# NISG 2026: scope, actions and evidence

Working template by AppWebSeo. Research checked on 21 October 2026.
This template supports preparation. It does not replace individual legal advice, an administrative decision or independent statutory verification.

## Entity and responsibility

- Legal entity:
- Accountable management member:
- Internal lead and substitute:
- IT/security owner:
- Legal adviser / open legal questions:
- Preparation and next-review dates:

## Evidence for the scope assessment

| Check | Finding | Evidence | Open issue | Owner |
|---|---|---|---|---|
| Jurisdiction under section 28 |  |  |  |  |
| Exact entity type in Annex 1/2 |  |  |  |  |
| Staff / annual work units |  |  |  |  |
| Turnover / balance sheet / accounting periods |  |  |  |  |
| Partner and linked enterprises |  |  |  |  |
| Evidence for section 25(4) independence |  |  |  |  |
| Size-independent service or designation |  |  |  |  |
| Domain-registration services |  |  |  |  |
| DORA / equivalent sector rules |  |  |  |  |
| Public-sector/exclusion rules |  |  |  |  |

Preliminary classification:

- [ ] Essential entity
- [ ] Important entity
- [ ] Separate domain-registration provider duties
- [ ] Indirect customer/supply-chain requirements
- [ ] No direct coverage indicated after documented assessment
- [ ] Unresolved; do not infer an exemption

Date criteria were met: ____________________
Professional/legal confirmation: ____________________

## Dates and filing

For entities already covered on 1 October 2026, the BCS registration page gives 4 January 2027 as the latest initial registration day. Later entry generally creates a three-month period from meeting the criteria. Check the individual situation.

For the initial essential/important cohort, BCS gives 30 September 2027 for self-declaration. For later entry, the general twelve-month period starts when the registration duty arises, not when registration is actually submitted.

| Task | Individual date / trigger | Owner | Substitute | Submission evidence |
|---|---|---|---|---|
| Registration and register data |  |  |  |  |
| USP / ID Austria / permissions |  |  |  |  |
| Changes to registered information |  |  |  |  |
| Governance / management training |  |  |  |  |
| Self-declaration, where applicable |  |  |  |  |
| Review of detailed regulatory requirements |  |  |  |  |

## Critical systems and dependencies

| System/service | Business function | Data/dependencies | Operator | Critical access | Recovery objective | Evidence status |
|---|---|---|---|---|---|---|
|  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |

## Action plan

Every action needs a system boundary and a testable acceptance criterion. These are working areas, not a complete legal audit catalogue.

| Area | Risk/finding | Action | Evidence/test | Owner | Date | Status |
|---|---|---|---|---|---|---|
| Risk analysis/security policy |  |  |  |  |  |  |
| Incident management |  |  |  |  |  |  |
| Backup/recovery/crisis management |  |  |  |  |  |  |
| Supply chain |  |  |  |  |  |  |
| Procurement/development/maintenance |  |  |  |  |  |  |
| Effectiveness reviews |  |  |  |  |  |  |
| Cyber hygiene/training |  |  |  |  |  |  |
| Cryptography/encryption |  |  |  |  |  |  |
| Personnel/access/assets |  |  |  |  |  |  |
| MFA/secure communications |  |  |  |  |  |  |

## Rehearse the incident path

- Competent CSIRT and official reporting channel:
- Significance decision and relevant NISV/sector rules:
- Who records the awareness timestamp?
- Who reports, and who substitutes?
- What evidence is preserved?
- Which customers/other authorities may need information?
- What happens if USP is unavailable? Check official alternative channels.

General NISG timetable for significant incidents: act without delay; early warning within 24 hours, notification generally within 72 hours of awareness. Trust services have a special 24-hour notification rule. Final report normally within one month after notification; ongoing handling requires progress/final reporting under the applicable rules. Assess DORA and other reporting duties separately.

## Define the technical engagement

- Included systems/environments:
- Authorised access and test methods:
- Excluded services:
- Required inputs and contacts:
- Intended changes:
- Acceptance criteria/evidence:
- Handover and recurring tasks:
- Open legal questions:
- Independent assessor, if required:
- Budget decision and next meeting:

## Primary sources

- [NISG 2026 in RIS](https://ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20013065)
- [NISV 2026 in RIS](https://ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20013307)
- [BCS registration](https://www.bundesamt-cybersicherheit.gv.at/303/registrierung.html)
- [BCS incident deadlines](https://www.bundesamt-cybersicherheit.gv.at/303/meldepflicht-und-fristen.html)
- [BCS evidence](https://www.bundesamt-cybersicherheit.gv.at/faq/nachweise.html)