[COMMUNITY] Assess Austrian NISG obligations (BGBl. I Nr. 94/2025) — AT transposition of NIS2, BKA (GovCERT) / BMI (SPOC) reporting, KSÖ coordination, and Austrian sectoral rules for Essential/Important entities
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
[COMMUNITY] Assess Austrian NISG obligations (BGBl. I Nr. 94/2025) — AT transposition of NIS2, BKA (GovCERT) / BMI (SPOC) reporting, KSÖ coordination, and Austrian sectoral rules for Essential/Important entities
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified CISO / BMI-liaison / Rechtsabteilung before reliance. Citations to BMI / A-SIT / EU regulations may lag the current text — verify against the source. Items marked [NEEDS VERIFICATION] must be confirmed against the current NISG text (idF BGBl. I Nr. 94/2025) and implementing ordinances before external use — the legislation is recent and evolving.
You are helping an enterprise architect generate an Austrian NISG Compliance Assessment — the Austrian transposition of NIS2 (EU Directive 2022/2555). The Austrian Netz- und Informationssystemsicherheitsgesetz (NISG, BGBl. I Nr. 111/2018 idF BGBl. I Nr. 94/2025) extends NIS2 obligations with Austria-specific designation, reporting, and supervision rules. Run this after $arckit-eu-nis2 to add Austrian obligations that go beyond the EU baseline.
User Input
$ARGUMENTS
Instructions
Note: Before generating, scan projects/ for existing project directories. For each project, list all ARC-*.md artifacts, check external/ for reference documents, and check 000-global/ for cross-project policies. If no external docs exist but they would improve output, ask the user.
Step 0: Read existing artifacts from the project context
MANDATORY (warn if missing):
REQ (Requirements) — Extract: security requirements (NFR-SEC-xxx), operational requirements, integration requirements (INT-xxx), sector and entity type information, criticality thresholds
If missing: proceed with user-provided entity description, but note that requirements analysis would strengthen the gap assessment
Read any global policies in 000-global/policies/ — extract security policy, incident response policy, supplier security policy, BCM policy
If BMI designation documents found, use them to pre-populate the Essential/Important status.
Step 1: Identify or Create Project
Identify the target project from the hook context. If the project doesn't exist:
Use Glob to list projects/*/ directories and find the highest NNN-* number
Calculate the next number (zero-padded to 3 digits)
Slugify the project name
Use the Write tool to create projects/{NNN}-{slug}/README.md
Set PROJECT_ID and PROJECT_PATH
Step 2: Read Source Artifacts
Read all documents from Step 0. Identify:
Sector (NIS2 Annex I Essential / Annex II Important / out of scope)
Organisation size (>250 employees / 50–250 / <50)
Operation in Austria (seat, subsidiary, critical service delivery in AT)
Sector-specific Austrian designation status (E-Control for energy, FMA for finance, BMSGPK for health, BMK for transport, RTR for digital infrastructure, BMI for federal public admin)
Financial sector involvement (DORA overlap)
Step 3: Template Reading
Read the template (with user override support):
First, check if .arckit/templates-custom/at-nisg-template.md exists in the project root
If found: Read the user's customized template
If not found: Read .arckit/templates/at-nisg-template.md
Before generating the assessment, determine entity classification:
Annex I — Essential Entities (NIS2 baseline, carried into NISG): Energy, Transport, Banking, Financial market infrastructure, Health, Drinking water, Wastewater, Digital infrastructure, ICT service management, Public administration, Space.
Annex II — Important Entities (NIS2 baseline): Postal/courier, Waste, Chemicals, Food, Manufacturing (medical devices, computers, transport), Digital providers, Research.
Austrian additions or scope differences:
Austria may designate additional entities under NISG based on criticality assessment (§3 Abs. 4: Bundeskanzler can designate regardless of size threshold)
Public-administration scope: Federal bodies in scope by default; Land-level bodies can opt in via Landeshauptmann declaration (§22 Abs. 5-6) — check whether the relevant Land has opted in
Special regimes continue for previously designated Betreiber wesentlicher Dienste under NISG 2018 — entities designated under old §16 transition automatically; new Essential/Important classification applies from entry into force of BGBl. I Nr. 94/2025
Size thresholds (NIS2 carried into NISG):
Essential Entity: sector-qualified AND (>250 employees OR >€50M revenue)
Important Entity: sector-qualified AND (50–250 employees OR €10–50M revenue)
Microenterprises may fall out of scope unless sector-specific designation applies
Show entity classification before generating the full document.
Step 5: Generate NISG Assessment
CRITICAL: Use the Write tool to create the assessment document.
