AustriaNetz- und Informationssystemsicherheits-Verordnung (NISV 2026), Risk-Management Requirements and Significant-Incident Criteria
NISV 2026, BGBl. II Nr. 290/2026, §§ 2 bis 5 und 7
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- If you are an essential or important entity under Section 24 of the NISG 2026, including an online marketplace, an online search engine or a social-networking-platform provider at the Section 25 medium-enterprise threshold, this ordinance binds you; the wider sector classes of Annexes 1 and 2 are reached too, by declaring that you are an essential or important entity.
- Meet the technical and methodological risk-management requirements of Article 2 and the Annex of Implementing Regulation (EU) 2024/2690 whatever your sector, including where your type of entity is not one that Implementing Regulation names (Section 2).NIST CSF 2.0GV.OC-03
- Base your risk analysis on at least technological, human, ICT supply-chain and location-related risks (Section 3).NIST CSF 2.0ID.RA-05
- Where you cannot meet a Section 2 requirement, temporarily or because of your size, implement compensating measures suited to that requirement's purpose, document them with reasons and review their effectiveness at least once a year (Section 4).NIST CSF 2.0ID.RA-07
- Report an incident as significant under Section 35(1) of the NISG 2026 when it meets any of the nine criteria in Section 5(1), or when incidents that are not significant alone meet the repeat-incident test in Section 7 (at least two within six months, same apparent cause and effect, together meeting the financial-loss criterion).NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- ID.RA-07Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Settledness
- As of
- Open questions
- When does a cybersecurity incident that has not yet caused a loss count as significant under Section 5(1) of the NISV 2026 because it 'kann einen solchen Verlust verursachen' (a direct financial loss above EUR 500,000 or 5 percent of annual turnover, whichever is lower)?
What this law does
The Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), BGBl. II Nr. 290/2026, is the ordinance the Cybersicherheitsbehörde issued under Section 32(5) and Section 35(3) of the NISG 2026 and published on .
Section 2 applies the technical and methodological risk-management requirements of Article 2 and the Annex of Implementing Regulation (EU) 2024/2690 to every type of essential and important entity listed in Annexes 1 and 2 of the NISG 2026, including those the Implementing Regulation does not itself cover. Section 3 requires a risk analysis to draw on at least four risk categories: technological, human, ICT supply-chain and location-related risks.
Section 4 requires compensating measures where an entity cannot meet a Section 2 requirement temporarily or because of its size, documented with reasons and reviewed at least once a year.
Section 5(1) treats a cybersecurity incident as significant under Section 35(1) of the NISG 2026 when it meets any of nine criteria, among them a direct financial loss above EUR 500,000 or 5 percent of annual turnover, whichever is lower, and an outage or restriction for more than 100,000 users or 10 percent of users, whichever is lower, for more than 24 hours.
Section 7 counts incidents that are not significant on their own as one significant incident when they occurred at least twice within six months with the same apparent cause and effect and together meet the financial-loss criterion. The ordinance enters into force at the end of the day of its promulgation, so its first day is .
The NISG 2026, which this ordinance implements, gives the relevant provisions of Regulation (EU) 2022/2554 (DORA) precedence for an entity within DORA's scope (NISG 2026 Section 24(7)).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.