Compliance with cybersecurity requirements has practical value when institutions can prevent incidents, respond promptly and keep essential services running. This was the central issue of the panel “Beyond Compliance: Are We Really Prepared?”, held as part of the National Cybersecurity Conference organised by the National Cyber Security Authority (AKSK) on 3 November 2026 in Tirana.
The panel brought together Enkelejda Muçaj, Deputy Minister of Infrastructure and Energy, Barna Levente Kutvolgyi, Chief Executive Officer of ONE Albania, Reglendi Xhango, Chair of the Cyber Emergency Readiness Team at the Albanian Association of Banks, and Esmeralda Kazia, Director of Technology at the Albanian Power Corporation (KESH). Irma Droboniku, Deputy Director General of AKSK, moderated the discussion.
Perspectives from telecommunications, finance and energy highlighted how closely critical services depend on one another and why a coordinated approach to risk is necessary. An incident affecting one operator can have consequences for other sectors, disrupting economic activity and citizens’ daily lives and weakening trust in services. Implementing standards therefore requires risk-based investment, well-prepared teams and tested response and recovery plans.
Deputy Minister Enkelejda Muçaj linked cybersecurity to economic resilience and the reliable operation of the networks that underpin essential services. She welcomed cooperation with AKSK in aligning with and implementing European legislation and stressed that institutions and operators should apply these standards in their day-to-day operations.
Muçaj described preparedness as an ongoing process that must evolve as threats and the capabilities of malicious actors change. Action plans must be put into practice, reviewed and improved, while response capabilities should be available across the public and private sectors. She reaffirmed the Ministry of Infrastructure and Energy’s support for this work, with the aim of maintaining services for citizens and businesses even during a crisis.
Speaking from the telecommunications sector’s perspective, Barna Levente Kutvolgyi emphasised the responsibility that comes with the role of electronic communications in keeping the economy running. Banking and many other activities depend on these networks, so protecting them requires involvement across the organisation, including at senior management level.
ONE Albania’s experience in responding to threats illustrated the importance of involving leaders from different business functions, working with AKSK experts and making decisions promptly. Kutvolgyi noted that information sharing and operational coordination help limit risk and address vulnerabilities.
He also discussed dependence on international suppliers and service providers. An incident outside an operator’s own network can affect service availability in Albania. Managing that exposure requires monitoring, sustained investment and the ability to respond to situations that regulations alone cannot fully anticipate.
Turning to the financial sector, Reglendi Xhango illustrated the impact of a cyber crisis through disruptions to everyday services such as card payments, cash withdrawals from ATMs and payments made by businesses. The consequences extend beyond the affected institution and can disrupt the flow of funds and erode public trust.
Xhango explained that resilience means being able to manage incidents and maintain essential functions even when systems are compromised. In discussing the requirements of NIS 2 and DORA, he highlighted the importance of continuous risk management, board accountability, incident reporting and testing response capabilities.
He paid particular attention to third-party risk. Alongside contractual safeguards, institutions need to assess and monitor supplier risk and test whether suppliers can maintain their services during a disruption. Xhango also stressed the need to standardise information sharing among financial institutions and with AKSK, and to allocate sufficient staff and funding to support that work.
Esmeralda Kazia brought the perspective of the energy sector, where the security of digital systems is directly linked to physical processes, industrial equipment and continuity of power generation. She stressed that cybersecurity at KESH is integral to operational safety and to the corporation’s responsibility for maintaining essential services in Albania.
Drawing on her experience in incident monitoring and response at AKSK, Kazia noted that uncertainty about systems, responsibilities and recovery priorities can worsen the impact of an incident. In an industrial environment, even a decision to isolate a device must be assessed with the teams responsible for operations, automation and process safety so that a protective measure does not introduce another risk.
Investment decisions should therefore be based on a clear understanding of critical assets and processes, dependencies between information technology and operational technology, and how privileged access and supplier access are managed. Network segmentation, access management and monitoring should be backed by tested recovery procedures, clear roles and leaders who can make decisions with incomplete information.
Kazia stressed that exercises should verify whether backups can be restored and whether response plans work in practice. The value of investment can be measured by how much it improves the ability to prevent incidents, respond effectively and restore functions in order of priority. For citizens, that means access to electricity, reliable communications and continuity of essential services.
Irma Droboniku highlighted the role of information sharing in strengthening defences across sectors. Information about an incident allows AKSK and operators to take action to protect other systems exposed to the same risk. Cooperation, timely decision-making and joint exercises help institutions translate legal requirements into the practical ability to handle incidents.
The panel emphasised that cyber resilience is built through continuous preparation and tested when services come under pressure. Institutions and operators are responsible for ensuring that standards, investment and operational capabilities work together to limit the impact of incidents and keep the country’s essential services running.
Watch the full panel discussion
