Austria defines cybersecurity risk-management requirements and criteria for major incidents
Austria's Cybersecurity Authority (Cybersicherheitsbehörde) has issued a regulation (NISV 2026) setting detailed requirements for how essential and important facilities must manage cybersecurity risks and defining when a cyber incident counts as
What changed
The regulation establishes concrete risk-management requirements for essential and important facilities, applies EU implementation rules to Austrian entities, and specifies nine criteria that automatically classify a cyber incident as major—including financial losses over €500,000, loss of trade secrets, death or serious injury, service outages affecting 100,000+ users or 10% of users (whichever is lower) for over 24 hours, or geographic outages in at least one Austrian state for over 24 hours.
Who is affected
Essential and important facilities (wesentliche und wichtige Einrichtungen)—such as critical infrastructure operators, online platforms, cloud providers, data centers, DNS providers, and trusted service providers—must comply with these cybersecurity rules under Austria's Network and Information Systems Security Act 2026 (NISG 2026).
What to look out for
Facilities must address four risk categories: technological risks, human risks, ICT supply-chain risks, and location-based risks for networks and information systems. If you cannot meet a requirement due to size or temporarily, you must implement compensating measures, document them with reasoning, and review their effectiveness at least annually. Planned maintenance and scheduled downtime do not count as major incidents; however, repeated incidents with the same cause within six months that collectively meet the financial or impact thresholds do count as one major incident.