Back | Home Agenda

Download PDF

Track: Compliance & Data Protection

Tue 03

14:30h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

Cybercompliance 360: Governing digital risk

Emilio Piñeiro Asociación Territorio Compliance President Moderator

Melanie Díaz Molins Defensa Penal Legal Counsel · Corporate, Compliance, Privacy & Digital Manager · DPO/DPD certificada Speaker

Eduard Blasi Casagran TechAndLaw Abogados Abogado especializado en Privacidad e IA · Fundador Speaker

Patricia Cabello Soto PDI - Policía de Investigaciones de Chile Abogada · Compliance y Ciberseguridad Speaker

2026-11-03 14:30 2026-11-03 15:30 Europe/Madrid Cybercompliance 360: Governing digital risk A discussion bringing together professionals from different disciplines to explore how cybersecurity, compliance, risk, privacy, governance and business can no longer be managed as independent functions. Networking Hub

Tue 3

14:30h - 15:30h Networking Hub Public Access

14:35h

Conference | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

NIS2: a preview from Italy

Edoardo Tarricone Complaion CEO and co-founder Speaker

2026-11-03 14:35 2026-11-03 15:00 Europe/Madrid NIS2: a preview from Italy

Italy has had a year of NIS2. Spain is about to start its own.

We saw companies discover they were “essential entities” by reading an email. We saw registrations rushed through at the last minute. We saw suppliers asked to prove NIS2 compliance by their own customers, long before any regulator came knocking. And we saw the gap grow between those who had prepared and those who hadn’t.

Edoardo Tarricone, CEO and co-founder of Complaion, shares what that year taught us: what companies underestimated, which mistakes cost the most, and when they realised they should have started sooner.

Auditorium I

Tue 3

14:35h - 15:00h Auditorium I Full Congress Pass

16:00h

Side Event | Side Event AI, identity and trust in the digital environment Compliance & Data Protection

AI Agents for vulnerability management and compliance-as-code

Schedule

16:00h - 16:30h

From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL

Harald Messemer MessemerTech OÜ ISO 27001 Lead Auditor Speaker

16:30h - 17:00h

Nobody Reads 40,000 Vulnerability Findings

Gerardo Prieto The Mill Adventure CISO Speaker

17:00h - 17:30h

Deepfakes & Spoofing: When SMS and Voice Cannot Be Trusted

Xavier Álvarez Merabytes Director de Operaciones Speaker

17:30h - 18:00h

Barcelona CyberSec Networking

2026-11-03 16:00 2026-11-03 18:00 Europe/Madrid AI Agents for vulnerability management and compliance-as-code Cybersecurity can no longer rely on manual backlogs, static bureaucracy, or blind trust. In this session block, we will explore the frontlines of digital defense: from transforming compliance into a living, automated process (OSCAL), and unleashing AI agents to manage the endless chaos of vulnerability findings, to fighting back in an era where deepfakes and spoofing mean voice and SMS can no longer be trusted. Three pivotal perspectives on building intelligent, scalable, and true zero-trust security for the real world. Networking Hub

Tue 3

16:00h - 18:00h Networking Hub Public Access

16:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Systemic, cyber-physical and supply chain resilience Compliance & Data Protection

From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL

Harald Messemer MessemerTech OÜ ISO 27001 Lead Auditor Speaker

#ComplianceAsCode, #ContinuousAssurance, #ISO27001, #OSCAL, #SGSI

2026-11-03 16:00 2026-11-03 16:30 Europe/Madrid From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL The ISMS and ISO 27001 are often perceived as bureaucratic processes disconnected from day-to-day cybersecurity operations. This talk proposes a different approach: integrating the ISMS into development and operations pipelines until it becomes part of the operational model. The key is to build systems that generate structured, signed evidence, traceably linked to policies, standards and legal requirements. OSCAL provides a common layer to continuously track the implementation and effectiveness of each control. The result is a shift from preparing for audits as one-off exercises to demonstrating an ongoing, living process. When facing an ISO 27001 audit or a customer request, traceability, evidence and the evolution of each control are already in place. Networking Hub

