Service · NISG 2026

NISG 2026: cybersecurity is now the law. We get your company ready.

Since 1 October 2026 the Austrian Network and Information Systems Security Act 2026 (NISG 2026) applies, the implementation of the EU NIS 2 directive. Softmaze checks whether and how the law applies to you, measures your current state against its requirements and implements what is missing: technically, in your processes and in the paperwork.

Request a NISG check

The deadlines

In force since: 1 October 2026The risk-management and incident-reporting duties apply from this day, with no transition period.
Registration by: 31 December 2026Essential and important entities register within three months with the Bundesamt für Cybersicherheit through the business service portal (USP).
Self-declaration by: 30 September 2027Within twelve months, registered entities declare which risk-management measures they have implemented.

What is the NISG 2026?

The NISG 2026 (Federal Law Gazette BGBl. I No. 94/2025) replaces the NISG 2018 and transposes the EU NIS 2 directive into Austrian law. It obliges companies and organisations in security-relevant sectors to protect their network and information systems to the state of the art, to report security incidents and to anchor the responsibility for this in management.

The new Bundesamt für Cybersicherheit (Federal Office for Cybersecurity) is in charge. It keeps the register of covered entities, receives reports, audits implementation and imposes fines.

Who is covered?

As a rule, medium and large companies (from 50 employees or EUR 10 million annual turnover) in the sectors of annexes 1 and 2 of the act, divided into essential and important entities:

Essential sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space.
Important sectors: postal and courier services, waste management, chemicals, food, manufacturing (such as medical devices, electronics, machinery, vehicles), digital providers (marketplaces, search engines, social networks), research.

Some providers, such as DNS services, data centres or trust services, are covered regardless of size. And companies that are not covered themselves are often pulled in by covered customers as suppliers: NIS 2 demands supply-chain security. Every company has to check for itself whether it is covered; that is exactly where our check starts.

What companies have to do now

The act requires documented risk management with appropriate, proportionate measures. The minimum list matches the ten areas of the NIS 2 directive:

Risk analysis and security policies for the information systems
Incident handling and a reporting process: early warning within 24 hours, notification within 72 hours, final report within one month
Business continuity: backups, recovery, crisis management
Supply-chain security, including relationships with service providers
Security in acquiring, developing and maintaining systems, including vulnerability handling
Procedures to assess the effectiveness of the measures
Cyber hygiene and training, including for management
Use of cryptography and, where appropriate, encryption
Human-resources security, access control and asset management
Multi-factor authentication, secured communication and emergency communication

Fines and liability

Essential entities: fines of up to EUR 10 million or 2 % of worldwide annual turnover, whichever is higher.
Important entities: up to EUR 7 million or 1.4 % of worldwide annual turnover.
Management bodies must approve and oversee the measures, attend training and can be held personally responsible for violations.

Our NISG check and implementation

We are a software studio, not a paperwork supplier: we build the systems that have to be secured and know where the gaps usually are. How it goes:

1. Applicability check
Essential, important or not covered? We check sector, size and the special cases and put the result in writing, for your customers and insurers too.
2. Gap analysis
Your current state against the NISG 2026 risk-management measures: technology, processes, documentation, suppliers. You get a prioritised list with effort and budget.
3. Implementation
Access control and multi-factor authentication, backups and recovery, encryption, monitoring and patching, an incident-response plan and reporting process, training for management and teams.
4. Registration and evidence
Registration in the USP, preparation of the self-declaration and a register of measures you can keep up to date yourself afterwards.

Why Softmaze

One team for software and security: we implement the measures in the systems we also build and run.
Proportionate: the act asks for appropriate measures, not certificates. We plan what fits your size.
In Vienna, in German and English, with fixed contacts.

Frequently asked questions about the NISG 2026

Since when does the NISG 2026 apply?

Since 1 October 2026. The risk-management and incident-reporting duties have applied from that day with no transition period.

By when does my company have to register?

By 31 December 2026 with the Bundesamt für Cybersicherheit through the business service portal (USP). Companies that become covered later have three months from that point.

What is the self-declaration?

By 30 September 2027 registered entities declare which risk-management measures they have implemented. You need solid documentation for that.

Is my company with fewer than 50 employees covered?

Usually not directly. The exceptions are certain providers that are covered regardless of size, and the supply chain: covered customers have to check their suppliers’ security and pass requirements on.

What are the fines?

Up to EUR 10 million or 2 % of worldwide annual turnover for essential entities, up to EUR 7 million or 1.4 % for important ones. Management can be held personally responsible.

How long does the NISG check take?

Applicability and gap analysis typically take two to three weeks for a medium-sized company. Implementation depends on the gaps; we plan it so that registration and self-declaration are possible in time.

Start with the check.

Tell us briefly what your company does and how big it is. Within one working day we tell you whether the NISG 2026 applies to you and how we would proceed.