Cybersecurity Beyond Legal Requirements: Readiness Is Measured by Service Continuity

This was the central issue of the panel “Beyond Compliance: Are We Truly Prepared?”, part of the National Cybersecurity Conference organized by the National Cybersecurity Authority on November 3, 2026, in Tirana. The panel featured Enkelejda Muçaj, Deputy Minister of Infrastructure and Energy; Barna Levente Kutvolgyi, Chief Executive Officer of ONE Albania; Reglendi Xhango, Head of the Cyber Emergency Readiness Team at the Albanian Association of Banks; and Esmeralda Kazia, Chief Technology Officer at the Albanian Power Corporation, moderated by Irma Droboniku, Deputy Director General of the National Cybersecurity Authority. The discussion also addressed dependence on international suppliers and providers, where an incident outside an operator’s own network could affect the accessibility of services in the country. In addressing the requirements of NIS2 and DORA, it highlighted the importance of continuous risk management, board accountability, incident reporting, and capability testing. In an industrial environment, even isolating a device must be assessed in cooperation with the structures responsible for operations, automation, and process safety, so that a protective measure does not create another risk. For this reason, investments should be based on knowledge of critical assets and processes, the dependencies between information technology and operational technology, and privileged and supplier access.