AI-generated · no human review · verify critical claims against the linked source.how it works →
Austria NISG 2026
policy
· policy:austria-nisg-2026
Austria's NIS2-transposition law, in force 1 October 2026, creating the Bundesamt für Cybersicherheit (BCS) with 24h/72h incident-reporting obligations and active-scanning powers for essential/important entities (Austrian BMI press release, 2026-09-22).
Aliases: Netz- und Informationssystemsicherheitsgesetz 2026
Coverage
1
first 2026-09-23 → last 2026-10-11
Latest activity
2026-09-23
Austria stands up a new federal cybersecurity authority with 24h/72h reporting and active-scanning powers
Peak priority
routine
1 routine
Targets
public-sector
sectors: public-sector, energy, transport · regions: dach, europe
Sources cited
3
3 hosts
Defender insights
What each entry about Austria NISG 2026 tells a defender to do, newest first.
Austria's Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), its NIS2 transposition, enters into force on 1 October 2026, two years late (heise online, 2026-09-22). It creates the Bundesamt für Cybersicherheit (BCS) under the Interior Ministry as the central authority and supervisor for "essential" and "important" entities in sectors including energy, transport, health, drinking and waste water, digital infrastructure, industry and food supply (Austrian BMI, via OTS, 2026-09-22). Municipalities are excluded, and the BCS takes over the civilian-administration GovCERT and oversight of the sectoral CERTs and CERT.at (heise online, 2026-09-22). Covered entities must send an early warning without delay and in any case within 24 hours of becoming aware of a significant incident, and a fuller notification within 72 hours (Austrian BMI, via OTS, 2026-09-22). Managers must attend security training, and the BCS will run active vulnerability scans of essential entities' internet-facing systems (heise online, 2026-09-22). Blocking or defending against those scans is punishable from 1 October (heise online, 2026-09-22). Penalties under the law are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).
For Swiss cantonal authorities, a nearer reference point is Canton Bern: its information- and cybersecurity law (ICSG) and implementing ordinance (IDSV) enter into force on 1 November 2026, and with the IDSV the canton is introducing its own platform for reporting security incidents, vulnerabilities and cyberattacks (Kanton Bern KAIO).
With the entry into force of the Network and Information System Security Act 2026 (NISG 2026), the new Federal Office for Cybersecurity (BCS) officially begins its work on 1 October 2026.
An initial early warning is required without delay, in any case within 24 hours of becoming aware of the incident. A more detailed notification must be made without delay, at the latest within 72 hours.
Austrian Federal Ministry of the Interior (BMI), via OTS press release
Blocking or defending against such state scans is punishable from 1 October, and affected essential entities must also actively cooperate on request.
Canton Bern's information- and cybersecurity law (ICSG) and its implementing ordinance (IDSV) enter into force on 1 November 2026, and the canton's incident-reporting platform comes with the IDSV (Kanton Bern KAIO).
heise's word for obstructing the BCS scans is "strafbar" (punishable), and it does not say whether that makes obstruction a criminal offence. It adds that penalties are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).
For an organization with an Austrian subsidiary or service under the law, significant incidents run on a 24-hour early warning and 72-hour notification clock from 1 October 2026, and an essential entity should also expect the BCS's active scans of its internet-facing systems, which it may not block (heise online, 2026-09-22).