Cybersecurity law passed: “Anyone who complains now has slept in the past”

That might be necessary. A study by management consultants at KPMG recently showed that one in seven cyber attacks in this country successful is.

Around are affected by the regulations 4,000 companies out of 18 critical sectors How Energy, transportation, healthcare or Digital infrastructure. You must The risk analysis carry out technical and organizational measures for greater cybersecurity are subject to strict rules in the event of incidents Reporting requirements and must ensure that security in the supply chains is ensured through contracts with service providers and suppliers. Violations can result in penalties of up to 10 million euros or two percent of the annual turnover.

The deadline

Nine months after the announcement in the Federal Law Gazette, i.e. probably in Herbst 2026the law will come into force. Affected companies then have three months to register and must declare cybersecurity measures introduced one year after they come into force. They must provide evidence of implementation no earlier than two years after the law comes into force.

“Nothing to be misunderstood”

For companies that have already adhered to common cybersecurity standards, such as the international standard for information security management systems ISO 27001says the change isn’t that big Michael Krausz. “Anyone who complains now has slept in the past, says the cybersecurity expert who is with his i.s.c. group Advises companies and organizations worldwide on IT security, information security and compliance issues. He considers the Austrian implementation of the EU directive to be successful. It is clear to everyone what needs to be done, says Krausz: “There is nothing to misunderstand.”

More companies affected than necessary

In Austria, however, many more companies are affected by the new regulations than actually should be, says Krausz. Because the way in which the size of companies is determined has gone overboard. The EU Commission’s recommendation provides for the number of employees AND sales in combination with the balance sheet total. In this country, the decision was made to formulate the number of employees OR sales in combination with the balance sheet total. “At least that’s what they are 1,000 companies more affected,” calculates Krausz.

It is also problematic that each country has its own implementation law. This means that Austrian companies that have branches in other EU countries may have to meet different requirements there. The Austrian law, for example, only covers this 37 pagesin Germany, however, it is the 140 pagessays Krausz.

There was also criticism of the cybersecurity authority, which is to be located in the Ministry of the Interior. The civil rights organization said that this did not mean independence epicenter.works. Although the law has small weaknesses, Krausz is convinced that the level of cybersecurity will definitely increase through the implementation of the EU directive.