iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityCountry filesExport mapAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextGeneral reading

Adapt the reading to the assessed company’s country and activity.

Home / Jurisdictions / Serbia

Country file

Serbia

The Union's purchases here are mainly machinery, equipment and transport materials. The population is largely connected and local hosting is dense here. Regional markers: Europe and Central Asia.

Relationship with the European Union

Stabilisation and Association Agreement with the European Union — in force since 2013

A trade agreement settles customs duties and the origin of goods. It does not settle security: the audit rights and evidence expected by the European client remain the same.

Sources reviewed on 17 September 2026

01

Economy and sectors

In force

Stabilisation and Association Agreement with the European Union

in force since 2013A trade agreement settles customs duties and the origin of goods. It does not settle security: the audit rights and evidence expected by the European client remain the same.

Map of trade agreements — European Commission
Third country

regime applicable to European data and access

European framework trackedNo general adequacy decision. The transfer mechanism and its accompanying measures must be chosen according to the actual data flows.

Adequacy decisions — European Commission
Historic claims

European Union restrictive measures targeting the country

EU Sanctions Map, as at 26 September 2026Only an old-standing prohibition remains on settling claims linked to transactions the UN had banned in the 1990s: ordinary trade is not affected by it.

Council Regulation (EC) No 1733/94
02

Incidents, fraud and impersonation

12 942

secure servers per million inhabitants

2024, latest available figureLocal hosting and certifications are common there. That says nothing about the security of any given provider — only about the terrain in which it operates.

Secure Internet servers — World Bank
Diverted order

verification of instruction changes

Cross-cutting controlOn industrial orders, impersonation targets a change of bank details or delivery location. Confirm any change through a channel already known to you, never the one that requested it.

03

Points to check within your organisation

To be scoped

The workshops behind the assembly

An assembly chain involves subcontractors in cascade. Ask which ones work on your order, from which sites, and which ones have access to the drawings or specifications you provide.

To be governed

What crosses the border with the drawings

Without an adequacy decision, drawings, specifications and production data may only leave under the safeguard of a transfer tool. Ask which one is in place, and what it provides for should a local authority demand access to the supplier's servers.

To be located

Where your data actually resides

Local hosting is common here, which does not tell you where your data actually lands: ask for the country of each environment, including backups, and who holds the keys.

Developments to be aware of

The topics that may change your answers

What this means for your situation

Machinery and transport equipment: 36.4% of what the Union buys here. Behind these flows lie assembly chains and cascading subcontractors, where audit rights and evidence are at stake.

Official sources

Confidential exchange

Describe your European relationship and the request received.

The Serbia file sets out a country and its relationship with the Union. What remains to be established is who assembles, from which sites, and what becomes of your plans once submitted.

Contact iKNSA