NISG 2026 & NIS2: putting cybersecurity into practice

What applies in Austria?

Austria’s Network and Information Systems Security Act 2026 (NISG 2026) implements the EU NIS2 Directive and has been fully in force since 1 October 2026. Entities in scope must already meet the applicable requirements. Registration deadlines do not postpone security or incident-reporting duties.

Source: Federal Office for Cybersecurity – legislation (German)

Is your organisation in scope?

Classification depends on the sector, type of entity, company size and statutory exceptions. Headcount alone is not a sufficient assessment. Partner and linked enterprises may also affect the size calculation. We support technical discovery; a binding legal assessment needs separate clarification.

Legal basis: NISG 2026, particularly sections 24–27 (German)

What needs attention?

Management bodies are responsible for implementation. Key topics include risk analysis, incident handling, backup and recovery, supply-chain security, vulnerability management, access controls and training. Measures must suit the organisation and its risks, with effectiveness that can be assessed.

Source: risk-management measures (German)

Registration and incident reporting

Initial registration uses NIS2-Services in Austria’s Business Service Portal. For entities already in scope when the Act entered into force, the authority specifies 1 January 2027 in principle, extended to 4 January 2027 under the deadline rules. Entities becoming subject later generally have three months. Registered information must be kept up to date.

Source: registration and deadlines (German)

Significant cybersecurity incidents require action without undue delay: early warning within 24 hours and notification generally within 72 hours of awareness. Trust service providers have a shorter notification deadline. A final report is generally due within one month of notification; ongoing incidents require a progress report first.

Source: reporting, exceptions and follow-up reports (German)

Our support: from discovery to implementation

• Build visibility: Record systems, network zones, interfaces and external access.
• Prioritise risks: Turn technical gaps and operational dependencies into an actionable plan.
• Secure IT and OT: Design and implement segmentation, firewall rules, secure remote access and permission models.
• Prepare operations: Plan logging, recovery and technical incident procedures.
• Build evidence: Document configurations, decisions and tests clearly.

Start with a clear next step

Bring your network diagrams, system inventories and open questions. Together we identify where discovery is needed and which technical measures to tackle first.

Discuss your project

This page provides general information and describes technical support. It does not replace individual legal advice or classification by the competent authority.