more significant indicator is the fact that most Serbian IT enterprises take more than a decade to develop from a start-up to a large company. On average, every year about ten micro enterprises grow to become small enterprises, three small enterprises become medium-sized, while only one enterprise succeeds in becoming a large company with 250 or more employees (source: survey Development of the Information Technology Industry). Challenges – It would appear that Serbia provides a sound foundation for starting a business in the IT industry, as it boasts a high-quality workforce; however, local workforce is capable of driving the growth of domestic companies only up to a certain level. On the other hand, foreigners come to this market primarily for the high-quality IT human resources, while all other sources of their growth are found outside of Serbia. For these reasons, the largest battle between IT companies in the local market is for attracting appropriate workforce: until a year or two ago, they competed for the best experts, while currently they compete for the best interns, as labour demand exceeds by far the supply. In such a situation, salary figures become the main “competitive edge” of an employer, and in this regard capacity takes precedence over quality, with international companies still offering more attractive packages. This, in turn, answers the question why domestic IT companies grow at a slower rate than the foreign-owned ones, which also bring access to international markets and finished or semifinished solutions. Foreign employers tend to aim for maximum productivity at a minimum cost, while the value added chain of their operations is usually located outside of Serbia (source: survey Development of the Information Technology Industry). 1.6 INFORMATION SECURITY With the development of new technologies and services, which are increasingly provided electronically, there is an increased demand for stepping up the level of information security. In Serbian legislation, the concept of information security was primarily associated with the information security of ICT systems of special importance in accordance with the Law on Information Security; however, it is increasingly becoming an important segment for both citizens and businesses, coupled with growing awareness of its importance. However, information security risks affect both the government, specifically the ICT systems of special importance, and citizens and businesses, who bear the brunt of cybercrime attacks. 1.6.1 Information security of citizens The module “Trust, Security and Privacy” in the SORS survey provides data on information security of citizens and the risks and threats to which they have been exposed.6 The survey asked the following four questions: 6 The source of data on e-skills is the publication of the Statistical Office of the Republic of Serbia Usage of information and communication technologies in the Republic of Serbia, 2019 https://publikacije.stat.gov.rs/G2019/Pdf/G201916014.pdf 38