NISG 2026 Software: Impact, Registration, Self-Declaration.
digi4risk guides you through the law in the order in which the deadlines appear—and files the required documentation exactly where the authorities will need to see it later. Software and consulting from Pressbaum, since 1992.
Five questions. An initial result.
The NISG 2026 covers essential and critical facilities of medium size and larger across 18 sectors—and, indirectly, their suppliers. This checklist provides guidance; we perform the binding classification during the initial consultation.
Ten Minimum Measures—and Where They Fit into the System.
digi4risk operates in a process-driven manner: You document what you do; the system then determines which requirements for which standards have been met. A single documentation entry satisfies NISG 2026, ISO 27001:2022, and IT-Grundschutz simultaneously.
- Risk Analysis and Security Concepts: Risk Register in accordance with ISO 27005 / BSI 200-3, Statement of Applicability, Action Plan.
- Incident Response: Incident Workflowwith Deadlines of24 hours / 72 hours / 1 month; Draft Report for the Cybersecurity Authority.
- Business Continuity, Backup, Crisis Management, Emergency Plans, Recovery Tests, Responsible Parties, and Contact Information.
- Supply Chain Security: Suppliers from the CRM, questionnaires, risk assessment, contract documentation.
- Acquisition, Development, Maintenance – Vulnerability Management: Asset Registry, Patch Records, Vulnerability Tickets.
- Effectiveness Assessment: Internalaudits, key performance indicators, and management reviews—automatically compiled from the modules.
- Cyber Hygiene and Training: Training module with certification for each individual—including for management in accordance with Section 31.
- Cryptography and Encryption: Policy Lifecycle, Including Approval, Versioning, and Acknowledgment.
- Employee Security, Access Control, Asset Management: Hiring, Transfer, and Termination as a Checklist with Revocation of Authorization.
- MFA and Secure Communication: Evidenceof implementation for each system, including exceptions with justification and procedures.
From Feeling Affected to Self-Declaration.
Registration is a formality that requires seven pieces of information. The self-declaration submitted twelve months later is not a mere formality: it requires information on network and information systems, the supply chain, and risk analysis. Those who keep records of the supporting documentation on an ongoing basis can generate the declaration with the click of a button.
Week 1
Certification Review: Impact, Gaps, Action Plan. Findings for Management.
Weeks 2–4
Installation, importing assets and suppliers, assigning responsible parties, and training management.
Through December 31, 2026
Register using the seven pieces of information specified in § 29; designate a contact person.
Ongoing
Record evidence, report incidents, conduct an annual review. Self-declaration based on existing records.
Not affected—but in demand.
Affected organizations must secure their supply chains and obtain documentation from IT service providers, software vendors, and maintenance companies. The law does not require a certificate, but it does require a reliable, up-to-date response.
Light Verification
Self-assessment, list of actions, points of contact, responsibilities. To be completed in a few days.
Customer Surveys
Import a questionnaire, answer questions from the existing list, and export as a PDF or spreadsheet.
No system change
If ISO 27001 is required later on, the existing system will remain the same—only the scope will expand.
With Your IT Partner
Your IT service provider can operate digi4risk as a partner—or we can do it.
Management bears personal responsibility.
Management bodies must approve and monitor risk management measures and participate in cybersecurity training. Violations may result in fines of up to €10 million or 2% of revenue; organizational violations, such as failure to register, may result in fines of up to €50,000.
Training with Certification
Participation and content are included in the training module—available in the audit.
Approval Documented
Approval of policies and risk management, including the date and the person responsible.
Dashboard for Management
Status of measures, outstanding risks, deadlines—without technical jargon.
Management Review
The annual report is compiled from all modules.
Three paths, one system.
ISMS Operations
Software plus support: reviews, deadline tracking, audit preparation.
InquiriesAll prices are net. Consulting services are eligible for funding through KMU.DIGITAL—we’ll review this during the initial consultation. All modules on the platform: digi4business.
In short.
Am I affected by NISG 2026?
If your company operates in one of the 18 sectors and has at least 50 employees or €10 million in revenue or total assets, the answer is most likely yes. Some special cases, such as DNS or trust service providers, are covered regardless of size. The checklist above provides an initial guide.
When is the deadline for registration?
Within three months of the law taking effect, that is, by December 31, 2026. Those affected at a later date have three months from the time the conditions are met.
What is a self-declaration?
A structured report on the risk management measures implemented, due twelve months after the registration requirement takes effect. It covers, in particular, network and information systems, supply chain security, and the results of the risk analysis.
Do I need ISO 27001 for NISG 2026?
No. The law does not require certification. However, organizations with ISO 27001 certification already meet most of the requirements. digi4risk includes both in the same documentation catalog.
What happens during a security incident?
Significant incidents must be reported within 24 hours as an early warning, within 72 hours as an incident report, and within one month as a final report. digi4risk initiates the timeframes upon the occurrence of the incident and prepares the report.
How much does NIS2 software cost?
digi4risk starting at €250 per month; supported operation starting at €500 per month; certification check €1,490 for one day. Consulting services are eligible for funding through KMU.DIGITAL.
Where is the data located?
In Austria, the EU, or on your own server.
30 minutes, and then you'll know what's missing.
We'll determine the extent of the impact, the next logical step, and whether KMU.DIGITAL applies.
Schindler IT-Solutions GmbH
Fünkhgasse 32a/Building 2, 3021 Pressbaum
Phone +43 2262 672040
Email office@schindler-it.com