Cybersecurity Database

Regulation

NISV 2026 (NIS 2 risk-management ordinance)

Ordinance of the Cybersecurity Authority on detailed requirements for cybersecurity risk-management measures and further criteria for significant incidents (NISV 2026)

In force since 2 October 2026Record checked against the official source on 29 October 2026 · Methodology

Official source: https://www.ris.bka.gv.at/eli/bgbl/II/2026/290

Official sourceWayback Machine snapshot
Official number
BGBl. II Nr. 290/2026
Date adopted
Entry into force

Summary

The ordinance, adopted by the Federal Office for Cybersecurity under the NISG 2026, specifies the risk-management measures that essential and important entities must apply from 1 October 2026. It extends the technical and methodological requirements of Article 2 and the annex of Implementing Regulation (EU) 2024/2690 to all types of entities listed in Annexes 1 and 2 of the NISG 2026, creating a single catalogue to be implemented with a risk-based approach. It sets four broad risk categories and allows compensating measures where a requirement cannot be met immediately. It also lays down criteria for deciding when an incident is significant and must be reported, excluding planned outages and treating repeated incidents together. It does not apply where sector-specific EU rules, such as the DORA Regulation, ensure at least an equivalent level.

Who it applies to

Essential and important entities covered by the NISG 2026, except those already bound by equivalent measures under sector-specific EU acts.

Information

Jurisdiction
Austria
Issuing body
Bundesamt für Cybersicherheit (Cybersicherheitsbehörde)
Type
Regulation
Available languages
German
Topics
Notes
Adopted under § 32(5) and § 35(3) of the NISG 2026. Published in the Bundesgesetzblatt on 1 October 2026 and in force at the end of the day of publication; these dates are still to be verified against the RIS text, which could not be consulted directly. The Federal Office for Cybersecurity publishes the ordinance and its explanatory notes on the "Recht und Dokumente" page of its website.

Record details

Original title
Verordnung der Cybersicherheitsbehörde zur Festlegung näherer Anforderungen an die Risikomanagementmaßnahmen im Bereich der Cybersicherheit und weiterer Kriterien über das Vorliegen eines erheblichen Cybersicherheitsvorfalls (NISV 2026)
Title in other languages
  • Regolamento dell'autorità per la cybersicurezza sui requisiti delle misure di gestione del rischio e sui criteri degli incidenti significativi (NISV 2026)
  • Ordonnance de l'autorité de cybersécurité précisant les exigences relatives aux mesures de gestion des risques et les critères des incidents importants (NISV 2026)
  • Reglamento de la autoridad de ciberseguridad sobre los requisitos de las medidas de gestión de riesgos y los criterios de los incidentes significativos (NISV 2026)
Licence / terms of use
Public domain / official act – Act published in the official gazette: legislative texts and official acts are excluded from copyright protection under national law.
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

Bundesamt für Cybersicherheit (Cybersicherheitsbehörde). (2026). Verordnung der Cybersicherheitsbehörde zur Festlegung näherer Anforderungen an die Risikomanagementmaßnahmen im Bereich der Cybersicherheit und weiterer Kriterien über das Vorliegen eines erheblichen Cybersicherheitsvorfalls (NISV 2026) (BGBl. II Nr. 290/2026). https://www.ris.bka.gv.at/eli/bgbl/II/2026/290

Chicago

Bundesamt für Cybersicherheit (Cybersicherheitsbehörde). "Verordnung der Cybersicherheitsbehörde zur Festlegung näherer Anforderungen an die Risikomanagementmaßnahmen im Bereich der Cybersicherheit und weiterer Kriterien über das Vorliegen eines erheblichen Cybersicherheitsvorfalls (NISV 2026)." 1 October 2026. https://www.ris.bka.gv.at/eli/bgbl/II/2026/290.

BibTeX

@misc{at_nisv_2026,
  author       = {{Bundesamt für Cybersicherheit (Cybersicherheitsbehörde)}},
  title        = {{Verordnung der Cybersicherheitsbehörde zur Festlegung näherer Anforderungen an die Risikomanagementmaßnahmen im Bereich der Cybersicherheit und weiterer Kriterien über das Vorliegen eines erheblichen Cybersicherheitsvorfalls (NISV 2026)}},
  year         = {2026},
  note         = {BGBl. II Nr. 290/2026},
  url          = {https://www.ris.bka.gv.at/eli/bgbl/II/2026/290},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON