Are you ready for NISG 2026? Austria's NIS2 Law Applies From 1 October
Austria's new cybersecurity law, the NISG 2026, applies from 1 October 2026. Around 4,000 organisations must register with the new Federal Office for Cybersecurity by 31 December 2026 and implement NIS2 security measures, including access control. This guide explains who is affected, what the law demands and what to do in the next 90 days.
• Last updated: 23 October 2026 • 12 mins Reading Time
Table of Contents
What is NISG 2026 and when does it apply?
Is my organisation in scope of NISG 2026?
How and by when do you register under NISG 2026?
What security measures does NISG 2026 require?
What should CISOs do before 31 December 2026?
What must management do, and are managers personally liable?
Key takeaways
- NISG 2026 applies from 1 October 2026 and replaces the NISG 2018, the NISV and the QuaSteV. It is Austria's implementation of the EU NIS2 Directive (EU) 2022/2555.
- Around 4,000 organizations are in scope.These are generally medium-sized and large entities (from 50 employees, or more than €10 million turnover and balance sheet) in 18 sectors, classed as essential or important entities.
- Registration is due by 31 December 2026 via the Unternehmensserviceportal (USP) application "NIS2 Services". Failing to register can cost up to €50,000, or €100,000 for a repeat offence.
- § 32 requires state-of-the-art security measures from day one. These explicitly include access-control concepts, management of privileged and admin accounts, asset management, MFA and supply-chain security.
- Incidents must be reported within 24 hours (early warning) and 72 hours (notification). Management must approve the measures and complete dedicated training.
- Fines reach €10 million or 2% of global turnover for essential entities. A self-declaration of your measures is due by autumn 2027, and audit-based evidence can be requested from 1 October 2028.
What is NISG 2026 and when does it apply?
NISG 2026 is Austria's national law implementing the EU NIS2 Directive. It applies from 1 October 2026. It was adopted by the Nationalrat on 12 December 2025 with a two-thirds majority, approved by the Bundesrat on 18 December 2025, and published as BGBl. I Nr. 94/2025 on 23 December 2025 [1].
Here is the background:
- NIS2 (Directive (EU) 2022/2555) is the EU's second Network and Information Security Directive. Member states had to transpose it by 17 October 2024 [2]. Austria missed that date after an earlier bill failed in parliament in 2024.
- NISG 2026 replaces three instruments on 1 October 2026: the NISG 2018 (BGBl. I Nr. 111/2018), the NIS Regulation (NISV) and the Qualified Bodies Regulation (QuaSteV) [1].
What changes compared with NISG 2018?
The biggest practical shift is self-identification. Under NISG 2018 the authorities informed you that you were in scope. Under NISG 2026, organisations must work out for themselves whether they are in scope, and register if they are.
Is My Organisation in Scope of NISG 2026?
You are most likely in scope if you operate in one of the 18 sectors listed in the law's two annexes and you are at least a medium-sized enterprise: 50 or more employees, or more than €10 million in both annual turnover and balance-sheet total [3]. The Austrian Chamber of Commerce (WKO) and the Interior Ministry (BMI) estimate that around 4,000 organisations are directly affected [3][4].
The two annexes:
- Anlage 1, "sectors of high criticality": for example energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration and space.
- Anlage 2, "other critical sectors": for example postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers and research.
How the classification works:
- Essential entities (wesentliche Einrichtungen): generally large enterprises in Anlage 1 sectors, plus certain entities regardless of size (for example qualified trust service providers, DNS service providers, TLD registries and some public administration bodies).
- Important entities (wichtige Einrichtungen): medium-sized enterprises in Anlage 1 sectors, and medium-sized and large enterprises in Anlage 2 sectors.
- Size-independent designation: some smaller entities are in scope because of their role, for example if they are the sole provider of a critical service.
Size is measured using the EU SME definition (Commission Recommendation 2003/361/EC), which NIS2 itself references [2]. Group structures (partner and linked enterprises) can push a subsidiary above the threshold, so check the consolidated figures and not just the local legal entity.
