Cybersecurity BlogNISG 2026 Is Here: How We Approach Implementation as Pentesters & Security Consultants

• What: The Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz, BGBl. I No. 94/2025) transposes the EU NIS2 Directive and replaces the NISG 2018.
• Since when: 1 October 2026, with no transition period for the obligations.
• Who: medium-sized and large entities in 18 sectors, plus certain providers regardless of size. Companies assess for themselves whether they are covered.
• Deadlines: registration via the Austrian Business Service Portal (USP) by 31 December 2026, self-declaration by 30 September 2027.
• Responsibility: lies with management. Implementation involves the whole company, technically and organisationally.

The NISG 2026 is Austria’s implementation of the EU NIS2 Directive. Since 1 October 2026 it applies to companies of at least medium size (at least 50 employees, or more than EUR 10 million in turnover and balance sheet total) that operate in one of 18 sectors. These include energy, healthcare, transport, digital infrastructure, IT services, food and manufacturing. Depending on size and sector, you are an essential or an important entity: the same obligations, but different levels of supervision.

Whether you are covered is something you assess yourself; the authority does not classify companies. A good place to start is the online guide of the Austrian Economic Chamber (WKO). And even if you are not covered directly, you will often feel the law as a supplier: covered companies must secure their supply chain and pass the requirements on through contracts.

Risk management, management training and the reporting obligation have applied since 1 October 2026. You must register by 31 December 2026, and the self-declaration follows by 30 September 2027.

• Management (§ 31): is responsible for the measures and must attend cybersecurity training itself. Employees must be trained regularly.
• Risk management (§ 32): technical, operational and organisational measures in ten minimum areas, including risk analysis, backups, supply chain and vulnerability management.
• Reporting (§ 34): early warning to CERT.at within 24 hours (weekends included), incident notification within 72 hours, final report after one month.

Deadline	What is due	Legal basis
by 31 December 2026	Registration via the USP (“NIS2-Services”)	§ 29(3)
by 30 September 2027	Self-declaration of implemented measures	§ 33(1)
from 1 October 2028 at the earliest	Audit by an independent body, only on request	§ 33(2)

According to the Federal Office for Cybersecurity, registration is still accepted in early January. We still wouldn’t leave it until New Year’s Eve.

Essential entities face fines of up to EUR 10 million or 2 % of worldwide annual turnover, important entities up to EUR 7 million or 1.4 % (§ 45). Missing the registration or self-declaration costs up to EUR 50,000, and up to EUR 100,000 for repeat offences.

Administrative fines are imposed on the company. The NISG 2026 does not provide for administrative fines against management itself. A breach of management’s duties can, however, lead to damage claims if it acted without due care and this caused a loss. For essential entities that fail to comply with an official order, the authority can also temporarily prohibit management from exercising its functions (§ 39(4)).

Our recommendation: make the NISG 2026 a top-management issue, give one person or a small team the responsibility, and work in steps instead of waiting for perfection. The law covers cybersecurity both technically and organisationally. Tools help with parts of it. But it all has to come together with people.

The law explicitly places responsibility with management (§ 31). That means the executive management, not the head of IT or the CISO. In practice, management has to free up time and budget. Without that, the project stays a side job for IT that fizzles out somewhere between a printer problem and a password reset. And if things go wrong in the end, management is liable, as described above.

Appoint one person or a small team to own information security. This is where the organisational threads come together: risk analysis, policies, the reporting process, suppliers, training and the evidence for the self-declaration. Processes, responsibilities and measures must be documented in writing and reviewed regularly. The easiest way is an information security management system (ISMS), ideally in a dedicated tool rather than in twelve Excel sheets.

Even if your IT is fully outsourced, responsibility stays with your company. The service provider implements, you steer and check.

The person in charge coordinates, but cannot do everything alone. Training applies to all employees, supplier contracts involve purchasing, and the reporting process needs people who can be reached at weekends too. Every department will have to contribute. Joint training for management, IT, the CISO and compliance has proven worthwhile.

Nobody has to be a NIS2 expert to implement the law. Given the complexity of the requirements, the WKO recommends consulting experts. For the question of whether and how your company is covered, legal advice pays off. For risk analysis and measures, an external security consultant. That does not mean you can skip the responsible person in your own team where all the threads in the company come together. We point this out explicitly in every one of our consulting projects.

No auditor expects everything to be perfect on day one. The law sees it the same way: the audit report of an independent body explicitly contains “identified deficiencies” and an action plan to remedy them (§ 33(3)). The self-declaration, too, is only an indication of the state of implementation. What you do need for every area is a plan, and it has to be improved continuously. So start wherever you can and get better step by step.

A penetration test is not explicitly required. What is required are “policies and procedures to assess the effectiveness” of the measures and vulnerability management (§ 32(4)(e) and (f)). The EU Implementing Regulation 2024/2690, which all entities should use as guidance, names penetration testing as one form of regular security testing.

One detail matters later: a certificate such as ISO 27001 can only prove operational and organisational implementation. Technical implementation must be proven separately (§ 33(2)).

Because we want to know in detail what the tools we recommend actually deliver, and because we are pentesters at heart, we built our own set. We use it to support companies with the technical implementation of the NISG 2026. Whether we advise you ourselves or you work with another consultant: the tools work either way.

We start where attackers start: from the outside. The authority looks from there too. The national CSIRT may check publicly accessible systems non-intrusively and gets in touch if it finds something insecure (§ 8(2)). For essential entities, the Federal Office may run security scans itself (§ 38). Better to know beforehand what they will see.

CheckFix shows you your attack surface. The external security assessment checks your domains for email security, encryption, known vulnerabilities, open services and security headers. You get an A to F rating and a prioritised ToDo-CheckList with a fix strategy for each finding. The report from the external security assessment serves as evidence for the technical part. Your data stays on servers in Europe.

The AI pentest shows you what can actually be exploited. It builds on the external analysis: secinto’s own pentest agent attacks the systems found in a controlled way. It runs exclusively on our own hardware in Austria, and your data never goes to a cloud AI provider. A re-check proves that a gap has been closed. You can create your report directly in the dashboard, or have secinto certify the pentest for you.

The CheckFix Risk Manager checks your supply chain. Suppliers answer compliance questionnaires directly in the dashboard, and every supplier also gets an external technical analysis, without access to their systems. That puts the self-assessment and the technical findings side by side.

Registration is done quickly. The real work is anchoring information security in the company for good, with management that backs it and people who take care of it. And amid all the deadlines and paragraphs, it is worth remembering what this is about: the NIS2 Directive aims at a high common level of cybersecurity across the EU. That only works if everyone takes part, including the companies that currently see the law mainly as extra work.