Montenegro’s planned critical-infrastructure law could create a recurring market for risk consulting, resilience engineering and security services as essential operators face mandatory assessments, continuity plans and incident reporting.
The proposed Law on Critical Infrastructure Resilience covers 11 sectors, including transport, healthcare, drinking water, wastewater, digital infrastructure, public administration and food production and distribution.
Companies and institutions designated as critical would have to establish resilience functions, assess risks and prepare formal plans covering prevention, protection, response and recovery.
The commercial implications extend well beyond cybersecurity.
Operators may need business-continuity planning, physical-security audits, backup systems, supplier-risk assessments, emergency exercises, engineering reviews and staff training.
The framework is designed around the principle that essential services must continue operating when infrastructure is disrupted by natural hazards, technical failures, sabotage or other incidents.
That changes resilience from discretionary corporate spending into a potential compliance cost.
A water utility, hospital, food distributor or digital-infrastructure operator may need to demonstrate not only that its principal assets are protected, but that alternative suppliers, backup capacity and recovery procedures are available if something fails.
That could favour specialist engineering and advisory companies able to combine operational, physical and digital risk assessment.
The law would also increase the importance of incident-management systems.
Critical operators would have to notify authorities of significant incidents within 24 hours and provide more detailed information afterwards. Corporate penalties for some breaches could reach €20,000.
For insurers, the regime could improve the quality of information available when underwriting critical assets.
Documented resilience plans, stress testing and continuity measures can make operational risks easier to assess.
The final size of the market will depend on which companies are formally classified as critical and on implementing rules.
But much of the resulting work is likely to repeat.
Risk assessments need updating, emergency plans require testing, employees need training and suppliers and technical systems change.
For designated operators, resilience is moving from good practice towards a recurring cost of doing business.