What about suppliers who are not in scope? Even if you fall below the thresholds, you will probably feel NISG 2026 indirectly. In-scope entities must manage supply-chain security (§ 32), so expect questionnaires, contract clauses and access requirements from your customers [3]. The WKO offers an online "NISG advisor" to check whether you are affected.
Who supervises NISG 2026 in Austria?
The competent authority is the new Bundesamt für Cybersicherheit (BCS, Federal Office for Cybersecurity). It is a monocratic authority within the Federal Ministry of the Interior (BMI) and starts operating on 1 October 2026 [4].
What the BCS does:
- Maintains the register of essential and important entities.
- Supervises compliance: proactively (ex ante) for essential entities and reactively (ex post) for important entities, meaning only where there are indications of non-compliance.
- Receives incident reports together with the Computer Security Incident Response Teams (CSIRTs), which provide technical support.
- Issues detailed requirements: it can specify security measures by regulation. A national regulation for most sectors is expected and is likely to draw on the EU's technical rules for digital providers, Implementing Regulation (EU) 2024/2690 [5].
Practical tip: Put the BCS and your sector CSIRT into your incident-response contact lists now. When a 24-hour deadline is running is not the time to find the right mailbox.
How and by when do you register under NISG 2026?
Registration opens on 1 October 2026 and must be completed by 31 December 2026, via the "NIS2 Services" application in Austria's Unternehmensserviceportal (USP) [6]. Organisations that come into scope later have three months from meeting the criteria.
Step by step:
- Check USP access. Your organisation needs a USP account. Every person who will register or report needs an ID Austria, Austria's digital identity [6].
- Assign the NIS roles in the USP: "NIS Gesamt" (full access), "NIS Registrierung (registration) and "NIS Meldung" (incident reporting) [6]. Give the reporting role to more than one person so you are covered 24/7.
- Collect the register data required by § 29: name of the entity, address and current contact details, any representative, and the sector(s), subsector(s) and entity type(s) that apply [1].
- Submit and document. Keep the confirmation and record who submitted it. Your auditors will ask later.
- Keep the data current. Changes must be updated, and the authority reviews the register regularly.
What if you miss it? Failing to register, or failing to submit the later self-declaration, is an administrative offence punishable by up to €50,000, or €100,000 for a repeat offence [3].
What security measures does NISG 2026 require?
§ 32 NISG 2026 requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risks, following an all-hazards approach and the state of the art [7]. The measures mirror Article 21 of NIS2 and apply from 1 October 2026, with no transition period.
The minimum measure areas (aligned with NIS2 Art. 21(2)) [2][7]:
- Risk analysis and information system security policies
- Incident handling
- Business continuity: backup management, disaster recovery and crisis management
- Supply-chain security, including security aspects of relationships with direct suppliers and service providers
- Security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure
- Policies and procedures to assess whether the measures are effective
- Basic cyber hygiene and cybersecurity training
- Cryptography and, where appropriate, encryption
- Human resources security, access-control concepts and asset management
- Multi-factor or continuous authentication, and secured voice, video, text and emergency communications
"Proportionate" is not the same as "optional". Proportionality means the depth of controls can reflect your size, exposure and the likely impact of incidents. Every area still has to be addressed and documented.
What does "access control" actually mean under NISG 2026?
Access control under NISG 2026 means you can show that every identity (employee, admin, service account or supplier) has only the access it needs, and that you manage those rights over their full lifecycle. The WKO's guidance on § 32 lists these items [3]:
- Personnel security: reliability checks and defined procedures when employment ends or roles change.
- Access control: managing access and authorisation rights, with specific attention to privileged and administrator accounts.
- Asset management: classifying and inventorying assets, and returning or deleting them when employment ends.
For digital providers, EU Implementing Regulation 2024/2690 already spells this out in more detail. It covers access-control policies, managing access rights, privileged and system-administration accounts, identification, authentication and regular reviews of access rights [5]. It is reasonable to expect the Austrian regulation for other sectors to follow this model.
