Quelltext der Seite Network and Information Security Directive (NIS2-RL)/en

<languages/>
{{Infobox Rechtsakt (EU)|Typ=Richtlinie|Jahr=2022|Nummer=2555|Vertrag=EU|EWR=ja|Titel=Richtlinie (EU) 2022/2555 des Europäischen Parlaments und des Rates vom 14. Dezember 2022 über Maßnahmen für ein hohes gemeinsames Cybersicherheitsniveau in der Union, zur Änderung der Verordnung (EU) Nr. 910/2014 und der Richtlinie (EU) 2018/1972 sowie zur Aufhebung der Richtlinie (EU) 2016/1148|Kurztitel=NIS-2-Richtlinie|Bezeichnung=NIS2-RL|Rechtsmaterie=Binnenmarkt, Cybersicherheit|Grundlage=AEUV, insbesondere {{Art.|114|AEUV|dejure|}}
|LegalReference=OJ L 2022/333, 80|ApplicableFrom=17 October 2024 (transposition deadline)|Valid=transposition}}

<span id="Kurzübersicht"></span>
== Overview ==

{| class="wikitable"
!Goals
!Scope
!Content<ref>https://www.nis.gv.at/nis-2-richtlinie.html</ref>
!Synergy
!Consequences
|-
|Development of cybersecurity capabilities (Recital 1 NIS2)
|Annex I (high-criticality sectors)
|Obligation for all MS to adopt national cybersecurity strategies (Art 7 NIS2)
|Data protection management system
|Essential entities: fines of at least EUR 10 million or 2% of global annual turnover
|-
|Achieving a high common level of cybersecurity (Art 1 NIS2)
|Annex II (other critical sectors) if thresholds in Art 2(1) of the Annex to Recommendation 2003/361/EC are exceeded
|Obligation for MS to define various responsibilities and enforcement duties (Art 31 et seq. NIS2)
|Security of processing (Art 32 GDPR)
|Important entities: maximum fine of at least EUR 7 million or 1.4% of global annual turnover, whichever is higher
|-
|Mitigating threats in key sectors (Recital 1 NIS2)
|To be transposed by MS by 17 October 2024 (not yet done)
|Obligations regarding cybersecurity risk management (Art 20 et seq. NIS2) and reporting (Art 23 NIS2)
|Confidentiality clauses
|Administrative orders and instructions. Suspension of activity also possible (Art 32 NIS2)
|-
| 
| 
|Provisions and obligations on sharing cybersecurity information (Art 29 et seq. NIS2)
| 
|Management bodies can be held personally liable (Art 20 NIS2)
|}

For both, the higher amount applies. 
|- 
| Containment of threats in key sectors (Recital 1 NIS2 Directive) 
| Must be implemented by Member States by 17 October 2024 (not yet done) 
| Obligations regarding cybersecurity risk management (Art. 20 et seq. NIS2 Directive) and reporting obligations (Art. 23 NIS2 Directive) for affected entities 
| Confidentiality clauses 
| Official instructions and orders. Suspension of operations can also be ordered (Art. 32 NIS2 Directive) 
|-
| 
| 
| Rules and obligations on the exchange of cybersecurity information (Art. 29 et seq. NIS2 Directive) 
| 
| Management bodies may be held personally liable (Art. 20 NIS2 Directive) 
|}

<span id="Einführung"></span>
== Introduction ==

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union<ref>Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148, OJ L 333/80 of 27.12.2022</ref> (short: “NIS2 Directive”) is the successor to the EU’s first cybersecurity directive<ref>Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 on measures for a high common level of security of network and information systems across the Union, OJ L 194/1 of 19 July 2016</ref> (“NIS Directive”).  

Already under the first NIS Directive and its national implementation (NISG), certain companies were required to adopt cybersecurity measures. The successor, the NIS2 Directive, significantly expands the scope to include many previously uncovered companies and mandates tailored security measures. It also introduces specific requirements for incident notification systems and new liability provisions. The NIS Directive was implemented in Austria via the Network and Information System Security Act (NISG), which is currently (as of October 2024) being revised to implement NIS2<ref>Network and Information System Security Act 2024 – NISG 2024; Telecommunications Act, eHealth Act, amendments (326/ME)

https://www.parlament.gv.at/gegenstand/XXVII/ME/326</ref>. Also notable is Implementing Regulation (EU) 2024/2690<ref>Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 laying down technical and methodological requirements for cybersecurity risk management measures under Directive (EU) 2022/2555, and specifying cases where security incidents affecting DNS providers, TLD registries, cloud computing services, data center services, content delivery network operators, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms, and trust service providers are to be considered significant.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402690</ref>.  

