Short answer: if you have 50 employees, usually no – but…
NIS2 (in Austria: NISG) applies as a rule of thumb 50 employees or over €10 million turnover and Total assets – and only in 18 regulated sectors (energy, health, transport, digital infrastructure, IT services, etc.), including micro and small enterprises Generally excluded. But: Major customers pass on obligations to suppliers via contract (Supply chain pressure) - then you need proof, even though the law doesn't affect you directly.
The thresholds at a glance
| size | Employees | Finance | NIS2 episode |
|---|---|---|---|
| Small/Small | < 50 | ≤ 10 Mio. € | Basically excluded (exceptions: Telekom, DNS/TLD, trust services) |
| Means | ≥ 50 | Sales and Balance sheet > €10 million | Affected → mostly “important facility” |
| Big | ≥ 250 | Sales > €50 million and Balance sheet > €43 million | Affected → mostly “essential facility” |
Obligations for those affected (overview)
Registration
Register with the BMI via CERT.at within 3 months.
Message
Cyber incidents: 24-hour early warning, 72-hour report, 1-month report.
Risk management
Technical + organizational measures, documented and effective.
Management
Management approves, monitors and trains itself - personal liability for breach of duty.
What SMEs should do now
- ✓ Check if affected: Match sector + size (table above). If in doubt, ask the CERT.at contact point.
- ✓ Document basic hygiene: Backups (tested!), updates, access concepts, incident flow on one page.
- ✓ Create supplier folder: AV contracts, TOMs, list of sub-service providers – that’s what regulated customers ask first.
- ✓ Website & Tools hardening: Updates, 2FA everywhere, backups, monitoring – ours SEO check and Cookie check Find the basics for free.