Organisation type
Cybersecurity Season participants
The problem
After the days in the room the habits fade. A month later someone holds the door for a stranger, pastes a customer list into a chat assistant, switches off the computer whose files are locked or talks to a journalist, because in the hurry the right line does not come back. Then what went wrong is not reported within the hour.
26 courses · 1 specific to this profession
A verified example
The deadline for reporting a cyber incident
An example from your field, taken from another profession: Cybersecurity Season facilitators.
- What the tool doesFrom an AI assistant's answer to the security officer of a critical information infrastructure operator, who asked how soon an incident must be reported, to whom, and under which article.
- Where the tool goes wrongThe answer cites a repealed law and does not give the reporting deadline in force.
- The verification stepOpen the law in force on qbz.gov.al and compare the article, deadline and recipient.
More: why it is easy to miss and the full check
Where the tool goes wrong, and why it is easy to miss
The answer looks complete: a law, an authority, an article. But Law no. 2/2017 was repealed by Law no. 25/2024, Article 49, and the deadline is not given. The law in force, Article 23 point 3, requires every incident to be reported within 4 hours of identification, to the National CSIRT and the sectoral CSIRT. Of 30 answers tested, none gave 4 hours; 29 gave 24 or 72 hours.
The check that catches it
- Open the law on qbz.gov.al, in the consolidated version in force, not a summary.
- Check that the law cited to you is still in force: find the article on repeals in the newer law.
- Find the reporting article and compare the deadline, the recipient and the article with what the tool gave you.
- In your internal procedure, write down the law, the article, the deadline and the date you checked them.
Verified on 28 September 2026, ten times per model, with the same question word for word: Claude Haiku 4.5 10/10; Claude Sonnet 5 10/10; Claude Opus 5.5 10/10. Law no. 25/2024 on cybersecurity, Article 23 point 3 and Article 49 (QBZ, text in force).
What it looks like
From the AI assistant's answer… 4. The specific article: the main provisions on the duty to notify incidents are in Article 21 and following of Law no. 2/2017 (the chapter on security measures and incident reporting).
Translated from the Albanian original.
Why this matters to you
Before any hurried action, a question, or a call to the number the company already holds, never the number in the request.
The problem, the workflow and the evidence, in full
- The workflow
- Before any hurried action, a question, or a call to the number the company already holds, never the number in the request. Before any paste, share or photo, two questions: what level is this, and is the tool on the approved list? Unknown means no. Anything that went wrong is reported within the hour through the channel the company names. When files are locked, IT, the manager and the data protection officer hear within 10 minutes, by phone. You do not look for the cause yourself, and only the roles the company has set speak to the press and the regulators.
- What you leave with
- A one-page habits card for a role, written by hand, with no real name, phone number or password. It holds the 4 habits of the season, the lines the role says on the phone to a visitor with no host, to a journalist and to the Commissioner's office, and the reporting path for the first hour. A colleague in the same role can read it without asking you. Beside it stay the rules your room wrote, signed by your manager; the season's record holds counts by team only, never a name next to a result.
What the courses cover: One course that goes with the four days of a client's Cybersecurity Season, for the staff who take part.
The courses in full
One course that goes with the four days of a client's Cybersecurity Season, for the staff who take part. Before each episode (the door and the inbox, the shared drive and the printer tray, the ransom note, the supplier and the press) a short preparation; after it, what to remember, a short learning check and the one habit to keep; then a summary of the season and a practical task.
The Cybersecurity Season for your team
Four episodes of one day each, for an organisation. This workshop is offered on its own; the course below prepares the person who runs it.
Courses for this type of organisation
Courses tied directly to this work appear first.
Cybersecurity Season participants
26 courses · 1 specific to this profession