NISG 2026 is now in effect.
What does that mean for your company?

NISG 2026 implements the European NIS2 Directive in Austria. Compared with the previous framework, it significantly expands the number of organizations subject to cybersecurity requirements.

The rules cover companies and organizations across several sectors, including energy, transportation, healthcare, digital infrastructure, and parts of manufacturing.

Company size also matters. As an initial guideline, companies in relevant sectors with at least 50 employees or annual revenue above €10 million should examine whether they fall within the scope.

These thresholds alone don't provide a definitive answer.

Smaller companies can also be covered under certain conditions. Companies outside the direct scope may face additional requirements from customers that are regulated. Supply chains and dependencies on external service providers are an important part of the framework.

A reliable assessment therefore needs to consider the company's sector, size, role, and specific circumstances.

Once a company has established that NISG applies, attention turns to its technical environment.

That includes identifying systems essential to business operations, documenting where relevant data is stored and processed, and understanding the interfaces connecting IT, operational technology (OT), cloud services, and external providers.

Responsibilities for monitoring, incident response, and recovery also need to be clear.

In an IT or production environment that has developed over many years, this can be difficult.

A production system may depend on several databases, an ERP system, an external API, and infrastructure maintained by different teams or providers. Documentation often exists, but it may no longer reflect the current system landscape.

These dependencies need to be understood before the associated risks can be assessed and managed.

Preparing for NISG 2026 starts with an inventory of existing systems, processes, and information.

Many companies already have documentation, monitoring tools, incident response procedures, and reporting structures. The first step is to understand how complete and reliable these are.

For example, system documentation may exist in several departments while incident reports are stored in separate tools. Management reporting may require employees to manually combine information from different sources.

Bringing these existing sources together can provide a useful foundation for further measures.

We encounter similar challenges in our industrial data projects. Companies collect large amounts of information from machines, databases, business applications, and individual tools. Using this information reliably requires consistent data structures and dependable connections between systems.

This is where Data Engineering can support NISG readiness.

A reliable data foundation helps companies understand their systems, interfaces, and dependencies. It also makes the information needed for monitoring and reporting more accessible.

An inventory establishes which systems exist and how they are connected. Continuous monitoring provides information about their current condition and behavior.

Centralized monitoring can combine operational, technical, and security-related signals from IT infrastructure and operational technology.

For employees investigating an incident, the useful information includes which system is affected, how the problem relates to other systems, and whether action is required.

An alert without this context may create additional investigation work.

Methods such as anomaly detection can help identify unusual patterns in large volumes of operational data.

An unusual pattern does not automatically indicate a cybersecurity incident. It can, however, provide an early signal that a system or process requires closer examination.

We already use anomaly detection in industrial applications to identify unusual patterns and critical events in data.

Supply-chain dependencies deserve particular attention.

Cloud providers, software vendors, technology partners, managed services, and other suppliers can all contribute to business-critical processes.

Our NISG Readiness Check therefore considers IT, OT, and cloud dependencies alongside requirements affecting the supply chain.

Companies outside the direct scope of NISG 2026 also need to understand these relationships.

A regulated customer may request additional documentation, security information, or evidence of how critical services are operated.

This means a company's obligations and business requirements can also be influenced by the regulatory responsibilities of its customers.

Cybersecurity risks require management attention, particularly when they affect essential business processes.

Management needs a reliable overview of relevant risks, ongoing measures, responsibilities, and dependencies.

Technical monitoring systems often contain much more information than is useful for these decisions. The challenge is to make the relevant findings accessible and understandable.

Dashboards, automated reporting, and clearly assigned responsibilities can help.

For example, management reporting could show which critical systems are covered by monitoring, whether unresolved incidents exist, and how agreed measures are progressing.

Ideally, this information comes directly from the systems and processes used in daily operations. Automated data collection can reduce the manual effort required to prepare reports and supporting evidence.

The technical work required for NISG readiness differs between companies.

One organization may lack a complete overview of its systems and interfaces. Another may have fragmented monitoring across IT and OT. In a third, the necessary information exists, but management reporting and evidence collection still involve substantial manual effort.

We recommend starting with an assessment of the existing environment.

A useful assessment provides a clear picture of the current situation, identifies relevant gaps, and establishes priorities for further action.

Some measures will involve organizational responsibilities and procedures. Others will require technical changes.

We help with the technical part.

We provide technical and operational services rather than legal advice. Our NISG Readiness Check does not replace an independent audit or certification.

We help companies understand their data and system landscape and establish the foundations for monitoring, data management, automation, and reporting.

In complex IT, OT, production, and platform environments, this can result in a technical roadmap with concrete measures that the responsible teams can implement.

If you're still assessing whether NISG 2026 applies to your company, or already know that it does but need a clearer picture of your operational readiness, begin with your current systems and processes.

Our NISG Readiness Check covers system transparency, data flows, IT/OT/cloud dependencies, monitoring, risk and escalation processes, management reporting, supply-chain requirements, and automation opportunities.

The result is a prioritized action plan with concrete next steps.

START YOUR NISG READINESS CHECK