The framework Accountable Institutions and Social Inclusion
Cybersecurity and Law Enforcement
By 2030, Bosnia and Herzegovina has coordinated, EU-aligned cyber resilience and the tools to deliver digital justice and protect people online.
Contributes to CPD outcome: Accountable Institutions and Social Inclusion
The reality and the drivers
Where we start
Bosnia and Herzegovina faces significant challenges in cybersecurity and the digitalization of law enforcement agencies, marked by a fragmented cybersecurity landscape and work in silos:
Fragmented Cybersecurity governance
Bosnia and Herzegovina lacks a state-level CSIRT and effective coordination of cyber incident responses, and relies on fragmented, disproportionate entity-level defense mechanisms. Major gaps remain in aligning legislation with EU directives (NIS2, Data Act, GDPR). The operational maturity and capacity of existing CSIRTs are low, as institutions struggle to attract and retain skilled cybersecurity experts in the public sector. Cyber initiatives lack a long-term sustainability mechanism.
Silos and "Blind Spots" in Law Enforcement
Cybercrime's borderless nature clashes with BiH's territorial law enforcement, which lacks integrated data exchange systems. Progress has been made in specific areas, but the police sector, particularly in the Federation of BiH, suffers from a lack of digital governance and integrated systems. The current system still needs tools and training to investigate technology-facilitated Gender-Based Violence, as online threats are still perceived as "virtual" or less harmful.
Vulnerable Critical Infrastructure, Private Sector, Citizens
Many critical infrastructure sectors (energy, health, telecom…) and private sector entities operate under voluntary security standards, as they are overlooked by efforts to protect the government and establish public-administration-centric protection mechanisms. Critical infrastructure, the private sector, and citizens (especially women) are highly vulnerable and susceptible to systemic paralysis in case of a major incident.
Key trends shaping change
What is driving the shift
Artificial Intelligence "democratizes" cybercrime
Malicious actors leverage the increasing sophistication of AI tools to develop more advanced and evasive attack methods. Understanding these risks is crucial for developing effective countermeasures.
Alignment with EU Policies
The EU's NIS2 Directive, GDPR, Directive on Violence Against Women, etc., set strict requirements for the development of a holistic national cybersecurity and cybercrime system. No CSIRT means no integration with the EU Digital Single Market.
Geopolitics and Cyber Threats
The Western Balkans, and Bosnia and Herzegovina specifically, are increasingly visible targets, and local and regional trends indicate a rise in state- and non-state-sponsored attacks, signaling that "security through obscurity" is not a viable defense strategy for BiH.
Our plan
What we will do, 2026-2030
8 areas of engagement where UNDP will work with partners to deliver this pillar.
-
Support CSIRTs Operationalization
Provide technical support to state and entity CSIRTs to achieve SIM3 Maturity and FIRST Membership, including establishing the mandatory "Single Point of Contact" to ensure compliance with the EU Reform Agenda.
-
Action on Technology-Facilitated Gender-Based Violence (GBV)
Support harmonization of legal frameworks (EU Directive on Violence Against Women) to criminalize online violence and equip police with forensic tools and capacities to effectively prosecute online GBV.
-
Strengthen Cybersecurity in the Judiciary
Support the establishment of an internal CSIRT for the High Judicial and Prosecutorial Council (HJPC) to protect judiciary digital systems with real-time monitoring and automated alerts for sensitive justice data.
-
Essential Infrastructure Resilience
Provide support in identifying and scoping support to "critical services providers" in sectors beyond public administration (e.g., Energy, Digital Services…) for EU NIS2 compliance.
-
Intelligence-Led Policing
Expand current digital systems (e.g., SALW tracking) and deploy investigative tools to law enforcement agencies across the country to prosecute Technology-Enabled Hate Speech, Disinformation, and Technology-Facilitated Gender-Based Violence.
-
Cybersecurity Academic Specialization
Institutionalize the Cybersecurity Master's Program at the University of Sarajevo as a full degree. Equip labs and actively promote women's enrollment to bridge the critical skills gap.
-
Institutionalization of AI-specific Human Rights Impact Assessments (HRIAs) and Ethical Usage Guidelines
Support the development and requirement of Human Rights Impact Assessments (HRIAs) for all "high-risk" AI systems, including assessments focused on gender, before these systems are deployed in public institutions. Additionally, strengthen the technical oversight capacity of the Personal Data Protection Agency to ensure that the use of AI in public administration respects fundamental human rights.
-
Strengthening Cybersecurity for MSMEs
Since 90% of businesses lack a systemic approach to cybersecurity, these activities will provide budget-friendly security solutions and training for the private sector, based on the pilot activities completed in 2025.
Partner with us on this
Let's deliver Cybersecurity and Law Enforcement together
These areas are an invitation. If your organisation can co-design, co-fund or co-deliver any of them, we want to hear from you.