CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

EU NIS2 Directive

policy · policy:eu-nis2-directive

EU directive requiring member-state transposition and mandatory incident reporting by essential/important entities. The European Court of Auditors' Special Report 19/2026 (2026-09-22) finds transposition two years behind schedule in most member states and cross-border incident notification unreliable in practice; national transposition laws (Austria's NISG 2026, Poland, the Netherlands, Germany) are tracked as their own entities.

Aliases: NIS 2, Directive (EU) 2022/2555

Coverage
2
first 2026-09-23 → last 2026-10-11
Latest activity
2026-09-23
Austria stands up a new federal cybersecurity authority with 24h/72h reporting and active-scanning powers
Peak priority
notable
1 notable · 1 routine
Targets
public-sector
sectors: public-sector, energy, transport · regions: europe, dach
Sources cited
5
4 hosts

Defender insights

What each entry about EU NIS2 Directive tells a defender to do, newest first.

2026-09-23ROUTINEAustria stands up a new federal cybersecurity authority with 24h/72h reporting and active-scanning powers

Story timeline

  1. 2026-09-23EU Court of Auditors: cyber-incident cooperation framework only partially effective, cross-border notification failed for the 2025 airport ransomware disruption
    researchEU auditors find no member state ever formally notified the bloc of the 2025 Collins Aerospace airport ransomware attack
  2. 2026-09-23Austria's NISG 2026 creates the Bundesamt für Cybersicherheit, 24h/72h incident-reporting clock live 1 October 2026
    researchAustria stands up a new federal cybersecurity authority with 24h/72h reporting and active-scanning powers

Hunting pivots

Tags
policy ×2

Entries about EU NIS2 Directive (2)

2026-09-23 · view entry permalink →

ROUTINEupdatedNATOA1

Austria's NISG 2026 creates the Bundesamt für Cybersicherheit, 24h/72h incident-reporting clock live 1 October 2026

Austria's Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), its NIS2 transposition, enters into force on 1 October 2026, two years late (heise online, 2026-09-22). It creates the Bundesamt für Cybersicherheit (BCS) under the Interior Ministry as the central authority and supervisor for "essential" and "important" entities in sectors including energy, transport, health, drinking and waste water, digital infrastructure, industry and food supply (Austrian BMI, via OTS, 2026-09-22). Municipalities are excluded, and the BCS takes over the civilian-administration GovCERT and oversight of the sectoral CERTs and CERT.at (heise online, 2026-09-22). Covered entities must send an early warning without delay and in any case within 24 hours of becoming aware of a significant incident, and a fuller notification within 72 hours (Austrian BMI, via OTS, 2026-09-22). Managers must attend security training, and the BCS will run active vulnerability scans of essential entities' internet-facing systems (heise online, 2026-09-22). Blocking or defending against those scans is punishable from 1 October (heise online, 2026-09-22). Penalties under the law are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).

For Swiss cantonal authorities, a nearer reference point is Canton Bern: its information- and cybersecurity law (ICSG) and implementing ordinance (IDSV) enter into force on 1 November 2026, and with the IDSV the canton is introducing its own platform for reporting security incidents, vulnerabilities and cyberattacks (Kanton Bern KAIO).

With the entry into force of the Network and Information System Security Act 2026 (NISG 2026), the new Federal Office for Cybersecurity (BCS) officially begins its work on 1 October 2026.

An initial early warning is required without delay, in any case within 24 hours of becoming aware of the incident. A more detailed notification must be made without delay, at the latest within 72 hours.

Austrian Federal Ministry of the Interior (BMI), via OTS press release

Blocking or defending against such state scans is punishable from 1 October, and affected essential entities must also actively cooperate on request.

heise online 2026-09-22
Correctionrun 2026-09-30T0639Z-auditprioritybodysourcessummaryevidence

Canton Bern's information- and cybersecurity law (ICSG) and its implementing ordinance (IDSV) enter into force on 1 November 2026, and the canton's incident-reporting platform comes with the IDSV (Kanton Bern KAIO).

heise's word for obstructing the BCS scans is "strafbar" (punishable), and it does not say whether that makes obstruction a criminal offence. It adds that penalties are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).