The aim of the NIS2 Directive is to establish a robust security infrastructure across the EU based on a risk-based approach. The focus is not on securing each individual device, but on ensuring the resilience of essential and important entities. 

Although Austria’s National Council secured a simple majority in July 2024 for the implementation law (NISG-E), the law requires a two-thirds majority due to constitutional provisions, which was not reached. The main reason for opposition was the placement of the national cybersecurity authority within the Ministry of the Interior.<ref>https://www.parlament.gv.at/aktuelles/pk/jahr_2024/pk0785</ref> The authors do not expect significant changes to the uncontested provisions in future drafts, which is why the following sections are based on the current draft (NISG 2024; Telecommunications Act, eHealth Act, amendment (326/ME)<ref>Federal law establishing a law on ensuring a high level of cybersecurity of network and information systems (Network and Information System Security Act 2024 – NISG 2024) and amending the Telecommunications Act 2021 and the eHealth Act 2012. https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621118.pdf</ref> – referred to hereafter as NISG).

<span id="Anwendungsbereich"></span>
== Scope ==

<span id="NIS2-Richtlinie"></span>
=== NIS2 Directive ===

<span id="Persönlicher/Sachlicher_Anwendungsbereich"></span>
==== Personal/Material Scope ====

The scope includes both public and private entities. The NIS2 Directive distinguishes between size-dependent (Art 2(1) NIS2) and size-independent (Art 2(3) NIS2) applicability. 

<span id="Größenabhängiger_Anwendungsbereich"></span>
===== Size-dependent scope =====

To define the size-dependent scope, the NIS2 Directive applies the size-cap rule: 

To define the size-dependent scope, the NIS2 Directive applies the size-cap rule: 

* Entities with more than 50 employees
* or more than EUR 10 million in annual turnover<ref>The calculation of size thresholds under EU Recommendation 2003/361/EC is complex and includes indirect links and partnerships, such as subsidiaries. Legal advice is recommended for large or complex organizations. https://op.europa.eu/de/publication-detail/-/publication/79c0ce87-f4dc-11e6-8a35-01aa75ed71a1</ref>

Additionally, the entity’s activity must fall under Annex I or II of the NIS2 Directive:

* Annex I includes sectors such as: Energy | Transport | Banking | Financial market infrastructures | Healthcare | Drinking water | Waste water | Digital infrastructure | ICT service management (B2B) | Public administration | Space

* Annex II includes sectors such as: Postal and courier services | Waste management | Manufacturing and trade of chemicals | Food production and distribution | Manufacturing | Production of goods | Digital service providers | Research 

 Annex II includes sectors such as:

Postal and courier services | Waste management | Manufacture, production and trade of chemicals | Food production, processing and distribution | Manufacturing industry | Goods manufacturing | Digital service providers | Research

<span id="Größenunabhängiger_Anwendungsbereich"></span>
===== Size-independent Scope =====

According to Articles 2 and 3 NIS2, entities may fall within the scope of the Directive regardless of their size or the "size-cap rule".  

Covered activities include: 

Under Article 2(2)(a) NIS2: 

* Providers of public electronic communications networks or publicly available electronic communications services
* Trust service providers
* Top-level domain name registries and DNS service providers

Under Article 2(2)(b)–(f) in conjunction with Article 3(1)(e) NIS2: 

* Services essential for maintaining critical societal or economic activities
* Services whose disruption could significantly affect public order, public security or public health
* Services whose disruption could pose a significant systemic risk, particularly in sectors with potential cross-border impacts
* Entities considered critical due to their specific importance at national or regional level for their sector, type of service or interdependent sectors
* Certain public administration entities

* Entities designated as critical under the Critical Entities Resilience Directive (CER Directive)
* Domain name registration service providers

<span id="Wesentliche_und_Wichtige_Einrichtungen"></span>
=== Essential and Important Entities ===

Entities within scope are classified under Article 3 NIS2 as either essential or important. 

* Essential entities are subject to both proactive and reactive supervision (Art 32 NIS2) 

* Important entities are subject to reactive supervision only (Art 33 NIS2)<ref>https://www.nis.gv.at/nis-2-richtlinie.html</ref> 

Different sanction regimes apply accordingly.

<span id="Territorialer_Anwendungsbereich"></span>
=== Territorial Scope ===

Applies to entities established in the EU or providing services within the EU (Art 2 NIS2).

