Austria · NISG 2026

NISG 2026: test your defences before attackers do.

Austria's NISG 2026 has applied since 1 October 2026, with no transition period for the risk management measures. You must assess their effectiveness, and from October 2028 the authority can demand evidence.

  • BGBl. I No. 94/2025
  • In force since 1 Oct 2026
  • Report mapped to section 32

From the law to the pentest: three levels

The words penetration test do not appear in the statute. They appear where the law gets specific.

  1. Section 32(4)(f) NISG 2026

    Assess effectiveness

    Policies and procedures to assess the effectiveness of your risk management measures.

    What the test deliversEffectiveness measured by outcome: what holds and what fails.
  2. Section 2 NISV 2026 · Annex to Reg. (EU) 2024/2690, point 6.5

    Security testing

    Via the ordinance, the EU annex applies to all entities: plan tests by risk, run them to a documented methodology, record the results, remediate critical findings.

    What the test deliversDocumented methodology, every finding with criticality and remedy.
  3. Explanatory notes on section 33 NISG 2026

    Technical audit

    Per the explanatory notes: inspection of configurations plus a penetration test that emulates real attackers. An “assumed breach” is always covered.

    What the test deliversA test along exactly these lines, before the request arrives.

Under section 33(2), ISO 27001 only evidences operational and organisational implementation, not technical.

What applies when

  1. 1 Oct 2026In force, no transition period for measures and reporting duties.
  2. + 3 monthsRegistration with the Federal Office for Cyber Security (s. 29).
  3. + 12 monthsSelf-declaration of the measures implemented (s. 33(1)).
  4. from 10/2028Evidence via an independent body can be demanded (s. 33).
Fines

Essential entities up to €10m or 2% of worldwide turnover, important entities up to €7m or 1.4%, whichever is higher (s. 45).

Management

Management must ensure and oversee the measures and take training itself (s. 31). Essential entities risk a temporary ban on exercising management functions (s. 39).

Your evidence

Report with methodology, findings by criticality, mapping to section 32 and a remediation plan, a basis for self-declaration and evidence.

Registration, self-declaration and the section 33 audit report remain yours, and we do not provide legal advice.

What we test, following the notes on section 33

From the outside

What an attacker sees from the internet: perimeter, web applications, VPN, email. We derive the scope from your risk analysis.

Assumed breach

We start with an ordinary user account on the internal network and show how far it reaches towards the domain and your critical services.

Configuration

Hardening, permissions and the principle of least privilege, checked on the systems that carry your service.

Who is affected

Essential entities

  • Large companies in the 11 sectors of Annex 1: at least 250 employees, or over €50m turnover and over €43m balance sheet.
  • Regardless of size, among others: critical entities (RKEG), DNS service providers, TLD registries, qualified trust service providers, federal administration.

Important entities

  • Medium-sized companies in Annex 1, plus large and medium-sized ones in the 7 sectors of Annex 2: at least 50 employees, or over €10m turnover and over €10m balance sheet.
  • Audits only where there are indications of breaches (s. 38(2)). The self-declaration still applies.

The authority supervises essential entities without cause as well (s. 38(1)). Not covered are, among others, municipalities, schools and universities.

Section 32(4): ten measures, a test checks six of them

The law requires an all-hazards approach protecting network and information systems including their physical components.

  • aRisk analysis and information system security
  • bHandling of cybersecurity incidents
  • cBusiness continuity, backup, crisis management
  • dSupply chain security
  • eSecurity in acquisition, development and maintenance, vulnerability handling
  • fAssessing the effectiveness of the measures
  • gCyber hygiene and training
  • hCryptography and encryption
  • iHuman resources security, access control, asset management
  • jMulti-factor authentication, secured communication

Pentest proves it directly Test measures it too: detection, phishing simulation

Reporting duties for significant incidents (s. 34)

24 h

Early warning to the sectoral CSIRT, or to the national CSIRT where there is none.

72 h

Notification of the cybersecurity incident to the same body.

1 month

Final report, counted from the 72-hour notification.

The pentest shows whether and when your monitoring raises the alarm, and so whether these deadlines hold in an emergency.

Frequently asked questions

Does the NISG 2026 require a penetration test?

Not in the statute. It requires effectiveness to be assessed (s. 32), the ordinance requires security tests, and the explanatory notes describe the technical audit under section 33 as a penetration test.

We are ISO 27001 certified. Is that enough?

The certificate can serve as evidence for the organisational and operational side. Section 33(2) excludes technical implementation from this; it has to be audited.

When should we test?

The measures have applied since 1 October 2026. A test before the self-declaration makes sense: you then report measures in place instead of open gaps.

How often do we have to test?

The law sets no fixed interval. Frequency and scope follow your risk analysis (Reg. 2024/2690, Annex point 6.5.2). For evidence, the audit may be no more than two years old.

How far does an attacker get in your network?

A 30-minute initial consultation, free of charge. We clarify scope and priorities, then you receive a fixed-price quote.

Book a consultation Send an enquiry
hello@access-granted.de
+49 9281 5918506
Service: access-granted.de/en/pentest/nis2

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: October 20, 2026