NIS2 compliance in Austria

NIS2 compliance in Austria at a glance

Austria's NIS2 transposition arrived in two steps: the Netz- und Informationssystemsicherheitsgesetz 2026, promulgated as BGBl. I Nr. 94/2025 on 23 December 2025 and in force from 1 October 2026, and the NISV 2026 ordinance issued on the day the Act took effect. The Bundesamt für Cybersicherheit is the single competent authority, so covered entities register with it, apply risk-management measures covering incident handling, continuity, supply chain, cryptography and access control, report significant incidents and later have implementation verified by an independent body. There is no NIS2 certificate, and the Act does not name ISO/IEC 27001, though valid certificates can support part of the proof. Sterling's Frankfurt office runs the applicability check, gap analysis and documentation, with Effivity and Sterling Academy included with the engagement.

Who needs NIS2 in Austria, and what happens without it

These are the organisations in Austria that most often need to show NIS2.

• Essential and important entities in the Act's annexed sectorsThe NISG 2026 applies to entities established in Austria in the sectors of its annexes, and they register with the Bundesamt für Cybersicherheit.
• Suppliers, managed-service and cloud providersThe risk-management measures include supply-chain security, so covered entities push requirements and evidence demands onto their providers.
• Operators designated as critical entitiesThe RKEG runs in parallel, with the Minister of the Interior designating critical entities and informing the NIS authorities when supervising them.
• Financial entitiesDORA applies directly to them and the FMA is the competent authority, so they should check how it interacts with the NISG 2026.

NIS2 requirements in Austria

Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.

In Austria these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →

How to achieve NIS2 compliance in Austria

One team from the Frankfurt office carries the work from scoping to sign-off. Clients in Austria are served from Sterling's Frankfurt office, on-site where the work needs it and remotely otherwise.

1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
2. Gap assessment against NIS2 and the Austrian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
5. Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

How long does NIS2 compliance take in Austria?

There is no standard duration: it depends on your scope and on how much of the system already runs. In Austria these are the factors that set the timeline.

• Whether the entity is essential or important and which annexed sector applies
• Existing information security management system and incident reporting arrangements
• Management training and board reporting
• Supply-chain and cloud dependencies

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

• Scope and timeline estimator

How much does NIS2 compliance cost in Austria?

The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Austria these factors move both.

• Number of legal entities and sectors in scope
• Control remediation across the group
• Independent verification costs, which the Act places on the entity unless the authority decides otherwise
• Overlap with DORA or the RKEG for regulated groups

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

NIS2 consultants and assessors in Austria

Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

• Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
• Ask the consultant how the local requirements in Austria are mapped into the same system, so nothing runs twice.
• Ask for client references in your sector; Sterling’s client letters are available on request.
• Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

NIS2 in Austria: questions clients ask

More on NIS2 for Austrian organisations

• NIS2: the complete guide
• Watch: How to comply with the NIS2 Directive
• NIS2 compliance in Austria and every other standard Sterling delivers there

Other standards Austrian businesses ask Sterling for

Organisations in Austria often combine NIS2 with one of these, under one management system where the scopes allow.

All 22 standards Sterling delivers in Austria →