12-14 October 2026, Herceg Novi, Montenegro

Digital public services are expanding rapidly across the Western Balkans and Eastern Partnership, and with them grows the responsibility of public institutions to keep systems secure, protect citizens’ data and maintain services when something goes wrong. Cyber resilience is therefore no longer the concern of IT departments alone. It has become a question of institutional preparedness, public-sector leadership and citizens’ trust.

With this in focus, ReSPA, together with the Western Balkans Cyber Capacity Centre (WB3C) and relevant national cybersecurity institutions, brought public administration professionals from the Western Balkans, Armenia, Moldova and Ukraine together in Herceg Novi for an advanced Training of Trainers on Cyber Resilience and Data Protection.

Held alongside the Western Balkans Digital Summit, the three-day programme was designed around a very practical ambition: to strengthen the people inside public administrations who can recognise risks, respond effectively, protect sensitive data — and transfer that knowledge further within their institutions.

As governments become increasingly dependent on digital platforms, interconnected systems and data-driven services, cyber incidents can affect much more than technology. They can interrupt essential public services, expose personal information and weaken confidence in institutions.

Building resilience therefore means preparing institutions before a crisis happens by clarifying responsibilities, strengthening procedures and ensuring that staff know how to react when systems and services come under pressure.

Opening the programme on behalf of ReSPA, Bojana Bajić emphasised this connection between digital transformation and stronger public institutions: “Digital transformation must go hand in hand with cybersecurity, data protection and citizens' trust. Through this Training of Trainers programme, we aim to empower professionals to share knowledge and strengthen resilience across public administrations.” 

From Knowing the Rules to Knowing What to Do

Rather than stopping at awareness raising, the programme focused on how institutions can actually prepare, respond and improve. Through practical exercises, case studies, institutional self-assessments and peer learning, participants worked on issues ranging from emerging cyber threats and cybersecurity governance to cyber hygiene, incident prevention, business continuity and crisis management.

The programme also placed strong emphasis on the practical side of data protection. Participants explored the application of GDPR principles, Records of Processing Activities, Data Protection Impact Assessments, transparency obligations and data subject rights - all areas that increasingly shape the daily work of modern public administrations.

The final part of the programme looked ahead to the challenges administrations are already beginning to face: artificial intelligence, cybersecurity information sharing and stronger institutional cooperation.

But just as importantly, participants worked on how to transfer this knowledge further. Through the ToT approach, they developed institutional action plans and practical methods for sharing knowledge within their administrations, helping ensure that what is learned in Herceg Novi does not remain with one participant or one unit.

Sessions were facilitated by WB3C experts Arianit Maraj and Stella Manga Chesnay, who brought specialised expertise in cybersecurity governance, institutional resilience and data protection.

The programme’s connection with the Western Balkans Digital Summit, also held in Herceg Novi from 12 to 14 October, further expanded that exchange. Participants joined Summit activities and connected with policymakers, digital transformation leaders, international organisations and other stakeholders working on the future of digital government. This broader context reinforced an important message: digital innovation, cybersecurity and data protection cannot be treated as separate agendas. They increasingly need to advance together.

The real value of the programme will be measured not only by what participants learned during the three days, but by what happens once they return to their institutions. The Training of Trainers model is designed to create a multiplier effect - encouraging participants to transfer practical knowledge, support institutional learning and strengthen cybersecurity awareness among their colleagues. It requires institutions in which people understand the risks, know their responsibilities and are prepared to act - from senior management and policy teams to data protection officers and operational staff.

By connecting public administration professionals, cybersecurity experts and regional partners, ReSPA and WB3C are helping strengthen the institutional foundations needed for safer, more resilient and more trusted digital public services across the Western Balkans and Eastern Partnership.