Why this is harder than it sounds: Microsoft's State of Cloud Permissions Risks report found that identities use only 1% of the permissions granted to them. It also found that workload identities outnumber human identities by 10 to 1 [8]. Unused access, dormant accounts and unmanaged machine identities are exactly what "state of the art" access control is supposed to remove. They are also what an auditor will find first.
Typical access-control gaps that surface in NIS2 readiness checks:
- Leavers and movers who keep old permissions (privilege creep)
- Local admin and break-glass accounts outside the identity provider
- Service accounts, API keys and secrets with no owner and no rotation
- External suppliers with standing access that nobody reviews
- Access reviews that are rubber-stamped, because reviewers can't see what data a permission actually reaches
Sichtbarkeit ist kein Luxus mehr - sie ist die Grundlage für digitales Vertrauen.
What are the NISG 2026 incident reporting deadlines?
Significant incidents must be reported to the responsible CSIRT in stages: an early warning within 24 hours of becoming aware, and an incident notification within 72 hours [3]. NIS2 also requires a final report no later than one month after the notification [2].
Where access data matters: The 72-hour assessment depends on answering "which accounts were used, and what could they reach?" Organisations that can't map identities to data spend those 72 hours reconstructing permissions instead of containing the incident.
Practical tip: Run a tabletop exercise before the end of 2026 using the USP "NIS Meldung" role. Time how long it takes to answer "what data could the compromised account access?"
What should CISOs do before 31 December 2026?
In the next 90 days, you should confirm scope, register, get management approval, and build an evidence base for access control. That last step takes the longest. Here is a practical plan.
October 2026: scope and ownership
- Confirm scope and classification (essential or important) for every legal entity in the group, using consolidated size figures.
- Name an accountable owner for NISG 2026 and a deputy, and add BCS and CSIRT contacts to your incident-response plan.
- Set up USP access and ID Austria for the people who will register and report.
November 2026: register and baseline
- Register via USP "NIS2 Services" well before the deadline. Don't leave it until the Christmas period.
- Run a gap analysis against § 32 and, as a best-practice benchmark, against Implementing Regulation 2024/2690.
- Baseline identity and access risk:
- Inventory all human and non-human identities (service accounts, API keys, secrets, AI agents).
- Identify privileged accounts and accounts outside your identity provider.
- Map which identities can reach sensitive data, including supplier accounts.
December 2026: management and quick wins
- Get formal management approval of the measures, and schedule management training.
- Remove the obvious risk: dormant accounts, leavers' access, unrotated secrets, and supplier access nobody can justify.
- Launch a first access review with data-level context, and keep the evidence (who reviewed what, and what was revoked).
- Plan 2027: a continuous access-review cycle and evidence collection ahead of the self-declaration.
Budget reality check: IBM's 2026 Cost of a Data Breach study puts the global average cost of a breach at a record USD 4.99 million, up 12% year on year [10]. For most organisations, cleaning up access and automating reviews costs a fraction of that, and it also serves ISO 27001, DORA and cyber-insurance requirements.
What must management do, and are managers personally liable?
Under § 31, management bodies must approve the cybersecurity risk-management measures, oversee their implementation, and take part in cybersecurity training designed for management [9].
What this means in practice:
- Approval: the board or managing directors must formally approve the § 32 measures.
- Oversight: management must actively monitor implementation, not just sign off once.
- Training: the training must be specific to management. Attendance should be documented [9].
On liability: according to the WKO, NISG 2026 does not set administrative fines against managers personally. Managers who negligently breach their duties can still face civil liability claims from their own organisation [9]. This differs from Germany, where the NIS2 implementation law creates explicit management liability. Austrian boards still have strong reasons to take the approval and training duties seriously.
What fines apply, and when will the authority ask for evidence?
Essential entities face fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher. Important entities face up to €7 million or 1.4% [2][3]. Evidence obligations are phased in: a self-declaration by autumn 2027, and audit-based evidence that can be required from 1 October 2028.
