National CERT of the Republic of Serbia

Challenge

One place to report and process security incidents

For a platform of this type, a standard informational website was not enough. We needed to develop a reliable digital system that would allow users to report a complex security event in a simple way, while giving the CERT team all the information and tools needed for further processing.

The system had to support different categories of reporters — from individuals and small and medium-sized businesses to operators of ICT systems of special importance — as well as different types and levels of incident severity.

A particular challenge was communication after the initial report. A cyber incident rarely ends with a single form submission: additional information, documentation, and technical data need to be exchanged, and all communication must remain tied to the specific case.

Solution

From report to a complete incident case

We developed a system in which every submission is transformed into a structured case that the CERT team can continue to monitor and process.

The reporting form adapts to the type of user and allows the entry of key incident data — incident category and type, time and duration, event description and impact, as well as technical compromise indicators such as IP addresses, domains, URLs, and hash values. The platform also supports reporting thwarted incidents.

After submission, the user receives a verification message and a unique incident ID, which makes the report the basis for further communication and case handling.

Email communication integrated directly into the case

One of the key parts of the solution is email integration.

The internal system pulls in incoming communication and links it to the corresponding incident, so operators do not have to manage the case in the application while also manually tracking a separate email inbox.

From the system, it is possible to review received messages, send new replies, and connect the full correspondence to the specific case. In this way, all incident data and all communication remain unified in one place.

This approach is especially important because after the initial report, users can send additional information and attachments via email, using the incident ID to link their communication to the existing report.

Key features

Advanced incident reporting

Dynamic forms for individuals, companies, and critical ICT systems, with different data sets depending on the type of report.

Incident & case management

Each report creates a separate case with relevant data, status, and communication history.

Email integration

Receiving, reading, and sending email messages directly from the system, with the full correspondence linked to the relevant incident.

Technical incident data

Recording the incident category, duration, impact, and compromise indicators such as IP addresses, domains, URLs, and hash values.

Thwarted incident reporting

In addition to actual security events, the platform also allows the recording of situations in which an incident was successfully prevented.

Informational and educational portal

Alongside the reporting system, the public part of the platform brings together current security alerts, recommendations, publications, reports, and the register of special CERTs.

Multilingual platform

The content is available in Cyrillic, Latin, and English, making the platform suitable for both local users and international cooperation.

Security

Security as a core requirement

A platform entrusted with sensitive data

For a national cyber incident reporting system, security is not an additional feature — it is the foundation of the entire project.

The platform was designed with a strong focus on protecting communication and data that may contain sensitive information about compromised systems, networks, and security incidents.

The National CERT treats all incident-related correspondence as sensitive, while a PGP infrastructure is also supported for secure information exchange.

Given the nature of the system, the architecture, access controls, and data processing model were developed with significantly higher security requirements than standard web applications.

More than a reporting system

CERT.rs is both an operational tool and a national information center for cyber security.

Through the platform, the National CERT publishes security alerts, recommendations, and information about current threats, maintains a register of special CERTs, and provides access to publications and reports in the field of information security.

The incident intake and processing service is available to users 24/7.

Result

A unified digital flow from incident to response

The result is a centralized platform that connects the public portal, structured cyber incident reporting, case management, and direct email communication.

Instead of disconnected forms, email messages, and internal records, the CERT team gets a unified workspace for handling incidents, while users have a clear channel to report a problem and continue communicating with the responsible team.

The solution was developed for an environment where reliability, availability, security, and precise information management are critical requirements — making it one of the more complex systems in our portfolio.