Tue 3

16:00h - 16:30h Networking Hub Public Access

15:30h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

Jornada Anual DCA Ciberseguretat

Laura Caballero Nadales Cybersecurity Agency of Catalonia Director Speaker

Alba Barrientos DCA Gestora de la Comunitat Ciberseguretat Host

José Nicolás Castellano Cybersecurity Consultant Speaker

Xavier Pi UPC School Co-director Máster Industria 4.0 Speaker

Olga Sánchez Caixabank IT Manager Speaker

Barbara Eisele DCA Gestora Blockchain Speaker

2026-11-03 15:30 2026-11-03 17:30 Europe/Madrid Jornada Anual DCA Ciberseguretat La comunitat de ciberseguretat de la Digital Catalonia Alliance (DCA) celebra la seva jornada anual en el marc del Barcelona Cybersecurity Congress, un punt de trobada per a empreses, professionals i agents de l’ecosistema digital. La sessió donarà visibilitat a solucions tecnològiques innovadores en els àmbits de la ciberseguretat i el blockchain, i abordarà els reptes de la confiança digital des de diferents perspectives. El programa inclourà demostracions i casos pràctics, una sessió sobre com s’executa un ciberatac i una taula rodona amb experts en ciberseguretat, compliance i blockchain. La jornada finalitzarà amb un espai de networking per fomentar connexions i noves oportunitats de col·laboració Level 0 - Room 2.1

Tue 3

15:30h - 17:30h Level 0 - Room 2.1 Invitation required

11:20h

Side Event | Side Event Systemic, cyber-physical and supply chain resilience Compliance & Data Protection CISOs & Security Leader

Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial?

Oscar López Grupo Agrolimen Cybersecurity & IT Governance Manager Speaker

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

Pablo Carmona Preventa de Redes y Ciberseguridad OT/IT Speaker

Joan Figueras Coordinador de CCI en Cataluña Speaker

Maite Arcos Fundación ESYS Directora Moderator

2026-11-03 11:20 2026-11-03 12:00 Europe/Madrid Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial? text Networking Hub

Tue 3

11:20h - 12:00h Networking Hub Public Access

11:00h

Side Event | Side Event Systemic, cyber-physical and supply chain resilience Compliance & Data Protection IT & Infrastructure

Cómo gestionar dependencias en proyectos industriales complejos

María Dolores Trapero Elecnor Sistemas Responsable de Centro de Ciberseguridad y redes IT/OT Speaker

2026-11-03 11:00 2026-11-03 11:20 Europe/Madrid Cómo gestionar dependencias en proyectos industriales complejos text Networking Hub

Tue 3

11:00h - 11:20h Networking Hub Public Access

10:00h

Side Event | Side Event Systemic, cyber-physical and supply chain resilience Compliance & Data Protection CISOs & Security Leader IT & Infrastructure

Ciberresiliencia en la cadena de suministro industrial

Schedule

10:00h - 10:20h

Apertura: la cadena de suministro industrial ya no es una cadena

José Valiente Centro de Ciberseguridad Industrial (CCI) Director General Speaker

10:20h - 10:40h

¿Qué ocurre cuando falla un tercero tecnológico crítico?

Oscar López Grupo Agrolimen Cybersecurity & IT Governance Manager Speaker

10:40h - 11:00h

El papel del fabricante en la ciberresiliencia industrial

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

11:00h - 11:20h

Cómo gestionar dependencias en proyectos industriales complejos

María Dolores Trapero Elecnor Sistemas Responsable de Centro de Ciberseguridad y redes IT/OT Speaker

11:20h - 12:00h

Panel – ¿Quién controla realmente el riesgo de la cadena de suministro industrial?

Oscar López Grupo Agrolimen Cybersecurity & IT Governance Manager Speaker

César Delgado Rockwell Automation Cybersecurity Business Development Speaker

Pablo Carmona Preventa de Redes y Ciberseguridad OT/IT Speaker

Joan Figueras Coordinador de CCI en Cataluña Speaker

Maite Arcos Fundación ESYS Directora Moderator

2026-11-03 10:00 2026-11-03 12:00 Europe/Madrid Ciberresiliencia en la cadena de suministro industrial La resiliencia industrial ya no depende únicamente de proteger los activos propios, sino de comprender y gobernar las dependencias tecnológicas que sostienen la operación. Este side event aborda la cadena de suministro desde cuatro perspectivas complementarias: operador industrial, fabricante, ingeniería y gobierno del riesgo. Analizaremos qué ocurre cuando falla un tercero tecnológico crítico, cómo diseñar productos y arquitecturas capaces de resistir, y cómo gestionar dependencias en proyectos industriales complejos. La sesión culminará con un panel sobre quién controla realmente el riesgo de la cadena de suministro, poniendo el foco en responsabilidad compartida, visibilidad, alternativas, capacidad de respuesta y continuidad operativa. Networking Hub

