NISG 2026: What Austria’s NIS2 Law Requires, and How to Prove It

Austria’s Network and Information Systems Security Act 2026 (NISG 2026) took effect on 1 October 2026. It transposes the EU’s NIS2 Directive into Austrian law and replaces the NISG 2018. The Austrian Economic Chamber (WKO) expects around 4,000 companies to be newly or more extensively covered.

The first deadline is already running. Covered entities must register within three months of the law taking effect, so by the end of December 2026. Registration is the easy part, though: the law also requires companies to assess whether their security measures work, and to prove it when the authority asks.

What does the NISG 2026 regulate?

The full title states the aim: a federal act “to ensure a high level of cybersecurity of network and information systems”. It implements Directive (EU) 2022/2555. On the same date, the NISG 2018 and its implementing ordinances were repealed.

Oversight sits with a newly created Federal Office for Cybersecurity (Bundesamt für Cybersicherheit), reporting directly to the Minister of the Interior. It keeps the register of entities, receives self-declarations and can order audits. Fines, however, are imposed by the district administrative authorities.

Which companies fall under the NISG 2026?

The law distinguishes two categories. Essential entities are mainly large companies in the highly critical sectors listed in Annex 1, including energy, transport, health, digital infrastructure and banking. Some providers are covered regardless of size, among them qualified trust service providers, TLD registries and DNS service providers.

Important entities are medium-sized and large companies from Annex 1 or from the other critical sectors in Annex 2. These include postal and courier services, waste management, chemicals, food and parts of manufacturing.

The thresholds are in § 25. A company counts as medium-sized with at least 50 employees, or with annual turnover above €10 million and a balance sheet above €10 million. It counts as large from 250 employees, or from €50 million in turnover combined with a balance sheet above €43 million.

One detail matters for the financial sector. § 24(7) gives precedence to the DORA Regulation (EU) 2022/2554, so banks and insurers keep meeting their ICT risk-management and resilience-testing obligations through DORA rather than the NISG. Our guide to DORA’s testing requirements covers that side. ICT third-party service providers as defined by DORA, on the other hand, are additionally subject to the NISG under § 24(8).

What does the law require of management?

§ 31 is headed “Governance” and is short. The management body must “ensure and oversee” compliance with the risk-management measures in § 32. Its members must take part in cybersecurity training themselves, and staff must be offered training regularly.

The consequences of falling short are concrete. The company is liable for breaches committed by people in leadership positions or caused by a lack of supervision (§ 44). For essential entities, the authority can, under § 39(4), temporarily bar a person from exercising management functions.

Management therefore cannot hand cybersecurity entirely to IT. It needs to know whether the measures hold.

Which deadlines apply?

• Registration: within three months of entry into force (§ 29(3)), so by the end of December 2026.
• Self-declaration: within twelve months of the registration duty arising, entities submit structured information on the measures they have implemented and the results of their risk analysis (§ 33(1)).
• Audit by an independent body: on request from the authority, and no earlier than two years after entry into force (§ 33(2)). Essential entities must then demonstrate operational and organisational implementation within two months.
• Significant incidents: early warning within 24 hours, notification within 72 hours, final report no later than one month afterwards (§ 34).

Why isn’t a security policy on paper enough?

§ 32(4) lists the minimum content of risk management. Alongside incident handling, supply-chain security and cryptography, it contains two items that no document can satisfy on its own.

Letter (c) requires business continuity, including backup management, disaster recovery and crisis management. Letter (f) requires “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”.

Until someone has measured whether a measure works, its effectiveness is an assumption. § 33 is titled “Proof of the effectiveness of risk-management measures”, which makes the direction clear: an audited entity should be able to show what it tested and what happened.

Where does DDoS resilience testing fit into NISG compliance?

Availability is the security objective that denial-of-service attacks target. Cloudflare’s 2026 Threat Report, published in March 2026, counts 47.1 million DDoS attacks mitigated on its network in 2025, up 121% year on year.

For an energy supplier, a hospital operator or a logistics company, the customer portal, control room or shipment tracking has to stay reachable under load. Whether the CDN, WAF and scrubbing you pay for can deliver that is not something a datasheet answers; you find out when realistic attack traffic arrives.

A controlled DDoS resilience test against your own infrastructure is a procedure to assess effectiveness in the sense of § 32(4)(f), and it exercises business continuity under letter (c) at the same time. Our guide on how to test your DDoS protection explains how to set up a first run.

What Obsidio offers Austrian organisations

Papers AG, based in Zug, Switzerland, now offers its Obsidio platform to Austrian companies. Obsidio runs authorized DDoS simulations against infrastructure the customer owns. Domain ownership is verified through a DNS TXT record before the first packet, and no traffic flows without explicit approval. Every run ramps up gradually and can be aborted live at any moment.

The attack traffic does not come from a data center. It comes from thousands of real devices worldwide, through the decentralized Acurast cloud protocol, which connects unused smartphones into a distributed network of verifiable compute providers whose owners have opted in. Defenses that key on where traffic comes from behave differently against that pattern than against a handful of server IPs, which is why the result says something about a real attack.

Ten simulation types cover application-layer floods, slow attacks, connection exhaustion and protocol-specific vectors. Management gets measurable figures instead of estimates: requests per second, success rate, data transferred and how well the mitigation held under load.

For proof under § 33, the format matters. Obsidio creates structured, traceable reports mapped to the requirements of NIS2, DORA, and FINMA. As a next step, cryptographically attested reports from Trusted Execution Environments will follow, with signatures that auditors can verify themselves.

How should you get started?

• Check whether you are in scope. Sector under Annex 1 or 2, size under § 25, special cases under § 24. Financial entities check DORA precedence first.
• Register by the end of December 2026. The § 29(3) deadline is the first one that can lapse.
• Name your critical services. Which systems must stay reachable for operations to continue? They go into the test scope first.
• Measure effectiveness instead of assuming it. An annual test plan that includes availability scenarios gives you the basis for the self-declaration and for later audits.
• Collect evidence that survives an audit. A monitoring screenshot proves little; a signed test report from an independent party holds up.

See the Obsidio platform, or contact our team. Independent. Neutral. Verifiable. Resilience you can prove.