An incremental observer generation for modular systems is presented in this paper. It is applied to verification and enforcement of current-state opacity and current-state anonymity, both of which are security/privacy notions that have attracted attention recently. The complexity due to synchronization of subsystems, but also the exponential observer generation complexity, are tackled by local observer generation and an incremental abstraction. Observable events are hidden and abstracted step by step when they become local after synchronization with other subsystems. For systems with shared unobservable events, complete observers can not be generated before some local models are synchronized. At the same time, observable events should be abstracted when they become local, to avoid state space explosion. Therefore, a new combined incremental abstraction and observer generation is proposed. This requires some precaution (detailed in the paper) to be able to accomplish local abstractions before shared unobservable events are removed by observer generation. Furthermore, it is shown how current state opacity and anonymity can be enforced by a supervisor. This is achieved by a natural extension of the verification problem to a supervisory control problem based on forbidden states and incremental abstraction. Finally, a modular and scalable building security problem with arbitrary number of This work was partly carried out within the project SyTec -Systematic Testing of Cyber-Physical Systems, a Swedish Science Foundation grant for strong research environment. The support is gratefully acknowledged.