Tue 3

10:00h - 12:00h Networking Hub Public Access

Wed 04

12:00h

Side Event | Side Event Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

Roundtable: From port to aircraft and across supply chain – Common cybersecurity and CTI challenges

Nick Saharan CSAFI.ORG President Speaker

Vincent Rigal Head of Amadeus Application Security Operations Centers Speaker

Alejandro Manuel Herrera Pérez Port of Algeciras CISO Speaker

Ulrich Seldeslachts LSEC Leaders in Security CEO Moderator

2026-11-04 12:00 2026-11-04 13:00 Europe/Madrid Roundtable: From port to aircraft and across supply chain – Common cybersecurity and CTI challenges Where logistics, aviation and maritime cybersecurity challenges overlap - Legacy systems and operational technology -Third-party and supplier risks - Situational awareness and threat intelligence - Incident coordination across organisations- Opportunities for cross-sector information sharing. Level 1 - Room 2.3

Wed 4

12:00h - 13:00h Level 1 - Room 2.3 Public Access

16:00h

Side Event | Side Event AI, identity and trust in the digital environment Compliance & Data Protection IT & Infrastructure

Agents that act, humans that respond

José Manuel Tejedor Lloria Global CISO Council Spain Chapter Vice President – Finance Moderator

Eva Puerta Pérez Global CISO Council Spain Chapter Vice President – Academia Speaker

Rubén Cortés Domingo Global CISO Council Spain Chapter Advisory Board Member Speaker

Xavier Duch Global CISO Council Spain Chapter Advisory Board Member Speaker

2026-11-04 16:00 2026-11-04 17:30 Europe/Madrid Agents that act, humans that respond

Artificial intelligence is moving beyond assisting people to taking action. Systems already exist that can use tools, access data, trigger processes, and operate with real permissions.

Level 0 - Room 2.2

Wed 4

16:00h - 17:30h Level 0 - Room 2.2 Public Access

16:30h

Awards | Awards Cybersecurity as a strategic business and reputational risk Compliance & Data Protection CISOs & Security Leader

The CISO Leadership Awards Ceremony

Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Jury

Holger Spohn North Atlantic Treaty Organisation Principal Engineer (Advanced Cyber Defence Principles) Jury

José Valiente Centro de Ciberseguridad Industrial (CCI) Director General Jury

Krzysztof Szubert European Cyber Security Organisation (ECSO) Member of the Board of Directors Jury

Anett Mádi-Nátor Women4Cyber Foundation President Jury

Daniel Walther die Mobiliar Chief Information Security Officer Jury

Jon France idea42 CISO Jury

Katy Anton JP Morgan Executive Director of Cybersecurity Architecture Jury

Luca Dozio Altermaind Chief Information Security Officer Jury

Sascha Maier SV Group Chief Information Security Officer Jury

2026-11-04 16:30 2026-11-04 17:30 Europe/Madrid The CISO Leadership Awards Ceremony 28 of the most influential cybersecurity leaders in Europe and beyond are competing across 7 categories. The winners will be revealed live at Barcelona Cybersecurity Congress on 4 November at 16:30. Make sure you are in the room. Auditorium I

Wed 4

16:30h - 17:30h Auditorium I Full Congress Pass

10:45h

Conference | Congress Cybersecurity as a strategic business and reputational risk Compliance & Data Protection

No one is above the line: How NIS2 and DORA made the cybersecurity poverty line everyone’s problem

Rob Harrison Sophos Vice President Speaker

#Accountability, #Compliance, #Compliance&DataProtection, #CyberRegulation, #CyberResilience, #DORA, #Governance, #NIS2, #RiskManagement

2026-11-04 10:45 2026-11-04 11:10 Europe/Madrid No one is above the line: How NIS2 and DORA made the cybersecurity poverty line everyone’s problem Europe's regulators have quietly redrawn the cybersecurity poverty line - the gap between the few organisations that can run security as a system and the millions that have the tools but not the capability to make them work. Under NIS2 and DORA, that gap is no longer a social problem; it's a legal one, and it runs straight through your supply chain. When an under-resourced supplier or ICT provider sits below the line, you inherit both the breach and the regulatory exposure and, increasingly, your board inherits personal liability for it. This session examines how MDR and an agentic SOC scale security operations across 40,000 organizations, and why the harder, unsolved problem is scaling strategy and governance. That's the gap Sophos CISO Advantage is built to close: scaling the judgment of a world-class CISO, continuous control validation, and regulator-ready metrics to organisations with or without a CISO, so they can both deliver their security strategy and prove it, and lift their whole ecosystem above the line. Auditorium I