Detect version: Check for existing ARC-{PROJECT_ID}-ATNISG-v*.md files:
No existing file → VERSION="1.0"
Existing file → minor increment if refreshed, major if scope changed
Auto-populate Document Control:
Document ID: ARC-{PROJECT_ID}-ATNISG-v{VERSION}
Status: DRAFT
Created Date: {current_date}
Next Review Date: {current_date + 12 months}
Entity Designation: from Step 4 classification
Note: "This document supplements ARC-{PROJECT_ID}-NIS2-v*.md with Austrian-specific NISG 2024 obligations"
Section 1: Austrian Scope and Designation
Sector classification with AT sectoral authority mapping (E-Control, FMA, ELGA/BMSGPK, BMK for transport, etc.) [NEEDS VERIFICATION]
Entity designation: Essential / Important / Out of scope under NISG
Previous NISG 2018 designation (Betreiber wesentlicher Dienste) and transition status
Cross-border operations treatment (main establishment rules from NIS2)
Federal vs Land competence — confirm venue for supervision [NEEDS VERIFICATION]
Section 2: Governance (NIS2 Art. 20 — as transposed)
Geschäftsleitung (management body) approval of security measures
Management body personal liability for non-compliance — AT practice [NEEDS VERIFICATION: confirm penalty regime in NISG 2024]
Management body cybersecurity training requirement
All ten minimum security measures with current status and gaps:
Risk analysis policy
Incident handling
Business continuity / BCM
Supply chain security
Secure acquisition, development, maintenance
Policies to assess effectiveness
Cyber hygiene and training
Cryptography policy
HR security and access control
MFA and secure communications
A-SIT guidance alignment where applicable (A-SIT publishes sector-agnostic security guidance; not a regulatory body but commonly referenced by BMI and sectoral authorities)
Proportionality assessment: measures proportionate to entity size and risk
Extract existing controls from SECD artifact to pre-populate status
Section 4: Incident Reporting — Austrian Channel
Three-tier CERT reporting: Sectoral CERT (if designated, e.g. Energy-CERT) → National CERT (CERT.at, operative under BMI §5) → GovCERT (BKA §4(4), public-admin entities only). Non-public entities report to CERT.at / sectoral CERT; GovCERT handles federal and Land public-admin entities
Four-stage NIS2 reporting timeline (24h early warning, 72h notification, intermediate on request, 1-month final report)
Austrian form and language requirements for reports
Cross-reporting to DSB if personal data breach (Art. 33 GDPR + NISG)
Supplier inventory and risk assessment requirements
Contractual security clause requirements
Software supply chain requirements
ENISA supply chain framework plus AT-specific sectoral guidance (e.g. E-Control Verordnungen for energy sector, FMA Rundschreiben for financial sector)
EU coordinated risk assessment outcomes (5G, high-risk vendors)
Section 6: Business Continuity and Resilience
BCP documentation status
Backup and restoration testing
Crisis management procedures
RTO / RPO definition aligned with sectoral criticality expectations
Section 7: Supervision, Inspections, and Penalties
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ AT NISG Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-ATNISG-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📋 Austrian Entity Classification
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Classification: {Essential Entity / Important Entity / Out of scope}
Sector: {Annex I or II sector + AT authority}
Previous NISG 2018 Status: {BwD / None}
GovCERT Channel: {Confirmed / Gap}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Gap Summary (Art. 21 Ten Measures)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
{Compliance status for each of the 10 measures}
Total Gaps: {N} ({N} high, {N} medium, {N} low)
Incident Reporting: {Ready / Gap — 24h/72h capability}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
1. {If no eu-nis2 baseline: run $arckit-eu-nis2 first}
2. {If personal data in security monitoring: run $arckit-at-dsgvo}
3. Run $arckit-secure to implement Art. 21 controls
4. Run $arckit-risk to register NISG gaps
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Important Notes
Run after eu-nis2: This command adds the Austrian layer. For best results, run $arckit-eu-nis2 first.
NISG amendment is recent: The NIS2 transposition (BGBl. I Nr. 94/2025) is recent. Implementing ordinances (Verordnungen) from sectoral regulators may still be forthcoming. An AT cyber practitioner must confirm before external reliance.
Management body liability: NIS2 Art. 20 makes Geschäftsleitung personally liable for approving and overseeing cybersecurity measures. Under the 2025 NISG amendment, management bodies must complete cybersecurity training. Penalties for entities: Essential ≥ €10M / 2% turnover, Important ≥ €7M / 1.4% turnover (NIS2 Art. 34 floor).
24-hour reporting capability: The 24-hour early warning window is tight. Flag if no 24/7 incident detection and reporting capability exists.
KSÖ is voluntary but strategic: Participation in Kuratorium Sicheres Österreich is not a legal obligation, but it is the main national PPP forum and is often expected of designated entities.
DORA overlap for financial sector: Austrian financial entities face both NISG and DORA. Use $arckit-eu-dora to map the overlap; DORA generally takes precedence for ICT resilience obligations.
Use Write Tool: NISG assessments cover 9 sections with technical and regulatory depth. Always use the Write tool.
Success Criteria
✅ Assessment document created at projects/{project_id}/ARC-{PROJECT_ID}-ATNISG-v{VERSION}.md
✅ Entity classification determined (Essential / Important / Out of scope)
✅ Supervision regime and penalty ceilings documented (with verification flags)
✅ KSÖ / NCSC-AT coordination addressed
✅ Gap analysis with maturity levels and roadmap generated
Example Usage
$arckit-at-nisg Assess NISG obligations for a Styrian regional energy distributor (Stromnetzbetreiber) with BwD designation under NISG 2018, 400 employees, operating a SCADA migration project
$arckit-at-nisg NISG scoping for 001 — Austrian MSP serving healthcare and finance customers, 180 employees, HQ in Vienna with a secondary site in Linz
$arckit-at-nisg Austrian NIS2 transposition assessment for a federal ministry IT service provider, public administration sector, including GovCERT reporting readiness
Suggested Next Steps
After completing this command, consider running:
$arckit-eu-nis2 -- Run the pan-EU NIS2 baseline first if not already completed (when No prior eu-nis2 assessment exists for this project)
$arckit-at-dsgvo -- Assess AT DSG obligations where NISG processing involves personal data (when Security monitoring processes personal data (logs, user activity))
$arckit-risk -- Integrate NISG gap findings into the project risk register
