Skip to content

Key questions & compliance details on e-mail security

Detailed expert information

A complete overview of NIS2, the legal framework and technical protection standards for companies in Austria.

NIS2 & NISG in Austria: legal obligations

In Austria, the European NIS2 Directive is transposed by the Network and Information Systems Security Act 2026 (NISG 2026), in force since 1 October 2026. It obliges affected companies to take specific cybersecurity measures.

  • Obligation to take risk management measures in the area of ICT security.
  • E-mail authentication (SPF, DKIM, DMARC) is recommended as a protective measure by ENISA and BSI, among others, and is an important building block for securing communication.
  • Strict obligations to report significant security incidents to the Federal Office for Cybersecurity or the competent CSIRT.
Sanctions, fines & management responsibility

Under NIS2 and the national transposition laws, management bodies are responsible for compliance with cybersecurity regulations.

  • Essential entities: fines of up to €10 million or 2 % of worldwide annual turnover (whichever is higher).
  • Important entities: fines of up to €7 million or 1.4 % of worldwide annual turnover (whichever is higher).
  • Due diligence requirements for management when organising IT security standards.
  • Risk of breaching cyber insurance obligations as a result of inadequate protective measures.
Our audit & implementation roadmap (steps 1 to 3)

Step 1 (executive as-is analysis): Complete check of all existing DNS records (SPF, DKIM, DMARC) and identification of all external service providers.

Step 2 (professional implementation): Step-by-step activation (phase A: monitoring/p=none → phase B: optimisation/p=quarantine → phase C: protection/p=reject) to keep mail traffic running smoothly.

Step 3 (technical reports & evidence): Provision of technical reports and documentation to support NIS2, TISAX, supply chain audits and insurance.

Industry-specific requirements in Austria (banks, critical infrastructure, automotive and more)
  • Banks & financial services: Directly subject to the FMA and the Digital Operational Resilience Act (DORA).
  • Critical infrastructure & energy: Statutory reporting obligations and high security standards under NISG 2026.
  • Automotive & suppliers: Frequently contractually required TISAX® labels and evidence of holistic information security.
  • Healthcare & pharma: Protecting highly sensitive patient data and confidential communication.
  • Construction & trades: Defending against CEO fraud and invoice fraud.
  • SMEs & retail: Meeting EU supply chain laws and protection against spam filters.

Important notice & disclaimer (no legal advice)

The content, analyses and audit reports provided on this website serve exclusively as general information about technical security standards (such as SPF, DKIM, DMARC) and related regulatory frameworks (including NIS2 and the GDPR). They expressly do not constitute legal, tax or official compliance advice and cannot replace individual advice from qualified lawyers or specialised experts. Although prepared with care, we accept no liability for the accuracy, completeness or timeliness of the regulatory information presented. Liability is excluded to the extent permitted by law; this does not apply in cases of intent or gross negligence or to personal injury. The operators of linked external websites are solely responsible for their content; no legal violations were apparent at the time of linking.