ITER/ATAustria
What the record establishes for Austria: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Österreichische Datenschutzbehörde reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The sectoral CSIRT competent for the entity or, where there is none, CERT.at as national CSIRT, which forwards the report to the Bundesamt für Cybersicherheit binding | https://www.usp.gv.at/checked 2026-10-05 The Meldeplattform in the Unternehmensserviceportal, in operation from 1 October 2026 and reached through a USP login; nis.cert.at forwards to cert.at/de/nis2. CERT.at, as national CSIRT, takes, handles, and forwards the reports; where the platform is down, a PDF form to reports@cert.at. Sectoral CSIRTs receive the reports of the entities in their sector. | at nisg 2026, cert at nis2 |
| Financial supervisorDORA, article 19 | Finanzmarktaufsicht (FMA) reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Österreichische Finanzmarktaufsicht (FMA) reported | — | esma mar nca |
Transposition of NIS2 reported
| Act | Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026, BGBl. I Nr. 94/2025 |
|---|---|
| In force | 1 October 2026, by § 51(2): nine months after promulgation on 23 December 2025, then the first day of the following month. The date is arithmetic on the act's own wording. |
| Recipient | The sectoral CSIRT competent for the entity or, where there is none, the national CSIRT, which forwards the report to the Bundesamt für Cybersicherheit, the Cybersicherheitsbehörde under § 3a |
| Moves a term | No. None. Section 34(2) owes the early warning «innerhalb von 24 Stunden nach Kenntnisnahme des erheblichen Cybersicherheitsvorfalls», the notification «innerhalb von 72 Stunden nach Kenntnisnahme», an interim report on request, and the final report «spätestens einen Monat nach Übermittlung der Meldung»; where the incident is still running, a progress report then and the final report within one month of the end of its handling. |
| Standing | Read in the act as promulgated. The NISG 2024 the earlier entry named was a bill that did not pass; the authority's page it was read from did not say so. |
| Source | nisg at faq |
An event in Austria
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.