Austria · RKEG

RKEG: does your physical protection survive a real attempt?

The Critical Entities Resilience Act (RKEG) has applied in Austria since 1 March 2026. Ten months after designation, your resilience measures must be in place. A physical pentest shows first whether they hold.

  • BGBl. I No. 60/2025
  • In force since 1 Mar 2026
  • Report mapped to section 15(2)

Four zones, one way in

Section 15(2)(2) RKEG requires adequate physical protection; the explanatory notes name fences, barriers, surveillance, detection and access control. We take the route an intruder would take, zone by zone.

1

Site and perimeter

s. 15(2)(2)

Fence, gate, lighting, detection: where does someone get onto the site unseen, and does the surveillance raise the alarm?

2

Building envelope

s. 15(2)(2)

Side entrances, delivery bay, emergency exits, ground-floor windows: which door gives way without anything being damaged?

3

Reception and staff

s. 15(2)(5) and (6)

Posing as a technician, a supplier or a new colleague: does anyone ask for a badge, is tailgating noticed?

4

Critical core

s. 15(2)(2) and (3)

Control room, switchgear, server room. Do we get this far, and how long does it take for someone to react?

“Structural protective measures should be tested for practical effectiveness.” Guidelines for critical entities on section 15(2) RKEG, published by the DSN, June 2026, p. 33 (our translation)

The clock starts with the decision

  1. DecisionThe Ministry designates you as critical (s. 11).
  2. + 4 weeksName a contact point and a contact person (s. 11(5)).
  3. + 9 monthsFirst risk assessment, then at least every four years (s. 14).
  4. Your test windowThe physical pentest checks the measures before the plan.
  5. + 10 monthsMeasures and resilience plan in place, 24 h reporting duty (ss. 15, 17).
Supervision

The Ministry can request the risk assessment, plan and evidence, inspect on site after notice and order an audit (s. 20).

Fines

Up to €50,000, €100,000 if repeated, e.g. for a late risk assessment. Up to €500,000 for reporting breaches or an ignored remedy order (s. 23).

Your evidence

The test report shows with photos and timestamps that you have tested your measures, finding by finding against section 15(2).

We test and document. Risk assessment and resilience plan remain yours, and we do not provide legal advice.

The six resilience measures of section 15(2) and what a test shows

The RKEG prescribes no test method. The explanatory notes do require that measures and resilience plan are regularly checked for weaknesses.

  • Z 1

    Prevent incidents

    Including disaster risk reduction and climate adaptation. We test the intent part: does an intruder get that far at all?

    Test shows the intent part
  • Z 2

    Ensure physical protection

    Fences, barriers, surveillance, detection, access control. This is the core of a physical pentest.

    Test proves it directly
  • Z 3

    Resist and manage incidents

    Crisis management and contingency plans. We log whether and when someone notices and reports the intruder.

    Test measures the response
  • Z 4

    Continue or restore the service

    Recovery and alternative supply chains are not part of a pentest. Our findings feed into your planning.

    outside our scope
  • Z 5

    Personnel security

    Including external contractors and access rights. We test whether a fake contractor gets in without authorisation.

    Test proves it directly
  • Z 6

    Raise staff awareness

    Training for staff in critical functions. Social engineering scenarios show whether it works.

    Test measures the effect

Who is affected

Only those designated as a critical entity by official decision: active in Austria, operating critical infrastructure there and providing an essential service in which an incident can occur. Thresholds per sector are set by the RKEV ordinance (BGBl. II No. 91/2026).

Eleven sectors under the annex of the CER Directive. For the three dashed ones, the RKEG risk assessment, resilience measures and reporting duty do not apply (s. 18(3)); the NISG 2026 remains.

  • Energy
  • Transport
  • Banking
  • Financial market infrastructure
  • Health
  • Drinking water
  • Waste water
  • Digital infrastructure
  • Public administration
  • Space
  • Food: production, processing, distribution

When the Ministry of the Interior checks

On request

Submit documents

Risk assessment, resilience plan and other evidence, within a reasonable deadline (s. 20(1)).

If in doubt

Audit

If the evidence does not allow an assessment, the Ministry can require an audit by an approved resilience auditor (ss. 20, 21).

After notice

On-site inspection

The Ministry may inspect infrastructure and premises on site. You cooperate and provide competent staff (s. 20(3)).

A physical pentest is the dress rehearsal: whatever we find, you fix before an inspection turns it into a remedy order.

Frequently asked questions

Does the RKEG require a penetration test?

No, it names no specific method. But the explanatory notes require a check for weaknesses, and the DSN guidelines recommend testing structural protective measures for practical effectiveness.

No decision yet: is a test worth it now?

Yes, if you expect to be designated. From the decision, you have ten months for measures and plan. Knowing the weaknesses beforehand means planning the right measures straight away.

Does the NISG 2026 apply to us as well?

Yes. Under section 24(1)(1)(f) NISG 2026, critical entities count as essential entities regardless of size. On request we test site and network in one engagement.

Is this legal and safe for operations?

Yes. It is based on a written test authorisation with an emergency contact. We force nothing open, switch off no security systems and do not disrupt operations.

How far would someone get onto your site?

A 30-minute initial consultation, free of charge. We clarify sites and scope, then you receive a fixed-price quote.

Book a consultation Send an enquiry
hello@access-granted.de
+49 9281 5918506
Service: access-granted.de/en/pentest/physical

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: October 20, 2026