<span id="Nationaler_Umsetzungsentwurf_(NISG)"></span>
=== National Implementation (NISG Draft) ===

[[Datei:Nis ii wichtige einrichtungen ri.png|mini|Important Entities]]

<span id="Persönlicher/Sachlicher_Anwendungsbereich"></span>
==== Personal/Material Scope ====

According to § 2 NISG, the Act applies to essential and important entities operating in defined sectors. These sectors correspond to those listed in the NIS2 Directive and are extended by subsectors listed in Annexes 1<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621120.pdf</ref> and 2<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf</ref> of the NISG.

An "entity" under § 3(10) NISG is a natural person or a legal person or registered partnership recognized under the applicable national law, capable of exercising rights and bearing obligations in its own name. 

Unlike the two-tier approach in Articles 2 and 3 of NIS2, classification under the NISG relies solely on § 24 NISG. This section also distinguishes between sectors with size thresholds and those without.

<span id="Größenabhängiger_Anwendungsbereich"></span>
===== Size-dependent Scope =====

[[Datei:Nis ii wesentliche einrichtungen ri.png|mini|Wesentliche Einrichtungen - CC BY 4.0]][[Special:MyLanguage/Großes oder mittleres Unternehmen iSd NISG|Large or medium-sized enterprises]]
operating in sectors listed in Annexes 1 and 2 of the NISG are deemed important entities under § 42(2) NISG. 

A subset of these entities is designated as essential under § 24(1) NISG. 

Austria did not make use of the option to automatically classify previous “operators of essential services” or include municipalities and educational institutions within the scope.<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621119.pdf</ref>

<span id="Größenunabhängiger_Anwendungsbereich"></span>
===== Size-independent Scope =====

Regardless of size, the following are considered essential entities under § 24(1)(1) NISG:
* Qualified trust service providers
* TLD name registries
* DNS service providers
* Federal-level public administration entities
* Entities designated as essential by the cybersecurity authority (§ 26(1))
* Entities classified as critical under Directive (EU) 2022/2557 (CER Directive) 

Additionally, public authorities meeting the criteria in § 25(3) NISG fall under this category. These include federal and state institutions without a commercial mandate whose decisions impact individual rights in cross-border contexts.

<span id="Ausnahmen"></span>
===== Exceptions =====

Entities already subject to sector-specific EU legislation that mandates their own risk management or incident reporting—ensuring at least equivalent cybersecurity—and that are formally recognised as such by regulation (§ 27 NISG), are exempt. This may apply to entities covered by the DORA Regulation.

Entities in the public administration sector whose activities are primarily related to national security, public safety, military defense, or law enforcement, as well as institutions of higher education, judiciary, legislative bodies (including the Parliamentary Directorate), and the Austrian National Bank, are not considered essential or important entities (§ 24(6) NISG).

<span id="Abgrenzungen"></span>
===== Delineation =====

Entities not directly within the scope may still be contractually required to comply with NIS2 obligations through agreements with in-scope entities. In such cases, it must be assessed which parts of the obligations apply to the indirectly covered entity.

<span id="Territorialer_Anwendungsbereich"></span>
=== Territorial Scope ===

Essential and important entities, as well as domain name registration service providers, are subject to the provisions of this chapter only with regard to their establishments located in Austria (§ 28 NISG).

Different rules apply to providers of public communications networks, publicly available electronic communication services, DNS providers, TLD registries, domain name registration services, cloud computing service providers, data center service providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines, and social networking platforms. 

For details, see § 28 NISG.

<span id="Zeitlicher_Anwendungsbereich"></span>
=== Temporal Scope ===

As of the time of drafting, the NIS2 Directive has not yet been transposed into Austrian national law.

<span id="Zentrale_Inhalte"></span>
== Key Provisions ==

<span id="Risikomanagementmaßnahmen"></span>
=== Risk Management Measures ===

<span id="NIS2_Richtlinie"></span>
==== NIS2 Directive ====

The regulation of risk management measures under NIS2 follows a risk-based and proportionate approach<ref>https://www.handelsverband.at/fileadmin/content/Presse_Publikationen/Presseaussendungen/2024/03_Mar/2024-03_HV_NIS2-Leitfaden_extra.pdf</ref>. Companies must consider the following factors when implementing security measures:

* State of the art
* Cost of implementation
* Size of the entity
* Probability of security risks
* Other individual factors

Article 21(2) NIS2 defines ten concrete measures and minimum requirements that Member States must mandate. 

These include:

* Policies for risk analysis and information system security
* Incident handling
* Business continuity
* Supply chain management
* Evaluation procedures for cybersecurity measures
* Use of cryptography and encryption
* Personnel security
* Access controls and asset management
* Cybersecurity training
* Security in procurement
* Development and maintenance of network and information systems
* Secure authentication and communication

<span id="Nationaler_Umsetzungsentwurf_(NISG)"></span>
==== National Implementation (NISG) ====

§ 32 NISG implements Article 21 NIS2.

