One sheetfor everyreporting stage.

You must report every significant cybersecurity incident, meaning an event that compromises the availability, authenticity, integrity, or confidentiality of data or services (§ 3 no. 30 NISG 2026) and is significant. The NISV 2026 (BGBl. II No. 290/2026, promulgated on October 1, 2026) lists in § 5 cases that are significant in any case. According to the explanatory notes, “is capable of causing” in § 5 para. 1 no. 1 to 3 means that the effect is to be expected in the near future in the ordinary course of events. Check what has occurred or is imminent in this way.

• § 35 para. 1 NISG 2026: severe operational disruption of the services or severe financial losses for the entity (no. 1), or considerable material or non-material damage to other persons (no. 2).
• § 5 para. 1 no. 1 NISV 2026: direct financial loss exceeding €500,000 or 5% of annual turnover in the previous financial year, whichever is lower.
• No. 2: leakage of trade secrets within the meaning of § 26b UWG (Austrian Unfair Competition Act) or of information subject to secrecy under § 6 IFG (Austrian Freedom of Information Act).
• No. 3 and 4: death or serious damage to the health of a natural person.
• No. 5: successful, suspected malicious, and unauthorized access to network and information systems that is likely to cause severe operational disruption.
• No. 6 with § 7: at least two incidents in six months that are not significant on their own, with the same apparent root cause and impact, which together exceed the threshold from no. 1.
• No. 7 and 8: outage or limited availability of the services for more than 24 hours, for more than 100,000 users or 10% of users (whichever is lower), or in the territory of at least one federal state.
• No. 9: the incident has activated crisis management or disaster recovery plans of business continuity management.
• Exclusion under § 6 NISV 2026: only a scheduled interruption of operations or the planned consequences of scheduled maintenance work. This is not a significant incident.

The general criteria continue to apply alongside § 5 NISV 2026. Under § 35 para. 2 NISG 2026, these include the dependence of other sectors on your service, effects on the environment, public safety, or health, your market share, the affected area including cross-border impact, the affected systems, the severity of the threat, exploited vulnerabilities, and experience with similar incidents.

For entities under IR (EU) 2024/2690 (DNS, TLD name registries, cloud, data centers, content delivery networks, managed services and managed security services, online marketplaces, search engines, social networks, trust services), its Art. 3 and 4 and, depending on the type, Art. 5 to 14 apply; according to the explanatory notes, § 5 NISV 2026 governs the other entities. Managed services and managed security services additionally under Art. 10: completely unavailable for more than 30 minutes, limited for more than one hour for more than 5% or 1 million users in the Union (whichever is lower), or data compromised by a suspected malicious act or for this group of users.