TOOLBOX · DOWNLOAD
NIS2 risk management as a checklist.
Since October 1, 2026, essential and important entities must implement risk management measures under § 32 NISG 2026. What the ten minimum contents require in detail is set out in the Annex of IR (EU) 2024/2690; § 2 NISV 2026 extends it to all essential and important entities to which it does not already apply. This checklist maps each letter of § 32 para. 4 to the points of the Annex, summarizes the core of each requirement and lists evidence you should keep on hand. It also covers the duties of the management bodies under § 31, proportionality and compensating measures, and the self-declaration, audits and deadlines under § 33.
Free PDF · Checklist
NIS2 Risk Management: The Measures Under § 32 NISG 2026 as a Checklist
- Topic
- NIS2 & Compliance
- Format
- PDF, A4
- Length
- 11 pages
- Size
- 146 KB
- Updated
- Oct 25, 2026
- Sources
- 16
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
The minimum contents under § 32 para. 4 NISG 2026 with the Annex of Implementing Regulation (EU) 2024/2690, evidence ideas, management body duties and self-declaration.
- Information security officers and CISOs of essential and important entities under the NISG 2026
- Managing directors, executive boards and other management bodies that must ensure and oversee implementation
- IT management, compliance and internal audit who collect evidence and prepare the self-declaration
9 SECTIONS
What Is
Inside.
- 01
What this is about and what is binding
Ten minimum contents in the NISG 2026, details in the Annex of the Implementing Regulation, evidence ideas as a recommendation.
- 02
Mapping: § 32 para. 4 NISG 2026 and the Annex of the Implementing Regulation
Which points of the Annex specify the ten letters of § 32 para. 4 NISG 2026.
- 03
Checklist 1: policies, risk, incidents, operations
Points (a) to (c), Annex points 1 to 4: policy, roles, risks, incidents, contingency, backup and crisis.
- 04
Checklist 2: supply chain, procurement, operations
Points (d) to (f), Annex points 5 to 7: supply chain, acquisition, changes, patches, network and effectiveness.
- 05
Checklist 3: training, access, assets, environment
Points (g) to (j), Annex points 8 to 13: training, cryptography, staff, access, MFA, assets, environment.
- 06
Duties of the management bodies (§ 31 NISG 2026)
Ensure, oversee, approve, get trained: what executive management must do itself.
- 07
Proportionality and compensating measures
How size and risk determine implementation and when you may deviate with reasons.
- 08
Self-declaration, audits and deadlines (§ 33 NISG 2026)
Self-declaration by September 30, 2027, request for an audit no earlier than October 1, 2028, penalty ranges.
- 09
Common mistakes
What makes implementing § 32 NISG 2026 and providing evidence to the cybersecurity authority harder in practice.
EXCERPT
Mapping: § 32 para. 4 NISG 2026 and the Annex of the Implementing Regulation
| Point | Minimum under § 32 para. 4 NISG 2026 | Annex point |
|---|---|---|
| a | Policies on risk analysis and information system security | 1, 2 |
| b | Incident handling | 3 |
| c | Business continuity: backup, recovery, crisis management | 4, 13.1 |
| d | Supply chain security, including with direct suppliers | 5 |
| e | Acquisition, development, maintenance; vulnerability handling and disclosure | 6, 13.2 |
| f | Assessing the effectiveness of risk management measures | 7 |
| g | Basic cyber hygiene and training | 8 |
| h | Cryptography and, where appropriate, encryption | 9 |
| i | Human resources security, access control, asset management | 10 to 12, 13.3 |
| j | MFA or continuous authentication; secured communications | 11 (11.7) |
SOURCES
Supported
by Sources.
- NISG 2026, BGBl. I No. 94/2025, version in force in the RIS (opens in a new tab)Version of October 25, 2026 (original version); §§ 3 no. 11, 27, 29, 31 to 33, 38, 39, 44 to 46, 51; accessed October 25, 2026
- NISV 2026, BGBl. II No. 290/2026, authentic promulgation in the RIS (opens in a new tab)§§ 2 to 4 risk management measures, § 7, § 9 entry into force; accessed October 25, 2026
- Federal Office for Cybersecurity: Explanatory notes to the NISV 2026 (PDF) (opens in a new tab)General part, on §§ 2, 4 and 8: framework, DORA, § 7 by analogy, compensating measures, references; accessed October 25, 2026
- Explanatory notes to the government bill NISG 2026 (308 d. B. XXVIII. GP), at the Federal Office for Cybersecurity (PDF) (opens in a new tab)On §§ 31, 44 and 45 (approval, penalty addressee, § 9 VStG) and on § 33 (self-declaration); accessed October 25, 2026
- Verwaltungsstrafgesetz 1991 (VStG, Austrian Administrative Penal Act), § 9, in the RIS (opens in a new tab)§ 9 para. 1 liability of those authorized to represent externally; accessed October 25, 2026
- Directive (EU) 2022/2555 (NIS2 Directive), Art. 20 and 21 (opens in a new tab)Art. 20(1) and Art. 21(2); OJ L 333 of December 27, 2022; accessed October 25, 2026
- Implementing Regulation (EU) 2024/2690, Art. 2 and Annex (opens in a new tab)Art. 1, 2 and Annex points 1 to 13; OJ L of October 18, 2024; accessed October 25, 2026
- ENISA: NIS2 Technical Implementation Guidance, June 2025, Version 1.0 (opens in a new tab)Examples of evidence for points 1 to 13, guidance on 4.3.2; not binding according to ENISA; accessed October 25, 2026
- Federal Office for Cybersecurity: Registration (opens in a new tab)Initial registration by January 1, 2027, at the latest January 4, 2027 (§ 33 para. 2 AVG), NIS2 Services; page of October 2, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Frequently asked questions, registration (opens in a new tab)Registration by December 31, 2026, via the USP; page of September 25, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Frequently asked questions, executive management (opens in a new tab)Management body, training per member, no administrative penalties; page of September 25, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Frequently asked questions, measures (opens in a new tab)Responsibility for outsourced IT; page of October 15, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Frequently asked questions, § 2 requirements for risk management measures (opens in a new tab)Proportionality with spreadsheet example; page of October 20, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Frequently asked questions, § 4 compensating measures (opens in a new tab)Schedule for temporary deviations; page of October 20, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Frequently asked questions, evidence (opens in a new tab)Self-declaration by September 30, 2027, via the USP, ISO 27001, scope, partial recognition; page of September 25, 2026, accessed October 25, 2026
- Federal Office for Cybersecurity: Audits by independent bodies (opens in a new tab)Request no earlier than October 1, 2028, deadlines, certificates with scope; page of September 21, 2026, accessed October 25, 2026
These checklists are a TOMORIS recommendation and do not replace legal advice. The NISG 2026 and NISV 2026 as currently in force, the Annex of Implementing Regulation (EU) 2024/2690 (via § 2 NISV 2026 in the version at the time of its entry into force) and the cybersecurity authority’s requirements for the self-declaration are authoritative. The evidence ideas are examples; the ENISA guidance is not binding.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now IT security policy: template
Sample text for the information security policy and basic rules for employees, with references to BSI IT-Grundschutz, the NISG 2026 and the NISV 2026.
Learn MoreNIS2 incident report: template
Worksheet for early warning, notification and final report under § 34 NISG 2026, with a significance check under the NISV 2026.
Learn MoreISMS in the glossary
What an information security management system is and how it manages risks, measures and evidence on an ongoing basis.
Learn More
NIS2 & COMPLIANCE
More on
This Topic.
- PDF
NIS2 Reporting Obligations
Early warning within 24 hours, notification within 72 hours, final report after one month: deadlines, content, and recipients with references to the NISG 2026, plus a checklist.
View - PDF
NIS2 Incident Report
A worksheet for emergencies: master data, a significance checklist under the NISV 2026, fields for the early warning, notification, and final report, customer information, a GDPR review, and a log.
View - PDF
GDPR Data Breach Checklist
Data breach detected, now what? Establish the breach, assess the risk, notify the Austrian Data Protection Authority (Datenschutzbehörde) on time, inform data subjects and document everything, under Art. 33 and 34 GDPR.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.