Law / Austria

DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties

DORA-VG, BGBl. I Nr. 112/2024, Art. 1, §§ 2, 3, 7 und 8

In force since 17 Jan 2025.

A sector security regimes rule binding public and private bodies.

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• If you are a financial entity that Section 2 of the DORA-VG lists and the Finanzmarktaufsichtsbehörde (FMA) supervises under Article 46 of Regulation (EU) 2022/2554, such as a credit institution, payment or e-money institution, investment firm, crypto-asset service provider, central securities depository, central counterparty or trading venue, this Act and the Regulation bind you.
• If you are a credit institution under Section 1(1) of the Bankwesengesetz that is not one of the financial entities DORA Article 2(1)(a) to (t) lists, apply this Act, the Regulation and its delegated and implementing acts to yourself as if you were a credit institution under Article 2(1)(a) (Section 3(1)).
• Meet DORA's requirements on ICT risk management (Articles 5 to 14, except Article 11(11)), simplified ICT risk management (Article 16(1) and (2)), handling, classifying and reporting ICT-related incidents and cyber threats (Articles 17, 18(1) and (2) and 19), digital operational resilience testing (Articles 24 and 25) and ICT third-party risk (Articles 28 to 30), which Section 7(1) enforces.NIST CSF 2.0GV.OC-03
• If you are identified under DORA Article 26(8), carry out the advanced threat-led penetration testing that Articles 26(1) to (6) and (8) and 27 require (Section 7(1)(5)).NIST CSF 2.0ID.IM-02

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST Privacy Framework

• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
• PR.PO-P10A vulnerability management plan is developed and implemented.

NIST CSF 2.0

• GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
• ID.IM-02Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.2Compliance monitoring
• 3.2Monitoring and logging
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app