§ 32(1) NISG refers to Annex 3<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621122.pdf</ref>, which lists refined measures based on Article 21 NIS2. The list reflects EU-level efforts within the NIS Cooperation Group<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 33</ref>. Measures are categorized as organizational, technical, and operational<ref>Organizational: a binding policy; Technical: e.g., firewalls; Operational: e.g., qualified operations staff. 

https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 33</ref>.

§ 32(2) NISG obliges affected entities to ensure a level of security appropriate to the existing risk, thus reinforcing the risk-based approach.

Entities must consider:

* State of the art (§ 32(2)(1)(a) NISG)
* Relevant national, European, and international standards (e.g., Regulation (EU) No 1025/2012)
* Best practices

Implementation costs must be proportionate to the risks facing the network and information systems (§ 32(2)(1)(b) NISG)<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 34</ref>. No excessive financial or administrative burdens should arise.

Measures must follow a cross-hazard approach, covering both cybersecurity and physical security (§ 32(2)(2) NISG), including: 

These include:

* Protection from system failures, human error, malicious acts, and natural events
* Personnel security
* Appropriate access control strategies

Special focus is placed on supply chain risk management (§ 32(2)(3) NISG):

* Assessment of supplier and provider vulnerabilities
* Consideration of the overall quality and resilience of products and services
* Review of suppliers’ cybersecurity practices and development processes

Entities must identify, assess, and manage risks and dependencies in service provider relationships.

The evaluation must include products and services of direct suppliers and providers. Where services depend significantly on subcontractors, these must also be included in the assessment. This applies to both new procurements and existing contracts<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 34</ref>.

Entities may be required to submit a list of implemented risk management measures to the cybersecurity authority. They may also be required to undergo an independent audit, with the resulting report signed by a management body. For important entities, this obligation applies only under certain conditions (§ 33 NISG).

<span id="Governance-Verpflichtung_und_Haftung_der_Leitungsorgane"></span>
== Governance Obligations and Liability of Management Bodies ==

<span id="NIS2-Richtlinie"></span>
=== NIS2 Directive ===

The NIS2 Directive introduces specific governance obligations targeting the executive and management levels, emphasizing their active role. Key aspects include: 

Main aspects are:

* **Accountability**: Corporate leadership (e.g., board, management) is responsible for approving and overseeing the implementation of risk management obligations.
* **Personal liability**: Management bodies may be held personally accountable for non-compliance with these obligations.
* **Training obligation**: Management bodies must undergo cybersecurity training and ensure such training is also available to their employees.
* **Skill development**: Training aims to provide adequate knowledge and capabilities to identify and assess cybersecurity risks and implement appropriate management practices.
* **Preventive approach**: Strengthening leadership competencies is intended to proactively mitigate cybersecurity threats.

<span id="Nationaler_Umsetzungsentwurf_(NISG)"></span>
=== National Implementation (NISG) ===

<span id="Begriff_Leitungsorgan"></span>
==== Definition of Management Body ====

"Management body" refers to one or more natural persons who, under law, articles of association, or contract, are appointed to manage an entity’s operations or supervise its management (§ 3(1)(11) NISG). Entity and management body may be identical—for example, a Federal Minister<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 6</ref>. The definition targets actual leadership (typically executive boards, managing directors, or supervisory boards). Legal representation alone does not establish a management body<ref>https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 7</ref>.

<span id="Pflichten_des_Leitungsorgans"></span>
==== Obligations of Management Bodies ====

The NISG imposes several obligations on the management bodies of essential and important entities:

* **Implementation of measures**: Management bodies must approve their entity’s cybersecurity measures<ref>S. 33</ref>.

* **Oversight**: They are required to supervise the implementation of cybersecurity measures, ensuring effectiveness and compliance. They must ensure regular review and updates of such measures.
* **Resource allocation**: Management bodies are responsible for providing sufficient financial and personnel resources for cybersecurity. This includes developing and regularly updating a detailed resource allocation plan.
* **Risk oversight**: Management must monitor and manage cybersecurity risks, conduct comprehensive assessments including the identification of critical systems, potential incident impacts, and ensure development and review of incident response plans.
* **Training**: Management must attend cybersecurity training and ensure employees receive training to detect, assess, and manage risks.
* **Accountability**: Management bodies are liable for any breach of cybersecurity obligations that causes damage, unless already covered by the Liability of Public Officials Act (OrgHG), BGBl 181/1967<ref>S. 33</ref>.
* **Strategic priority**: These obligations aim to establish cybersecurity as a strategic priority at the highest level of management.

