In 2026, too, cyberattacks will remain the number one business risk for companies of all sizes, as demonstrated, amongst other things, by the Allianz Risk Barometer 2026. Critical IT services and data processing services are the targets of such attacks. This often results in disruption across the entire supply chain, which in some cases can even affect entire sectors.
Cybersecurity – including within the supply chain – therefore remains, quite rightly, a key focus for legislators. Austria has only just – at long last, after a significant delay – passed its national NIS 2 implementation act. But no sooner has the Act been introduced than an amendment is on the horizon: last week, the European Commission presented a proposal to amend the Cybersecurity Act (CSA) and the NIS 2 Directive (see here). The focus is on (i) the creation of a European cybersecurity certification framework to facilitate cross-border activities, (ii) the strengthening of the European Union Agency for Cybersecurity (ENISA), (iii) an amendment to NIS-2, and (iv) supply chain security in critical sectors. Your DORDA cybersecurity experts have summarised the key points of the new draft for you and evaluated them in light of the current status of implementation of the cybersecurity regulation:
CSA-2 package
No sooner has Austria enacted its NIS-2 Act (see here for the NISG 2026) than an adaptation is already on the way. The following practical adjustments are currently being considered in Brussels:
- The size criteria are to be adjusted and a new category of mid-cap companies introduced in order to ease the burden on SMEs.
- Clarifications and restrictions in the energy, chemicals and healthcare sectors.
- Member States should be required to prepare for the post-quantum computing era and to adopt appropriate policies to this end.
- The aim is to strengthen the exchange of information on ransom demands and payments in the context of ransomware attacks.
The Commission is also (once again) addressing a (geo-)political issue: there are to be restrictions on high-risk suppliers from third countries where there are cybersecurity concerns. The aim is to reduce dependencies on and influence from outside the EU. Once again, the focus is on the telecoms sector.
The so-called CSA-2 package is a proposal from the Commission which still needs to be approved by the Council and the Parliament. It remains to be seen how many of the changes will make it through.
Current Need for Action
It is becoming clear that the issue of cyber security remains a key focus for the legislator. The (regulatory) authorities are now also looking more closely at this issue. Companies should therefore now begin preparing for the range of obligations set out in (i) NISG 2026 and (ii) Cyber Resilience Acts (CRA; see our newsletter here). The insights shared publicly at information events by the department within the Ministry of the Interior responsible for network and information security – which will form the new Federal Office for Cybersecurity – are helpful in this regard:
- Assessing the applicability of the NISG 2026 is a task for legal experts, not for IT departments or CISOs. According to official estimates, thousands of companies in Austria will fall within its sphere of application. In-house IT service providers will generally fall under the NISG 2026 as managed service providers. Incorrect classification may result in administrative penalties.
- The new Federal Office for Cyber Security is due to be established in the first half of 2026. This will then provide the central authority.
- Companies subject to this requirement must register with the authority within three months. Registration will take place via the Business Service Portal; the form is currently being developed.
- The authority will provide a questionnaire for the self-declaration to be submitted by companies – that is, the ‘self-assessment’ on the status of risk management. In this way, the authority aims to gain an indication of the progress made in implementation.
- The national regulation setting out the details of risk management will be closely modelled on the Commission’s implementing regulation.
- In addition, a number of guidelines and further advice were announced
Cyber supply chain security, as addressed in the CSA-2 package, is by no means just a future dream: it is an integral part of the NISG 2026 and the CRA. Particularly in the case of long-term contracts, there is therefore an urgent need for companies to take action now in order to implement the requirements in good time and avoid liability issues. To this end, contracts with suppliers, IT service providers and customers must be renegotiated and supplemented.
Conclusion & Outlook
Given the prospect of heavy criminal penalties, potential management liability and the risk of being excluded from the market, early, comprehensive and well-documented preparation is essential. The key steps are:
