The article analyses Austria's Network and Information Systems Security Act 2026, which transposes the NIS-2 Directive and extends cybersecurity obligations to companies in 18 sectors. It explains the size and sector criteria for scope, the distinction between essential and important entities and the need for a documented, group-wide scope assessment. The authors outline registration, risk management, self-declaration and 24-hour incident reporting duties, as well as management accountability. They describe GDPR-style fines and recommend treating the law as a compliance priority with demonstrable management oversight.