Austria's NISG 2026 creates the Bundesamt für Cybersicherheit, 24h/72h incident-reporting clock live 1 October 2026
Austria stands up a new federal cybersecurity authority with 24h/72h reporting and active-scanning powers
Analysis
Austria's Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), its NIS2 transposition, enters into force on 1 October 2026, two years late (heise online, 2026-09-22). It creates the Bundesamt für Cybersicherheit (BCS) under the Interior Ministry as the central authority and supervisor for "essential" and "important" entities in sectors including energy, transport, health, drinking and waste water, digital infrastructure, industry and food supply (Austrian BMI, via OTS, 2026-09-22). Municipalities are excluded, and the BCS takes over the civilian-administration GovCERT and oversight of the sectoral CERTs and CERT.at (heise online, 2026-09-22). Covered entities must send an early warning without delay and in any case within 24 hours of becoming aware of a significant incident, and a fuller notification within 72 hours (Austrian BMI, via OTS, 2026-09-22). Managers must attend security training, and the BCS will run active vulnerability scans of essential entities' internet-facing systems (heise online, 2026-09-22). Blocking or defending against those scans is punishable from 1 October (heise online, 2026-09-22). Penalties under the law are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).
For Swiss cantonal authorities, a nearer reference point is Canton Bern: its information- and cybersecurity law (ICSG) and implementing ordinance (IDSV) enter into force on 1 November 2026, and with the IDSV the canton is introducing its own platform for reporting security incidents, vulnerabilities and cyberattacks (Kanton Bern KAIO).
Cited evidence
With the entry into force of the Network and Information System Security Act 2026 (NISG 2026), the new Federal Office for Cybersecurity (BCS) officially begins its work on 1 October 2026.
An initial early warning is required without delay, in any case within 24 hours of becoming aware of the incident. A more detailed notification must be made without delay, at the latest within 72 hours.
Blocking or defending against such state scans is punishable from 1 October, and affected essential entities must also actively cooperate on request.
Updates2
Canton Bern's information- and cybersecurity law (ICSG) and its implementing ordinance (IDSV) enter into force on 1 November 2026, and the canton's incident-reporting platform comes with the IDSV (Kanton Bern KAIO).
heise's word for obstructing the BCS scans is "strafbar" (punishable), and it does not say whether that makes obstruction a criminal offence. It adds that penalties are imposed not by the BCS itself but by the competent district administrative authority at the BCS's suggestion (heise online, 2026-09-22).
For an organization with an Austrian subsidiary or service under the law, significant incidents run on a 24-hour early warning and 72-hour notification clock from 1 October 2026, and an essential entity should also expect the BCS's active scans of its internet-facing systems, which it may not block (heise online, 2026-09-22).
Sources3
Revision history
- Published 2026-09-23T0405Z-intel
- Correction 2026-09-30T0639Z-audit
Priority recalibrated from notable to routine: an Austrian NIS2 transposition that changes no decision for Swiss entities, so the main text is shortened to the facts a reader needs. The closing sentence narrated earlier coverage and credited Canton Bern's ICSG with a 24h/72h reporting clock and a Finnish checklist comparison without sources. It now cites the canton's own page for the ICSG and IDSV entry into force on 1 November 2026 and the IDSV reporting platform. heise's "strafbar" is rendered as punishable rather than as a criminal offence, which heise does not specify. The sector list is cited to the ministry's release, and every citation carries its link.
Changed: priority body sources summary evidence
- Improvement 2026-10-11T1307Z-audit
Adds the missing defender takeaway: entities covered by the Austrian law meet the 24-hour and 72-hour reporting clock from 1 October 2026, and essential entities must tolerate the BCS active scans of their internet-facing systems. The earlier correction section loses a sentence that only narrated removed text.
Changed: body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.