Without space, there is no protection: The Cyber ​​Security Agency indicated that it still does not have adequate premises for work.

In order for the Cybersecurity Agency to be fully operational, it is urgently necessary to provide adequate space for its work. Further delay in resolving this issue poses an institutional and operational risk…

This is stated, among other things, in the Government's information, which was published after the session on Thursday, which also points out the conditions that the future space should meet, and states that the distance of the data center, which is in the "Vektra" building in Podgorica, from the Government's security and operational center GSOC, which is in the Atlas Capital center, should also be taken into account.

According to the Law on Information Security, which was adopted in December 2024, the Cybersecurity Agency was supposed to be established by the end of March of that year at the latest. However, the government only appointed the acting director in early December last year. Samira Orahovac, and at the end of the same month, the president and members of the Agency Council.

At the Council session held on February 25, information was adopted that tasked the Director of the Agency, in cooperation with the Ministry of Public Administration, to prepare information for the Government of Montenegro in order to urgently resolve the issue of spatial capacities for the Agency's employees.

The Government reminds that this need arises from the Agency's legal obligations, obligations from the Reform Agenda of Montenegro 2024-2027, as well as from the fact that without adequate space, it is not possible to establish the full operational function of the Agency within the required deadline.

"Based on the Law on Information Security, the issue of the Agency's location is not a question of standard administrative space, but rather a question of meeting the conditions for the lawful and efficient performance of tasks in the field of cybersecurity," the information published on Thursday states.

It is recalled that, according to the law, funds for the work of the Agency are provided in the budget of Montenegro, and that the Agency must meet technical and other requirements.

It points out the obligation of operational cooperation of the Agency with state structures responsible for responding to incidents.

"The Law on Information Security, in its provisions governing the handling of high-level incidents and cyber crises, prescribes mutual notification and joint participation of the Agency and the Government Security Operations Center GOSC in resolving incidents, as well as further coordinated action in the event of a cyber crisis," the Information states.

It also reminds of the obligation to cooperate with the Agency to exchange information on cyber threats, serious cyber threats and incidents and to resolve those threats, incidents and cyber crises.

"In operational terms, this cooperation is now directly reflected through cooperation with the Government Security Operations Center GSOC, which additionally conditions the requirement for spatial proximity for the purpose of effective coordination, information exchange and rapid response."

The information points out the importance of choosing a location, reminds that the data center is located in the premises of the "Vektra" building in Podgorica, and that the choice of space for the Agency's work "must objectively be limited to a radius of up to one kilometer from the specified location."

Additionally, as the document states, the Government Security Operations Center GSOC is located in the Atlas Capital Center, which "further confirms the justification and necessity of spatial restrictions within the same radius."

"Since such locational proximity directly affects the speed of response, the quality of coordination and the efficiency of joint operational action in handling threats, incidents and crisis situations."

The information also states that the space provided for the Agency's needs "must, in addition to location requirements, also meet special functional, technical and security requirements"...

"The space must enable the organization of work in clearly separated security areas (zones with different access regimes), with the possibility of establishing controlled entry and exit, physical separation of administrative, operational and technical functions, limited access areas for processing sensitive information, rooms for coordination and incident response, as well as spaces for meetings and inter-institutional cooperation," it states, adding that the space must also have adequate network and telecommunications infrastructure, including optical access, as well as the possibility of establishing a redundant link to ensure continuity of work and resilience of communication connections.

In addition, the space must have the capacity to conduct training and coordination activities with entities of particular importance, including critical infrastructure entities, taking into account the supervisory, coordination and preventive role of the Agency in the national cybersecurity system.

"Analysis of the business space market in locations that meet the above conditions... has determined that the rental price ranges from 24 euros per square meter," it states, with a proposal to find space at a rental price of up to 20 euros per square meter, while meeting all the above technical, functional and security conditions.

"The price limit must not lead to a threat to the minimum conditions necessary for the legal and operationally sustainable work of the Agency," the document states, adding that further delay in resolving this issue poses an institutional and operational risk, "because it reduces the time needed for adaptation, technical equipment, establishment of security regimes, organization of work and proving the full functionality of the Agency in accordance with legal and reform obligations."