<span id="Meldeverpflichtungen"></span>
== Incident Reporting Obligations ==

<span id="NIS2-Richtlinie"></span>
=== NIS2 Directive ===

The directive provides for several deadlines for reporting significant security incidents—24 hours, 72 hours, and one month. These are maximum deadlines; immediate reporting is often expected: 

* **Within 24 hours**: Early warning to the national authority, including whether criminal activity or cross-border effects are suspected.
* **Within 72 hours**: A more detailed report including current information, impact assessment, and indicators of compromise.
* **Within one month**: A final report with a comprehensive incident description, classification, severity, impact, remediation actions, and cross-border implications.
Voluntary reporting of incidents, threats, and near misses to CSIRT is also possible—even for non-essential entities. Such reports may be submitted anonymously.

<span id="Nationaler_Umsetzungsentwurf_(NISG)"></span>
=== National Implementation (NISG) ===

<span id="Meldung_von_Vorfällen_an_CSIRT"></span>
==== Reporting to CSIRT ====

Incident reporting is governed by §§ 34, 35, and 37 NISG.

§ 34(1) NISG obliges essential and important entities to report every significant cybersecurity incident to their sector-specific CSIRT or, alternatively, to the national CSIRT without delay. The Federal Chancellery maintains a list of CSIRTs under the NISG.

* **Early warning**: Within 24 hours
* **Follow-up report**: Within 72 hours
* **Final report**: Within one month; if the incident persists, a progress report is required, followed by a final report after resolution.

<span id="Inhalte_der_Meldungen:"></span>
Contents of reports:

* **Early warning**: Indicate whether the incident is suspected to be caused by unlawful or culpable acts or may have cross-border effects.
* **Incident report**: Update early warning with severity assessment, impacts, and compromise indicators.
* **Final report**: Full description of the incident, severity, causes, type of threat, mitigation measures, and possible cross-border effects.

Note: Alerts forwarded to the operator do not qualify as formal reports under § 34 NISG<ref>S. 21</ref>.

<span id="Meldung_von_Vorfällen_an_Betroffene"></span>
==== Notification to Affected Parties ====

If a significant incident affects service delivery, the entity must promptly inform service recipients and provide possible mitigation actions. 

<span id="Erheblicher_Cybersicherheitsvorfall"></span>
==== Definition of Significant Cybersecurity Incident ====

According to § 35 NISG, an incident is considered significant if: 

* It causes or may cause serious operational disruption or financial loss 

'''or''' 

* The affected systems’ role in service delivery
* Severity and technical nature of the threat
* Underlying vulnerabilities
* Past experience with similar incidents 

Additional criteria under § 35(2)–(3) NISG:

* Degree of dependency
* Possible consequences of incidents
* Market share of the entity
* Geographic reach
* Sector- and company-specific factors
* Additional criteria may be defined by the Federal Ministry of the Interior

Recital 101 NIS2 provides interpretative guidance. Implementing Regulation (EU) 2024/2690 further specifies what constitutes a significant incident for certain entities.

In addition, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402690 Implementing Regulation (EU) 2024/2690] defines what constitutes a significant cybersecurity incident for certain entities.

<span id="Fallbeispiel"></span>
=== Case Study ===

The company NisExperts AG is an IT service provider based in Styria, employing 66 staff members and recording an annual balance sheet total of nine million euros. NisExperts AG operates several data centers that host the IT infrastructure for multiple Austrian hospitals and the control system of a major Styrian network operator. On Friday afternoon at 4:00 p.m., the Security Operations Center (SOC) of NisExperts AG detects an unusually high number of requests targeting the firewalls of one of its data centers. Upon analysis, it is determined that the incident involves a Distributed Denial of Service (DDoS) attack targeting a core platform of the company.

On Friday at 4:00 p.m., its SOC detects a high volume of traffic targeting the firewalls of one data center. The attack is identified as a Distributed Denial of Service (DDoS) targeting a central company platform. Despite DDoS protection, attackers temporarily overload systems.

Impacts:
* Between 5:00 and 8:00 p.m., repeated outages affect a key access service.
* Clients experience connection drops, slow load times, and an inability to process critical data, triggering emergency procedures.

