TOOLBOX · DOWNLOAD
NIS2 reporting obligationsat aglance.
Since October 1, 2026, the NISG 2026 (Austrian Network and Information Systems Security Act 2026) has applied in Austria. Essential and important entities must report significant cybersecurity incidents in fixed stages: early warning within 24 hours, notification within 72 hours, and a final report no later than one month after that. This document shows deadlines, content, and recipients with the references in the law. It helps you prepare the reporting chain before an emergency occurs.
Free PDF · Guide
NIS2: Security Incident Reporting Obligations at a Glance
- Topic
- NIS2 & Compliance
- Format
- PDF, A4
- Length
- 7 pages
- Size
- 95 KB
- Updated
- Oct 25, 2026
- Sources
- 8
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Deadlines, content, and recipients of reports under the NISG 2026 (Austrian Network and Information Systems Security Act 2026) and the NIS2 Directive, with a preparation checklist.
- Executives and management bodies of essential and important entities in Austria
- IT management, information security officers, and incident response managers
- IT service providers who support their customers during security incidents
7 SECTIONS
What Is
Inside.
- 01
Who the Reporting Obligation Applies To
NISG 2026 since October 1, 2026: mandatory reporting for essential and important entities, voluntary reporting for everyone.
- 02
When an Incident Is Significant
The two criteria from § 35 NISG 2026, the assessment factors, the criteria of the NISV 2026 (Austrian NIS Regulation 2026), and the EU thresholds for digital providers.
- 03
The Reporting Chain: 24 Hours, 72 Hours, One Month
Early warning, notification, intermediate report, final report, and progress report with deadline, content, and reference.
- 04
Where to Report
To the competent CSIRT. It forwards the report to the Federal Office for Cyber Security.
- 05
Don't Forget Customers and Data Protection
Inform recipients of your services without undue delay and check the 72-hour notification under the GDPR in parallel.
- 06
Checklist: Ready to Report Before an Emergency
Ten items so that the 24-hour deadline does not become a hurdle during an incident.
- 07
Penalties for Violations
Administrative penalties under § 45 NISG 2026 for breaches of reporting and information obligations.
EXCERPT
The Reporting Chain: 24 Hours, 72 Hours, One Month
- 24 h
Early warning
Without undue delay, no later than 24 hours after becoming aware: where applicable, suspicion of unlawful acts and cross-border impact.
- 72 h
Notification
Without undue delay, no later than 72 hours after becoming aware: update and initial assessment, including severity and impact.
- 1 month
Final report
No later than one month after the notification, not after the incident: root causes, mitigation measures, impact.
| Stage | Deadline | Content | Reference |
|---|---|---|---|
| Early warning | without undue delay, no later than 24 hours after becoming aware | where applicable: suspicion of unlawful or malicious acts, possible cross-border impact | § 34 para. 2 no. 1 NISG 2026, Art. 23(4)(a) |
| Notification | without undue delay, no later than 72 hours after becoming aware | update of the early warning, initial assessment including severity and impact, indicators of compromise where available | § 34 para. 2 no. 2, Art. 23(4)(b) |
| Intermediate report | at the request of the CSIRT or the cybersecurity authority | relevant status updates | § 34 para. 2 no. 3, Art. 23(4)(c) |
| Final report | no later than one month after the notification, not after the incident | detailed description including severity and impact; type of threat and likely root causes; mitigation measures applied and ongoing; cross-border impact where applicable | § 34 para. 2 no. 4, Art. 23(4)(d) |
| Progress report | if the incident is still ongoing when the final report is due | status of incident handling; the final report follows no later than one month after incident handling ends | § 34 para. 2 no. 5, Art. 23(4)(e) |
- The deadlines run from becoming aware of the significant incident, not from when it began.
- Trust service providers report incidents affecting their trust services within 24 hours instead of 72 (§ 34 para. 2, sentence after no. 5).
- You must provide all information that enables the CSIRT and the authority to assess cross-border impact (§ 34 para. 2).
- The CSIRT responds no later than 24 hours after receiving the early warning with initial feedback and, on request, guidance on mitigation measures (§ 34 para. 4).
SOURCES
Supported
by Sources.
- NISG 2026, BGBl. I No. 94/2025, authentic promulgation in the RIS (opens in a new tab)§§ 3 no. 30, 3a, 8, 24 to 26, 34, 35, 37, 45, 51, and Art. 3 (§ 8a GTelG 2012), accessed October 22, 2026
- NISV 2026, BGBl. II No. 290/2026, authentic promulgation in the RIS (opens in a new tab)§§ 5 to 7 significance, § 9 entry into force, accessed October 25, 2026
- Federal Office for Cyber Security: Explanatory notes on the NISV 2026 (PDF) (opens in a new tab)On § 5: scope outside Implementing Regulation (EU) 2024/2690
- NISG 2026, current version in the RIS (opens in a new tab)
- Directive (EU) 2022/2555 (NIS2 Directive), Art. 23 reporting obligations (opens in a new tab)OJ L 333 of December 27, 2022
- Implementing Regulation (EU) 2024/2690, Art. 3 significant incidents (opens in a new tab)OJ L of October 18, 2024
- Regulation (EU) 2016/679 (GDPR), Art. 33 notification to the supervisory authority (opens in a new tab)
- Datenschutzgesetz (DSG, Austrian Data Protection Act), § 18 Data Protection Authority as supervisory authority (opens in a new tab)
This document provides an overview and does not replace legal advice. The legal text in its current version is authoritative; regulations of the cybersecurity authority, currently the NISV 2026, add details.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now NIS2 Cockpit
Readiness and evidence structure for NIS2, in a controlled assessment. Not legal advice.
Learn MoreNIS2 in the Glossary
What the NIS2 Directive governs and whom it affects, briefly explained.
Learn MoreIncident Response
How companies detect, contain, and follow up on security incidents.
Learn More
NIS2 & COMPLIANCE
More on
This Topic.
- PDF
NIS2 Incident Report
A worksheet for emergencies: master data, a significance checklist under the NISV 2026, fields for the early warning, notification, and final report, customer information, a GDPR review, and a log.
View - PDF
GDPR Data Breach Checklist
Data breach detected, now what? Establish the breach, assess the risk, notify the Austrian Data Protection Authority (Datenschutzbehörde) on time, inform data subjects and document everything, under Art. 33 and 34 GDPR.
View - PDF
Supplier Security Questionnaire
Fill-in questionnaire for IT service providers and suppliers: organization, access, vulnerabilities, incident reporting, audit rights and termination, based on NISG 2026 and IR (EU) 2024/2690.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.