Why "we have until 2028" is the wrong conclusion: The measures apply from 1 October 2026. If an incident happens in 2027, the authority can investigate how you managed access at that point, audit or no audit. The self-declaration in 2027 also asks management to confirm measures that must already be in place. And cyber insurers, customers and auditors under ISO 27001 or DORA will ask the same questions much earlier.
How CyberDesk helps you meet NISG 2026 access requirements
The hardest part of NISG 2026 for most security teams is not registration. It is proving that access to sensitive data follows least privilege, across employees, admins, service accounts, secrets, suppliers and AI agents. Traditional IAM, PAM and IGA tools tell you who an identity is. They rarely tell you what data it can actually reach.
CyberDesk is an identity-centric Data Access Governance platform that answers the question: "Who can do what with what data?" It maps that for both human and non-human identities.
How CyberDesk maps to NISG 2026 § 32:
Why teams choose CyberDesk:
- It closes the data-layer blind spot. The Access Graph makes unused permissions and data shared with “Anyone can view” visible, so you can safely remove unnecessary access.
- It deploys fast. CyberDesk is agentless. Holidu, a travel-tech company with 600 employees, deployed it in under 30 minutes without requiring extensive engineering support.
- It is analyst-recognised. KuppingerCole named CyberDesk a Rising Star in Data Access Governance (February 2026) for its graph-based entitlement visualisation across structured and unstructured data.
- It is built for EU compliance. Munich-based, TÜV-certified security architecture, "Cybersecurity Made in Europe" and hosted in EU. The same evidence also supports NIS2 in Germany, DORA, ISO 27001 and GDPR.
Schlussfolgerung
NISG 2026 applies from 1 October 2026 and brings around 4,000 Austrian organisations in 18 sectors under NIS2-level obligations. There is no grace period for the security measures. The first deadline is registration via the USP by 31 December 2026. After that come a self-declaration in autumn 2027 and audit-based evidence from October 2028.
Establishing and demonstrating effective access controls, from enforcing least privilege and managing privileged accounts to governing supplier access and conducting regular reviews, requires time and sustained effort. CISOs who use the next 90 days to confirm their scope, complete registration, secure management approval and establish a baseline of identity-to-data access will be better positioned to demonstrate compliance and control effectiveness.
Frequently Asked Questions
Hoi T. Ma
Marketing Specialist at CyberDesk
Working with companies to secure sensitive data by making every human, machine and AI data access visible.
Sources
- Republik Österreich, RIS – Netz- und Informationssystemsicherheitsgesetz 2026, BGBl. I Nr. 94/2025
- EUR-Lex – Directive (EU) 2022/2555 (NIS2 Directive)
- Wirtschaftskammer Österreich (WKO) – NIS FAQ and NIS2 overview
- Bundesministerium für Inneres (BMI) – Cybersicherheit (BMI magazine, 2026)
- EUR-Lex – Commission Implementing Regulation (EU) 2024/2690
- Unternehmensserviceportal (USP) – NIS-2
- Republik Österreich, RIS – § 32 NISG 2026 (Risikomanagementmaßnahmen)
- Microsoft Security Blog – 2023 State of Cloud Permissions Risks
- WKO – Leitungsorgane im Sinne der NIS-Gesetzgebung
- IBM Newsroom – Cost of a Data Breach 2026
Möchten Sie CyberDesk in Aktion sehen?
Erfahren Sie, wie CyberDesk Ihnen helfen kann, adaptiv zu kontrollieren, wer welche Aktionen auf welche Daten durchführen kann.
Gründer
Dr. Tobias Lieberum & Prabhakar Mishra
Jahr der Gründung
2022
Hauptsitz
München, Deutschland
Nehmen Sie Kontakt mit uns auf
Der Hauptsitz befindet sich in München, Deutschland.
Partner
Copyright © CyberDesk GmbH 2026. Alle Rechte vorbehalten.