**Applicability**:

According to § 24(2) NISG, entities operating as medium-sized businesses in highly critical sectors (Annexes 1 and 2 NISG) qualify as important entities. § 25 NISG defines medium-sized businesses as employing at least 50 persons.NisExperts AG meets both criteria: over 50 employees and operation in a critical sector (Annex 1 No. 8—Digital infrastructure). While service disruptions could affect public order and health, this alone does not qualify it as an "essential entity". NisExperts AG is therefore classified as an important entity under the NISG.

=== Incident Reporting ===

Important entities are required under § 34 NISG to report any significant cybersecurity incident to their competent sectoral CSIRT, or otherwise to the national CSIRT without delay. In assessing whether an incident qualifies as significant, § 35(2)(b) NISG states that possible effects on public order, security, public health, or the health of the population or large groups must be taken into account.As NisExperts AG provides critical services to several hospitals, and the outage triggered the activation of emergency plans, this likely constitutes a significant cybersecurity incident under § 35 NISG.

According to Article 8 of Implementing Regulation (EU) 2024/2690, a significant incident occurs when the availability of a data centre service operated by the provider is impaired for more than one hour. This condition is met, and thus the event qualifies as a significant incident.

In the absence of a sector-specific CSIRT, NisExperts AG reports the incident to the national CSIRT (cert.at) in accordance with § 34 NISG as follows:

==== Initial report within 24 hours ====

* **Content**: Description of the incident, initial assessment of impacts on availability and integrity, and preliminary measures taken.
* **Technical details**: Assessment of attack type (DDoS), affected systems, and possible source of the attack.

==== Update within 72 hours ====

* **In-depth analysis**: Clarification of causes, precise damage assessment, and further mitigation and recovery measures.
* **Impact assessment**: Specification of affected client groups and disruptions.

==== Final report within one month ====

* **Results**: Documentation of the entire incident management process.
* **Lessons learned**: Recommended preventive measures and future strategies.

<span id="Synergien"></span>
== Synergies ==

<span id="Meldepflichten"></span>
== Reporting Obligations ==

The reporting obligations under the General Data Protection Regulation (GDPR) and the NIS2 Directive overlap in several areas, although they have different focal points.

<span id="Art_der_betroffenen_Daten"></span>
=== Nature of affected data ===

* **GDPR**: Only applies when personal data is compromised (e.g. unauthorized access, loss or theft).
* **NIS2**: Also applies to incidents affecting the availability, integrity, or confidentiality of systems, regardless of whether personal data is involved—focus is on general IT security.

<span id="Bedingungen_für_die_Meldung"></span>
=== Conditions for reporting ===

* **GDPR**: Required if the breach poses a risk to the rights and freedoms of natural persons.
* **NIS2**: Obligations apply for significant incidents with potential impact on the delivery of essential services, based on criteria such as user impact, incident duration, or economic damage.

<span id="Überschneidungen"></span>
=== Overlaps ===

* Both regulations require reporting of incidents affecting confidentiality, integrity, or availability.
* If both IT systems and personal data are involved, dual reporting may be required—to the data protection authority (GDPR) and the cybersecurity authority (NIS2).
* Operators of essential services handling personal data may be subject to both regimes and must report both the data breach and the cybersecurity incident.

The risk management requirements under the GDPR and NIS2 Directive intersect where both data and IT system protection are concerned. While both require security and risk mitigation measures, they differ in emphasis.

<span id="Risikomanagement"></span>
== Risk Management ==

The risk management requirements under the GDPR and NIS2 Directive intersect where both data and IT system protection are concerned. While both require security and risk mitigation measures, they differ in emphasis:

* **GDPR**: Protects personal data and individual rights. Risk management under GDPR aims to mitigate risks to the rights and freedoms of individuals due to data processing.
* **NIS2**: Focuses on cybersecurity and protection of network and information systems in critical sectors (e.g. energy, healthcare, transport). The goal is to improve the resilience of IT systems and critical infrastructure.

<span id="Risikobasierter_Ansatz"></span>
=== Risk-based approach ===

Both frameworks require risk-based strategies to design and implement security measures.

* **GDPR**: Requires appropriate technical and organisational measures proportional to the risks to individuals’ rights and freedoms (Art. 24, 32 GDPR), such as encryption, pseudonymisation, access control, and backups.
* **NIS2**: Requires risk management for network and information systems based on potential cyber risks, focusing on availability, integrity, and confidentiality (Art. 21 NIS2). Measures include network security controls, threat detection, and incident response plans.

<span id="Konkrete_Sicherheitsmaßnahmen"></span>
=== Specific security measures ===

* **GDPR**: Emphasizes protection of personal data (Art. 32 GDPR), including encryption and restoring data availability after incidents.
* **NIS2**: Emphasizes cybersecurity and operational resilience, requiring threat monitoring, redundancy, and service continuity—not limited to personal data but covering the full IT infrastructure.

