Services
NISG 2026 and NIS2 for industrial companies in Austria
Austria's NISG 2026 expands cybersecurity duties for many essential and important entities. Whether your company is affected depends not only on revenue or headcount, but also on sector, actual activity, group structure, and statutory special cases. Solvetronix combines regulatory scope assessment with technical implementation in OT, embedded systems, IoT, and industrial IT.
Who is affected
Essential and important entities: sector and activity matter
Essential entities
Typically higher criticality, stricter oversight, and stronger management exposure.
- Energy, transport, healthcare, digital infrastructure, water, waste, public administration
- Industrial companies with critical dependencies or essential services
- Group or platform functions may matter even if production is only one part of the corporate structure
Important entities
Often manufacturers, OEMs, integrators, or service providers with a NIS2-relevant role.
- Manufacturing, machinery, electronics, digital services, and specialised suppliers
- Classification depends on the actual service, not just the label "industrial company"
- OT, IoT, remote access, and supply-chain position increase regulatory relevance
[SME REVIEW REQUIRED] Employee and financial thresholds must be verified against the current Austrian NISG 2026 text
Do not rely on old NIS2 summaries or generic EU slide decks. For Austrian scope assessment, headcount, turnover, balance sheet metrics, group structure, and sector-specific rules must be checked in the then-current legal text and implementation guidance.
Special cases
Exceptions and scope drivers can apply independently of company size
Exceptions independent of size
Some entities can be covered even without the classic SME/large-company logic when function, criticality, or statutory special status triggers inclusion.
Group and supply-chain role
Central IT, remote-service, platform, or security functions within a group may matter more than a single local site.
Actual activity
What matters is what your company really operates, manufactures, or secures, not just the commercial register wording or marketing label.
Management duties
Management must understand, decide, and evidence cyber risk treatment
- Establish and document scope assessment
- Approve risk-management measures and follow implementation
- Define ownership, escalation, and incident decisions
- Ensure evidence suitable for oversight, customers, and internal review
Risk management
Cyber risk-management measures for OT, IoT, embedded, and industrial IT
Risk analysis
Asset scope, threats, vulnerabilities, dependencies, and prioritisation.
OT/IoT hardening
Remote access, segmentation, secure defaults, patching, and update paths.
Embedded & edge
Firmware security, identities, secure update chain, and device inventory.
Supply chain
Third-party access, component risks, supplier duties, and dependencies.
Incident response
Detection, escalation, recovery, and evidence preservation for the Austrian reporting process.
Evidence
Policies, technical artefacts, management decisions, and audit trail.
Incident reporting
Austrian NISG reporting process: build the runbook before the incident
1. Qualify the incident
Decide whether it is a reportable cybersecurity incident under the current Austrian NISG regime or an internal disruption only.
2. Trigger escalation
Management, OT/IT, legal, communications, and group security should work from the same situation picture.
3. Preserve evidence
Secure logs, affected assets, supply-chain relevance, operational impact, and immediate containment measures in a structured way.
4. Report via Austrian process
Recipients, content, and deadlines must match the current NISG text, RIS publication, and competent authority/CERT workflows.
Practical note
Do not copy CRA-style 24h language into your NISG process. Austrian NISG reporting must follow the current Austrian legal text, competent recipients, and classification logic.
NISG vs CRA
Entity obligations versus product obligations
| NISG / NIS2 (entity level) | CRA (product level) |
|---|---|
| Duties for covered entities and their operating organisation | Duties for products with digital elements and their manufacturers |
| Focus on governance, resilience, reporting process, and risk treatment | Focus on security by design, SBOM, vulnerability management, and product documentation |
| OT, industrial IT, remote access, service providers, and processes are central | Firmware, software components, update mechanisms, and product scope are central |
| Relevance follows from the entity, sector, and activity | Relevance follows from product type, market role, and technical classification |
NISG vs MRO
Operational resilience versus machinery conformity
| NISG / NIS2 (operations and resilience) | Machinery Regulation (product safety and CE) |
|---|---|
| Assesses whether the entity can manage cyber risk and report incidents | Assesses machine safety and functions for CE/conformity |
| Relevant for operators, OEMs, service providers, or group functions depending on classification | Relevant for manufacturers and market actors of machinery and safety components |
| Covers organisation, processes, access, supply chain, and resilient operations | Covers risk assessment, safety functions, technical documentation, and substantial changes |
| Technical measures must work in real OT/IT environments | Technical and functional safety must be evidenced for CE |
Solvetronix modules
Eight modules from scope assessment to technical implementation
1. Scope assessment
Check sector, activity, group structure, and Austrian special cases.
2. Asset and process scope
Define OT, IoT, embedded, remote maintenance, suppliers, and operational processes.
3. Cyber risk analysis
Prepare critical risks, business impact, and priorities for management and engineering.
4. Supply-chain review
Assess remote access, third parties, component dependencies, and operator dependencies.
5. Governance and ownership
Define management duties, roles, approvals, and escalation in a defensible way.
6. Incident runbook
Build Austrian reporting workflow, internal escalation, evidence preservation, and communications.
7. OT/embedded/IoT hardening
Implement practical controls for devices, networks, remote access, and update paths.
8. Evidence and management briefing
Document evidence, implementation status, and decisions in a review-ready format.
FAQ
Typical questions from Austrian industrial companies
Are we automatically out of scope if we count as an SME?
No. Under NIS2/NISG, sector, actual service, group role, and statutory special cases can matter more than a generic SME label. That is why we explicitly mark thresholds as [SME REVIEW REQUIRED].
Is an office-IT security concept enough?
Usually not. Industrial environments require OT, embedded devices, remote maintenance, operator processes, and supply-chain realities to be addressed in practice.
Is NISG the same as CRA?
No. NISG/NIS2 assesses the entity and its operational resilience. CRA assesses digital products and manufacturer duties. Many industrial companies need both layers in parallel.
When should management be involved?
At the start. Scope assessment, prioritisation, budget, escalation, and evidence cannot be solved by engineering alone.
Background and guidance
Need a clear Austrian NISG path?
We combine scope assessment with practical OT, IoT, embedded, and industrial-IT measures.
Check NISG scope and technical maturity