Wed 4

10:45h - 11:10h Auditorium I Full Congress Pass

13:05h

Roundtable | Congress AI, identity and trust in the digital environment Compliance & Data Protection

Europe’s cyber resilience & cyber sovereignty: a strategic perspective from Europe’s governmental cybersecurity agencies

Marcos Gómez INCIBE - Instituto Nacional de Ciberseguridad CISO & Deputy Director of Corporate Security Speaker

Pekka Jokinen National Cyber Security Center Finland Deputy Director General Speaker

Maurizio Mensi Italian National School of Administration Professor of Law and Economics Moderator

Arno Spiegel Federal Chancellery (Austria) Deputy Director - Cybersecurity and Crisis Data Center Speaker

Carlos Moreira Antunes National Cybersecurity Centre (Portugal) Head of Legal and International Affairs Speaker

#CyberResilience, #CyberSovereignty, #EuropeanSecurity, #GovernmentCybersecurity, #NIS2, #StrategicCooperation, #ThreatLandscape

2026-11-04 13:05 2026-11-04 13:50 Europe/Madrid Europe’s cyber resilience & cyber sovereignty: a strategic perspective from Europe’s governmental cybersecurity agencies

Europe is entering a decisive era for cybersecurity. As geopolitical tensions, sophisticated cyber threats, supply-chain dependencies and digital disruption continue to grow, European governments must strengthen their ability to anticipate, withstand and recover from cyber incidents while protecting Europe’s strategic digital autonomy.

This high-level panel brings together senior representatives from the national cybersecurity agencies of Portugal, Spain, Finland and Austria to explore the governmental perspective on European Cyber Resilience and Cyber Sovereignty. The discussion will examine how European nations are translating EU cyber strategies, regulations and resilience frameworks into national capabilities; protecting critical infrastructure and government services; strengthening public-private cooperation; securing strategic technologies and supply chains; and developing greater European sovereignty in an increasingly contested digital environment.

The panel will provide practical insights into Europe’s evolving cybersecurity priorities, cross-border cooperation and the capabilities required to build a more resilient, secure and digitally sovereign Europe.

Auditorium I

Wed 4

13:05h - 13:50h Auditorium I Full Congress Pass

Thu 05

14:05h

Conference | Congress AI, identity and trust in the digital environment Compliance & Data Protection

Governing, testing and assuring AI-enabled systems

Iraklis Mathiopoulos CREST Europe Council Member Speaker

2026-11-05 14:05 2026-11-05 14:30 Europe/Madrid Governing, testing and assuring AI-enabled systems

AI is transforming cybersecurity services, creating new opportunities while introducing challenges around risk, governance and trust. As AI systems become increasingly autonomous, how can organisations ensure they are secure, reliable and used responsibly?

Drawing on CREST's latest research and work on AI principles, standards and assurance, this session will explore how organisations can build confidence in AI-enabled systems through effective governance, human oversight, testing and independent assurance, enabling responsible innovation without compromising trust.

Auditorium I

Thu 5

14:05h - 14:30h Auditorium I Full Congress Pass

10:00h

Side Event | Side Event AI, identity and trust in the digital environment Compliance & Data Protection

AI under control: Security, governance and accountability

Emilio Piñeiro Asociación Territorio Compliance President Moderator

Jordi Martínez Barranco SELGRUP Dirección de Tecnología · Gobernanza IT · Transformación Digital · Seguridad de la Información · IA Speaker

Sonia Gracia Castellón Fieldfisher Principal Associate · Privacy & Digital Law · AI & Technology Speaker

Mª Dolores Fenollosa INCOTEC Innovación Eficiente Innovación · Negocio · Startups tecnológicas · Cumplimiento Speaker

2026-11-05 10:00 2026-11-05 11:00 Europe/Madrid AI under control: Security, governance and accountability A practical and multidisciplinary conversation on how organisations can govern the use of AI through security, risk management, compliance, accountability and organisational decision-making. Networking Hub

Thu 5

10:00h - 11:00h Networking Hub Public Access

Track: Compliance & Data Protection

#BCC26