<span id="Risikobewertung_und_Dokumentation"></span>
=== Risk assessment and documentation ===

* **GDPR**: Requires a Data Protection Impact Assessment (DPIA) if high risks to individuals are anticipated (Art. 35 GDPR), including detailed risk evaluation and mitigation.
* **NIS2**: Requires regular assessments of network and information system risks, identifying cybersecurity risks and mitigation strategies—these are broader and cover all critical infrastructure.

<span id="Betroffene_Unternehmen"></span>
=== Affected entities ===

* **GDPR**: Applies to any organization processing personal data, which includes nearly all businesses and institutions.
* **NIS2**: Applies only to operators of essential and important entities in critical sectors (e.g. energy, banking, healthcare).

<span id="Technische_und_organisatorische_Maßnahmen"></span>
=== Technical and organisational measures ===

Both frameworks demand adequate security measures but differ in scope:

* **GDPR**: Focuses on protecting personal data—measures must prevent unauthorized access, ensure data security, and enable data recovery.
* **NIS2**: Focuses on protecting IT systems with emphasis on service availability and resilience—requires regular audits, vulnerability management, and emergency planning.

<span id="Überschneidungen"></span>
=== Overlaps ===

* **Risk assessment**: Both require identifying threats and vulnerabilities and implementing proportionate protection measures.
* **Security measures**: Both mandate technical and organisational controls to protect data and systems.
* **Documentation**: Both require thorough documentation of risk assessments and protective measures to demonstrate compliance during audits or incidents.

GDPR and NIS2 share common ground in requiring organisations to assess risks and implement appropriate safeguards, especially when personal data is at risk due to cybersecurity incidents. Organisations covered by both frameworks must ensure their risk management strategies comply with both. While GDPR centers on personal data protection, NIS2 prioritizes IT system resilience and broader cybersecurity. Risk overlaps should be assessed for relevance across both domains.

<span id="Sanktionen"></span>
Sanctions

<span id="NIS2-Richtlinie"></span>
=== NIS2 Directive ===

The amount of fines varies depending on the classification of the entity:

* **Sanctions for essential entities**: In case of non-compliance, essential entities may face fines of up to **€10 million** or **2% of the total worldwide annual turnover**, whichever is higher.
* **Sanctions for important entities**: Important entities may be fined up to **€7 million** or **1.4% of the total worldwide annual turnover**, whichever is higher.


In addition to financial penalties, the competent authority may impose further measures:
* Issuance of binding instructions to ensure compliance with the Directive.
* Temporary suspension of business activities in case of non-compliance with orders.
* Temporary prohibition for individuals in management positions to exercise managerial functions.
* **Liability of management**: Members of the governing body (e.g. executives, directors) may be held personally liable for ensuring compliance with cybersecurity obligations.

<span id="Nationaler_Umsetzungsentwurf_(NISG)"></span>
=== National Implementation (NISG) ===

If the cybersecurity authority determines during supervision that an essential or important entity is not fulfilling its obligations under this federal law, it must proceed in accordance with § 39(1–4) NISG. 

Initially, the entity must be notified and instructed to implement specific measures or adaptations in its risk management or compliance with reporting and other obligations.

If the entity fails to comply, the authority may issue an administrative decision mandating the implementation of the necessary cybersecurity risk management measures.

If an essential entity does not comply with the decision in a timely and verifiable manner, the authority is empowered to:

* Request that competent authorities **temporarily suspend the certification or authorisation** for all or part of the relevant services or activities provided by the entity, including cybersecurity certification under Art. 58 of Regulation (EU) 2019/881;

or

* Issue a **prohibition order** against a member of the governing body of the essential entity, preventing them from carrying out managerial duties in that entity. The decision must be published in a general manner intended to reach a broad audience.

<span id="Private_Einrichtungen"></span>
=== Private Entities ===

§ 45(1–3) NISG lists administrative offences subject to the following sanctions:

* **Essential entity**: Fine of up to **€10,000,000** or **2%** of the total worldwide annual turnover of the undertaking to which the essential entity belongs, whichever is higher.

* **Important entity**: Fine of up to **€7,000,000** or **1.4%** of the total worldwide annual turnover of the undertaking to which the important entity belongs, whichever is higher.

§ 45(4) NISG outlines further offences (e.g. breaches of obligations to tolerate audits or document measures), which are sanctioned as follows:

* **Fine of up to €50,000**, and in case of repetition, **up to €100,000**.

