AustriaNetz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures
NISG 2026, BGBl. I Nr. 94/2025, §§ 24, 25, 28 und 32
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- It binds a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 24, which reaches an online marketplace, an online search engine and a social-networking-services platform provider expressly (Section 28(2)(2)) at the medium-enterprise threshold of Section 25 (at least 50 employees, or turnover and balance-sheet total each over EUR 10 million) or above; the wider sector classes Section 24 also reaches (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT-service management, public administration, space, postal and courier services, waste management, chemicals, food, and manufacturing) are reached too, by declaring that you are an essential or important entity.
- Implement technical, operational and organisational risk-management measures, appropriate and proportionate to the risk, to reduce risks to the network and information systems you use for your operations or to provide your services, and to prevent or minimise the impact of a cybersecurity incident on your users and on other services.NIST CSF 2.0ID.RA-06
- Cover at least: risk analysis and information-system security concepts; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; effectiveness-assessment policies; basic cyber-hygiene practices and training; cryptography and, where appropriate, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication.NIST CSF 2.0GV.PO-01
- Have your management body implement and oversee these measures and attend cybersecurity training designed for it, and offer your staff regular training.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- Register with the Bundesamt für Cybersicherheit within three months of this duty applying (by ), and self-declare the risk-management measures you have implemented within twelve months of registration; once the Bundesamt first asks for proof of operative and organisational implementation, which it cannot do before two years after this duty applies, give that proof within two months if you are an essential entity (Section 33).NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 45's penalty regime for a Section 32 infringement is a Verwaltungsübertretung (administrative offence) carrying a fine only; the Act creates no criminal offence for it.
Penalty structure
Section 45(2) sets the fine for a wesentliche Einrichtung's (essential entity's) infringement, including a failure to implement the risk-management measures of Section 32 (unless the Bundesamt learned of it only from the entity's own self-declaration under Section 33(1)), at up to EUR 10,000,000 or up to 2 percent of the undertaking's total worldwide turnover in the preceding financial year, whichever is higher. Section 45(3) sets the wichtige Einrichtung (important entity) tier at up to EUR 7,000,000 or up to 1.4 percent, whichever is higher, mirroring NIS2 Article 34(4) and (5). Section 46(2) instead requires a public-sector body's non-compliance to be established by decision and, if not remedied, published, with no fine.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Bundesamt für Cybersicherheit (Cybersicherheitsbehörde), an authority with nationwide competence, directly subordinate to the Bundesminister für Inneres and set up outside the Generaldirektion für die öffentliche Sicherheit; an administrative fine is imposed by the competent Bezirksverwaltungsbehörde (district administrative authority) on the Bundesamt's notification.
Settledness
- As of
- Open questions
- Does an online marketplace, online search engine or social-networking-platform provider that cannot meet a requirement of Section 2 of the NISV 2026 'aufgrund ihrer Größe' (because of its size) have to implement compensating measures under Section 4(1) of the NISV 2026, and at what size does that ground apply?
What this law does
Section 32 requires a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity), as Section 24 defines them against the Annex 1 and Annex 2 sector lists and the medium- or large-enterprise thresholds Section 25 sets, to implement appropriate and proportionate technical, operational and organisational risk-management measures to reduce the risks to the security of the network and information systems it uses for its operations or to provide its services, and to prevent or minimise the impact of cybersecurity incidents on the users of its services and on other services.
The measures must follow an all-hazards approach and cover at least ten categories: risk analysis and information-system security concepts; cybersecurity-incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the security practices of direct suppliers and service providers; security in the acquisition, development and maintenance of network and information systems, including vulnerability management and disclosure; policies and procedures to assess the effectiveness of risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on the use of cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, secure voice, video and text communication and, where appropriate, secure emergency communication systems, transposing NIS2 Article 21.
Section 28, the territoriality provision, names an online marketplace, an online search engine and a platform for social-networking services expressly among the digital providers it reaches, alongside cloud-computing, data-centre, content-delivery-network, managed-service and managed-security-service providers.
Section 31 places implementation and oversight of these measures on the entity's management body (Leitungsorgan), which must attend cybersecurity training designed for it and ensure staff receive regular training. Section 24(7) gives the relevant provisions of Regulation (EU) 2022/2554 (DORA), and of the national provisions implementing it, precedence over this Act for an entity within DORA's scope.
Section 27(1) disapplies only the Section 32 and Section 34 requirements to an entity that sector-specific Union law binds with an at least equivalent level of cybersecurity, so the Section 29 registration this row names still binds such an entity.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .