Putting NIS2 into practice

That depends mainly on sector and size. Directive (EU) 2022/2555 covers entities in 18 sectors listed in Annexes I and II, usually from medium size upwards: 50 or more staff, or annual turnover and balance sheet total both above EUR 10 million. Some entities are covered regardless of size. National law is decisive; in Austria, that is the NISG 2026. The binding assessment is for you and your legal adviser; we support the technical implementation.

The NISG 2026 is Austria's transposition of NIS2. It was published as BGBl. I Nr. 94/2025 and has been in force since 1 October 2026. Entities in scope must implement risk-management measures, report significant incidents on time and ensure their management bodies take responsibility. Specific obligations such as registration and deadlines follow from the text of the act; have them checked by a legal adviser. For sites in other EU member states, the local transposition act generally applies.

For significant incidents, Art. 23 NIS2 sets three stages: an early warning without undue delay and at the latest 24 hours after becoming aware, an incident notification at the latest 72 hours after becoming aware with an initial assessment, and a final report at the latest one month after the notification. Reports go to the CSIRT or the competent authority. That only works if incidents are detected and evidenced quickly; ACDC's 24/7 monitoring and a managed SIEM with central logs help here.

Art. 21(2) lists ten minimum areas: risk analysis and information system security, incident handling, business continuity with backup and crisis management, supply chain security, security in acquisition, development and maintenance including vulnerability handling, assessing effectiveness, cyber hygiene and training, cryptography, human resources security with access control and asset management, and multi-factor authentication and secured communications. The measures must be appropriate and proportionate.

snapSEC takes on key technical parts of the implementation. blacklens.io continuously shows your attack surface, vulnerabilities and supply chain risks. ACDC – Active Cyber Defense Center monitors your environment around the clock and supports incident handling. Our consultants test effectiveness with penetration tests, red teaming, phishing simulations and cloud security assessments, and can run a managed SIEM for you. Organisational tasks such as policies, contingency plans and training concepts remain with you.

No. This page and our services provide technical guidance, not legal advice. snapSEC does not carry out audits and does not issue certificates or confirmations of compliance. Which obligations apply to your company, whether you count as an essential or important entity, and how you register and report incidents are questions for your legal adviser, your auditor or the competent authority. We implement technical measures and deliver results you can include in your documentation.

Management bodies carry the responsibility themselves. Under Art. 20 NIS2 they approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Their members must also follow training so that they can identify risks and assess cybersecurity risk-management practices. Operational implementation can be delegated; management's accountability remains. How the NISG 2026 regulates liability in detail is something to have checked by a legal adviser.

Directly only if the supplier is itself in scope. Indirectly, often yes: Art. 21 requires entities in scope to address the security of their supply chain, including their relationships with direct suppliers and service providers. That is why many companies pass security requirements on to their suppliers by contract. blacklens.io helps on both sides, for example by monitoring suppliers for ransomware leaks and keeping a continuous view of your own attack surface.