Improvementrun 2026-10-11T1307Z-auditbody

For an organization with an Austrian subsidiary or service under the law, significant incidents run on a 24-hour early warning and 72-hour notification clock from 1 October 2026, and an essential entity should also expect the BCS's active scans of its internet-facing systems, which it may not block (heise online, 2026-09-22).

policy23 Sep 04:44Zmulti-sourceOpen finding →
Sources: Austrian Federal Ministry of the Interior (BMI), via OTS · heise online · Kanton Bern, Amt für Informatik und Organisation (KAIO)

2026-09-23 · view entry permalink →

NOTABLEupdatedNATOA1

EU Court of Auditors: cyber-incident cooperation framework only partially effective, cross-border notification failed for the 2025 airport ransomware disruption

The European Court of Auditors published Special Report 19/2026 on 2026-09-22, concluding that the EU's cooperation framework for detecting and responding to cybersecurity incidents (the CSIRTs network, EU-CyCLONe, the European Cybersecurity Alert System, the Commission's cyber situation centre and the EU Cybersecurity Reserve) is only partially effective (European Court of Auditors, Special Report 19/2026, 2026-09-22). Three structural gaps drive the finding: NIS2 transposition delays ("member states had until October 2024 to transpose the NIS 2 Directive into national law, but only two met the deadline" (European Court of Auditors, Special Report 19/2026, 2026-09-22)); national-security legislation that lets member states withhold incident information with no obligation to share it; and no EU-wide platform to correlate cross-border incidents in real time. As its case study, the report documents that the September 2025 Collins Aerospace ransomware attack on airport passenger-processing systems; "the disruption was most severe at London Heathrow Airport, Brussels Airport, Berlin Brandenburg Airport, and Dublin Airport" (European Court of Auditors, Special Report 19/2026, 2026-09-22), was never classified as "significant" or "large-scale cross-border" under NIS2 by the affected member states, named by heise as Germany, Belgium and Ireland (heise online, 2026-09-22): "no member state treated this incident as being either significant or large-scale cross-border. Therefore, none of the affected member states formally notified ENISA or other member states of the incident. The CSIRTs network did not advise EU-CyCLONe, which therefore did not support the coordinated management of the incident" (European Court of Auditors, Special Report 19/2026, 2026-09-22). EU-wide, "in 2025, only 14 significant cross-border incidents were reported, by seven member states" (European Court of Auditors, Special Report 19/2026, 2026-09-22), and "no cybersecurity incident has been considered 'large-scale' by any member state since 2016", despite events the report itself cites as comparably severe, including WannaCry and NotPetya (European Court of Auditors, Special Report 19/2026, 2026-09-22). The Court's Recommendation 1, targeted for 2027 (information-sharing analysis and cross-border-incident detection) and 2028 (real-time incident reporting), calls for a Commission/ENISA-led review of national-security restrictions on information sharing and progress toward real-time incident reporting to ENISA (European Court of Auditors, Special Report 19/2026, 2026-09-22).

Switzerland sits outside NIS2's scope but is embedded in the same cross-border supply chains (aviation, finance, cloud) the report's case study concerns. The finding that formal EU cross-notification cannot be relied on for early warning is a direct input to how Swiss public-sector CERTs and GovCERT.ch should weight direct primary-source monitoring of national CERTs and vendor advisories against EU cross-notification channels, since a serious incident affecting an EU supply-chain partner may never surface through the formal EU mechanism at all.

Yet, no member state treated this incident as being either significant or large-scale cross-border. Therefore, none of the affected member states formally notified ENISA or other member states of the incident. The CSIRTs network did not advise EU-CyCLONe, which therefore did not support the coordinated management of the incident.

Member states had until October 2024 to transpose the NIS 2 Directive into national law, but only two met the deadline.

In 2025, only 14 significant cross-border incidents were reported, by seven member states.

European Court of Auditors, Special Report 19/2026

Despite the significant impact of the incident, the affected member states (Germany, Belgium and Ireland) reportedly did not notify the EU cybersecurity agency ENISA or the other member states accordingly, the report criticizes. (translated from German)

heise online 2026-09-22
Correctionrun 2026-09-29T2134Z-auditsourcesevidencesourcing_notesummarybody

The five EU-level networks and mechanisms the Court assessed are the CSIRTs network, EU-CyCLONe, the European Cybersecurity Alert System, the Commission's cyber situation centre and the EU Cybersecurity Reserve (European Court of Auditors, Special Report 19/2026, 2026-09-22). This entry previously listed the Cyber Blueprint in place of the cyber situation centre. The Blueprint is one of the policy instruments the report describes, not an assessed mechanism.

policy23 Sep 04:43Zmulti-sourceOpen finding →
Sources: European Court of Auditors · heise online

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Research2

Source distribution

  • heise.de2 (40%)
  • eca.europa.eu1 (20%)
  • kaio.fin.be.ch1 (20%)
  • ots.at1 (20%)
All cited sources (5)