NIS2 directive: what organisations need to know about cyber security

With the Network and Information Security Act 2026 (NISG 2026), Austria’s implementation of the NIS2 Directive, security measures and incident reporting obligations are becoming legally binding. From 1 October 2026, organisations within scope must be able to demonstrate that cyber security is managed in a structured, documented and continuous way. For many, this goes far beyond a technical challenge. It requires organisational change that questions and reshapes existing structures.

Before discussing implementation steps, it is worth taking a closer look at the requirements and how they evolved.

What is NIS2 and why does it exist?

The original NIS Directive (Network and Information Security) was introduced in 2016 to harmonise cyber security for critical infrastructure across the EU. It was the first attempt to define minimum cyber security standards at EU level. Over time, however, it became clear that its scope was too limited. The threat landscape had changed, and the directive had become outdated. Cyber attacks grew more sophisticated, organisations more interdependent, and supply chains more deeply interconnected.

In response, the EU fundamentally revised the directive in 2022 and expanded it into what is now known as NIS2. Its aim is to reduce regulatory differences between member states and limit room for interpretation.

NIS2 has been in force across the EU since January 2023 and obliges all member states to transpose it into national law. Although the deadline for implementation was 17 October 2024, most member states missed it. In Austria, transposition is taking place through the NISG 2026.

While EU‑wide minimum standards apply everywhere, national details differ slightly. For internationally active organisations, this means complying with European baseline requirements while also addressing country‑specific rules.

What changes with NIS2 and the NISG 2026?

NIS2 is not just another security guideline — it represents a significant expansion and tightening of existing requirements.

Who is affected?

Cyber security is particularly critical for sectors such as energy, transport, water, healthcare and public administration. Failures here can have severe societal consequences. A power outage, a disrupted wind farm or halted rail traffic affects entire regions, not just individual companies.

However, NIS2 also affects organisations outside officially designated critical infrastructure. Many act as suppliers or service providers to critical systems. A vulnerability in a smaller organisation can have far‑reaching consequences. Cyber security therefore extends beyond internal systems and always forms part of a broader ecosystem.

Cyber security operates on three levels

According to cyber security expert Mag. Walter Sedlacek, MSc, MBA, sustainable cyber security rests on three levels: technology, processes and organisation. Only by addressing all three can a resilient security architecture be achieved. Too often, organisations focus mainly on technology while underestimating the importance of processes and organisational structures.

1. Technology

Firewalls, encryption, authentication and monitoring are essential — they form the technical foundation. But technology alone is insufficient. It only protects what it covers. Even state‑of‑the‑art security infrastructure becomes ineffective if organisational or process‑related gaps exist. Many organisations invest heavily in technology while overlooking other attack vectors.

2. Processes

Many successful cyber attacks exploit processes rather than systems. Processes often evolve uncontrolled and are rarely reviewed from a security perspective.

An example from one project illustrates this clearly: a security consultant was tasked with obtaining sensitive salary data within one hour. No one believed it possible — SAP was well protected. Yet within ten minutes, the data was accessed. The consultant did not attack the technical system. Instead, he analysed the process and assumed the executive assistant had access. He was right. The salary data was stored in an unprotected Excel file on the assistant’s laptop used prior to system entry.

Such cases are not exceptions but surprisingly common. Security gaps frequently arise when processes are unclear, overly complex or undocumented.

3. Organisation

Cyber security is only as strong as its weakest link. Even the best technology and processes fail if responsibilities are unclear. In many organisations, cyber security sits “somewhere in IT”, while no one truly feels accountable.

Cyber criminals exploit this deliberately, increasingly relying on social engineering rather than technical attacks. They target people — the weakest link in the security chain — by impersonation or exploiting trust.

In one example, an actor was hired as an employee. His credentials were never verified. Within days, through conversations, visible passwords and careless information sharing, he obtained access to sensitive security‑relevant information. Again, the failure was organisational, not technical.

Cyber security is only as strong as its weakest link

The NISG 2026 highlights just how tightly technology, processes and organisation are intertwined — and how vulnerable organisations can be at these interfaces. Complex supply chains, increasing dependencies, growing use of AI and professionalised cyber attacks are no longer abstract risks.

Those who act early gain time to understand their security posture. Those who wait are forced to react under pressure — increasing the likelihood of mistakes. Last‑minute compliance measures may be formally correct but practically ineffective.

Our conclusion: Cyber security does not result from isolated actions or protecting individual departments. It is a cross‑organisational initiative — and the greatest weaknesses usually lie not in technology, but in processes and organisational structures.