Runs an essential service, in Austria

NISG 2026, BGBl. I Nr. 94/2025, §§ 24, 25, 28 und 32 · Read the law's page

• Implement technical, operational and organisational risk-management measures, appropriate and proportionate to the risk, to reduce risks to the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a cybersecurity incident on your users and on other services.
• Cover at least: risk analysis and information-system security concepts; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; effectiveness-assessment policies; basic cyber-hygiene practices and training; cryptography and, where appropriate, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication.
• Have your management body implement and oversee these measures and attend cybersecurity training designed for it, and offer your staff regular training.
• Register with the Bundesamt für Cybersicherheit within three months of this duty applying (by 1 January 2027), and self-declare the risk-management measures you have implemented within twelve months of the day your duty to register arises (1 October 2026 for an entity already covered), not of the day you register; once the Bundesamt first asks for proof of operative and organisational implementation, which it cannot do before two years after this duty applies, give that proof within two months if you are an essential entity (Section 33).
• It binds a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 24, which reaches an online marketplace, an online search engine and a social-networking-services platform provider expressly (Section 28(2)(2)) at the medium-enterprise threshold of Section 25 (at least 50 employees, or turnover and balance-sheet total each over EUR 10 million) or above; the wider sector classes Section 24 also reaches (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT-service management, public administration, space, postal and courier services, waste management, chemicals, food, and manufacturing) are reached too, by declaring that you are an essential or important entity.

NISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35 · Read the law's page

• Notify your competent sector-specific CSIRT, or, absent one, the national CSIRT, of every significant cybersecurity incident: an early warning within 24 hours of becoming aware, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects.
• Follow with a fuller notification within 72 hours of becoming aware, updating the early warning with an initial evaluation of the incident's severity and impact and any indicators of compromise.
• Submit an interim report on request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report no later than one month after you have finished handling the incident (Section 34(2)).
• If you are a trust service provider, submit an incident notification within 24 hours of becoming aware of a significant cybersecurity incident that affects your trust services (Section 34(2)).
• Treat an incident as significant where it has caused, or can cause, severe operational disruption or severe financial loss to your own operations, or has affected, or can affect, another person through considerable material or non-material damage.
• It binds a wesentliche Einrichtung or wichtige Einrichtung on the same scope as this jurisdiction's companion risk-management row, which names an online marketplace, an online search engine and a social-networking-services platform provider expressly; the wider sector classes are reached as on that row.

NISV 2026, BGBl. II Nr. 290/2026, §§ 2 bis 5 und 7 · Read the law's page

• Meet the technical and methodological risk-management requirements of Article 2 and the Annex of Implementing Regulation (EU) 2024/2690 whatever your sector, including where your type of entity is not one that Implementing Regulation names (Section 2).
• Base your risk analysis on at least technological, human, ICT supply-chain and location-related risks (Section 3).
• Where you cannot meet a Section 2 requirement, temporarily or because of your size, implement compensating measures suited to that requirement's purpose, document them with reasons and review their effectiveness at least once a year (Section 4).
• Report an incident as significant under Section 35(1) of the NISG 2026 when it meets any of the nine criteria in Section 5(1), or when incidents that are not significant alone meet the repeat-incident test in Section 7 (at least two within six months, same apparent cause and effect, together meeting the financial-loss criterion).
• If you are an essential or important entity under Section 24 of the NISG 2026, including an online marketplace, an online search engine or a social-networking-platform provider at the Section 25 medium-enterprise threshold, this ordinance binds you; the wider sector classes of Annexes 1 and 2 are reached too, by declaring that you are an essential or important entity.