NIS2 Austria: Compliance, Authorities & Key Requirements
Understand how Austria is implementing the NIS2 Directive, the current legal status, competent authorities, how incident reporting works today, and what steps organisations should take to get ready.
Introduction
Austria implemented the original NIS Directive via the Netz- und Informationssystemsicherheitsgesetz (NISG). To align with NIS2, a comprehensive update (NISG 2024) has been drafted and is progressing through the national process. Until the new law enters into force, current obligations under the existing NISG and the national CSIRT processes remain applicable.
NIS2 implementation in Austria
The draft NISG 2024 (Federal Act to ensure a high level of cybersecurity for network and information systems) is Austria’s vehicle to transpose NIS2. As of now, the draft is not yet in force; timelines are being updated by the Federal Chancellery. Organisations should monitor official channels and prepare for rapid registration and supervision once enacted.
Status
Draft law (NISG 2024) under discussion; not yet in force (expected to apply from 1 October 2026).
Official law / drafts
Draft available via the Austrian Parliament’s site (DE). Draft text (NISG 2024)
Registration
To be announced after entry into force. Current NIS incident reporting uses nis.cert.at.
| Sector | Austria note |
|---|---|
| Public sector | GovCERT and BKA handles security incident response, municipalities are expected to fall within NIS2 scope. |
| Digital infrastructure | data centres, cloud providers and TSPs follow EU Annex scoping reporting via CERT.at platform. |
| Finance | alignment with DORA; detailed supervisory mapping to be defined in the final national act. |
Compliance & certification
Austria is expected to mirror NIS2’s Essential/Important tiers and Article 21 risk management measures.
Scope (expected)
- Annex I & II sectors (services-based scoping)
- General size thresholds (≥50 employees or ≥€10m turnover/balance)
- Critical smaller entities may be included by exception
Obligations (core)
- Risk management policies and governance
- Incident detection & reporting (CSIRT coordination)
- Business continuity & crisis management
- Supply-chain security & contractual controls
- Access control, segmentation, encryption
Standards & alignment
ISO/IEC 27001:2023, NIST CSF 2.0 and sectoral norms; national implementation acts will provide specifics.
Timeline & key dates
Sector-specific notes
- Public sector: GovCERT and BKA coordinate security incident handling; municipalities expected to be in scope per NIS2.
- Finance: alignment with DORA; detailed supervisory mapping to follow in final act.
- Digital infrastructure: data centres/cloud & TSPs to follow EU Annex scoping; reporting via CERT.at platform.
Penalties
Final penalty design and turnover caps will be set by the Austrian NIS2 act. Expect alignment with NIS2’s administrative fine model and potential corrective measures once the law enters into force.
How to prepare
- Determine scope: assess Annex I/II services and size thresholds; prepare EE/IE classification.
- Readiness: map controls to ISO 27001/NIST CSF and produce a gap analysis.
- Incident reporting: establish playbooks and contacts for GOVCERT/CERT.at; rehearse timelines.
- Supply chain: add security requirements to vendor contracts & perform risk reviews.
- Governance: board accountability, KPIs, and training plans.
- Documentation: evidence trails for policies, risk, incidents, BCP/DR tests.