).