<span id="Öffentliche_Einrichtungen"></span>
=== Public Entities ===

§ 46 NISG stipulates that non-compliance by public entities must be reported by the Federal Minister of the Interior to the competent district administrative authority, which must then issue a decision confirming the legal violation.Such decisions are to be published unless they pose a threat to public order or security. The intent behind this provision is to create **public and political pressure** through publication, as a form of sanctioning the authority concerned.<ref>326/ME XXVII. GP - Ministerialentwurf - Anlage_2 https://www.parlament.gv.at/dokument/XXVII/ME/326/fname_1621121.pdf S 42</ref>

<span id="Weiterführende_Literatur"></span>
== Further Reading ==

<span id="Überblicksartikel"></span>
=== Overview articles ===

<div lang="de" dir="ltr" class="mw-content-ltr">
* ''Burgstaller'', Aktuelle Ereignisse und Entwicklungen zum Informationsrecht, ZIIR 2023/140/2.
* ''Gutbrunner'', Pflichten aus der NIS-2-RL, LexisNexis, 05/2024.
* ''Hessel/Callewaert/Schneider'', Die NIS-2-Richtlinie aus Unternehmensperspektive, RDi 2024, 208.
* ''Löffler'', NIS-2. Ein Überblick, dako 2024, 76.
* ''Pollirer'', Checkliste NIS-2, dako 2024, 43.
* ''Schmidt'', Neue europäische Anforderungen im Cybersicherheitsrecht - die NIS2-Richtlinie im Überblick, KuR 2023, 705.
* ''Stadler/Drolz'', Cyberregeln treffen auch Lieferanten, Der Standard 2024/18/01.
* ''Staffler'', Morgendämmerung der EU-Cybersicherheit-Compliance, JSt 2023/328/4.
* ''Tretzmüller'', Die Umsetzung des NIS-Gesetzes, Report 2019, https://www.kt.at/wp-content/uploads/2019/09/31-Kommentar-Tretzm%C3%BCller_Energie-Report-Sept-2019.pdf.
</div>

<span id="Schwerpunktartikel"></span>
=== Focus articles ===

<div lang="de" dir="ltr" class="mw-content-ltr">
* ''Dittrich,'' IT-Sicherheit und Krisenresilienz bei Energieversorgern und Energieanlagen MMR 2022, 1039.
* ''Knyrim/Briegl'', NIS-2: die Anwendung im Konzern, Dako 2024/39.
* ''Neuwirth'', Vom "wesentlichen Dienst" zur "wesentlichen" beziehungsweise "wichtigen" Einrichtung - und weitere ausgewählte Aspekte zur NIS-2-Richtlinie, jusIT 2024/2/5.
* ''Reiter'', Die NIS2-Richtlinie: Von Cybersicherheit und Haftung, Medien und Recht 2023/188/4.
* ''Reiter/Heidinger/Gstrein'', Die NIS2-Richtlinie: Von Cybersicherheit und Haftung, MR 2023, 188.
* ''Schiefer/Wieser'', NIS-2-RL. Wer trägt die Verantwortung im Unternehmen? ecolex 2023/568.
* ''Wegmann'', Too much of a good thing? Erweiterung und Verschärfung von Cybersicherheitsplichten durch die NIS2-Richtlinie, BB 2023, 835.
* ''Werner'', Anwendbarkeit der NIS-2 im chemischen Sektor, DSB 2024, 175.
</div>

<span id="Einführungswerke"></span>
=== Introductory Works ===

<div lang="de" dir="ltr" class="mw-content-ltr">
* ''Kipker'', Textsammlung Cybersecurity (2023).
</div>

<span id="Sammelwerke"></span>
=== Collected Volumes ===

<div lang="de" dir="ltr" class="mw-content-ltr">
* ''Anderl'' (Hrsg), #Cybercrime. Handbuch für die Praxis (2023)
* ''Ditttrich/Dochow/Ippach'' (Hrsg), Rechtshandbuch Cybersicherheit im Gesundheitswesen (2024).
* ''Hornung/Schallbruch'' (Hrsg), IT-Sicherheitsrecht. Praxishandbuch<sup>2</sup> (2024, iE).
* ''Kipker'' (Hrsg), Cybersecurity. Rechtshandbuch<sup>2</sup> (2023).
</div>

<span id="Kommentare"></span>
=== Commentary ===

<div lang="de" dir="ltr" class="mw-content-ltr">
* ''Anderl/Heußler/Mayer/Müller'', Netz- und Informationssystemsicherheitsgesetz NISG (2019) [zum Stand der ersten NIS-RL]
</div>

<span id="Einzelnachweise"></span>
=== Sources ===