Cybersecurity Risk Management Framework under the Information Security Act (Zakon o informacijski varnosti – ZInfV-1): The Information Security Act requires covered entities to implement cybersecurity risk management measures and perform compliance assessments. The framework introduces additional risk management obligations, regular training requirements, security documentation, incident management measures and supervisory oversight. Slovenia uses this framework as the national implementation of NIS2 requirements.
Sources: https://pisrs.si/pregledPredpisa?id=ZAKO8934
Model Security Documentation for Organisations (Vzorčna varnostna dokumentacija za organizacije): URSIV has published a complete security governance package to help organisations establish information security and cybersecurity risk management systems. The package includes security policies, risk assessment methodology, risk registers, business continuity planning, recovery planning, incident response planning and effectiveness measurement procedures. Organisations are expected to adapt the templates to their own infrastructure, sector specific requirements and risk assessment results.
Sources: https://www.gov.si/novice/2025-12-12-vzorcna-varnostna-dokumentacija-za-organizacije/
Risk Management Methodology for Information Security (Metodologija upravljanja tveganj na področju informacijske varnosti): URSIV has published a detailed risk assessment methodology to support compliance with national cybersecurity requirements. The methodology is based on ISO/IEC 27001:2022 and ISO/IEC 27005:2022 and requires organisations to systematically assess threats, vulnerabilities, likelihood and business impact for information assets. The approach includes risk registers, acceptable risk levels and a quantitative 5×5 risk model.
Sources: https://www.gov.si/assets/vladne-sluzbe/URSIV/Datoteke/Vzorcna-dokumentacija/3_ANALIZA-OBVLADOVANJA-TVEGANJ_ver_1.0.pdf
Policy and Procedures for Assessing the Effectiveness of Security Measures (Politika s postopki za presojo učinkovitosti varnostnih ukrepov za obvladovanje tveganj): Slovenia provides guidance requiring organisations to measure whether cybersecurity controls effectively manage identified risks. The model policy supports continuous monitoring, reporting to management, corrective actions and evidence-based improvement of cybersecurity measures. The document is intended to support ongoing risk governance and resilience improvement.
Sources: https://www.gov.si/assets/vladne-sluzbe/URSIV/Datoteke/Vzorcna-dokumentacija/8_POLITIKA-S-POSTOPKI-ZA-PRESOJO-UCINKOVITOSTI_ver_1.0.pdf
Risk Management Oversight and Inspection Mechanism: URSIV conducts inspections that review security documentation, risk assessments, implementation of cybersecurity measures and the effectiveness of security controls. Inspection activities include reviews of policies, plans, risk assessments and technical security measures, providing a mechanism to verify implementation of cybersecurity risk management requirements.
Sources: https://www.gov.si/en/state-authorities/government-offices/government-information-security-office/about-the-office/information-security-inspectorate/
https://www.gov.si/assets/vladne-sluzbe/URSIV/Datoteke/Zlozenka-ZInfV-1.pdf
