Incident (NIS2)
§ 2 BSIG — notifiable security incident
TL;DR
An incident (NIS2) is, under § 2 BSIG, an event that actually compromises the security of network and information systems. For 'significant' incidents, the 24/72/30 notification obligation applies.
What is an incident (NIS2)?
A security incident becomes notifiable as soon as it is 'significant'. Significance is defined qualitatively in § 2 no. 11 BSIG (the Act does not state fixed numerical thresholds):
- severe operational disruption of the services or financial loss for the entity concerned, or
- considerable material or non-material damage to other natural or legal persons
Example from practice
Ransomware encrypts servers. Incident: yes. Significant: yes (severe operational disruption). A 24-hour early warning to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK) (§ 32 BSIG) is mandatory.
Legal position: Germany and Austria
NIS2 is an EU directive (Directive (EU) 2022/2555); each Member State transposes it into national law. The term, the reporting office and the sanctions therefore differ in detail between Germany (BSIG 2025) and Austria (NISG 2026).
Germany (BSIG 2025)
- Term: The 'significant security incident' (erheblicher Sicherheitsvorfall) is defined in § 2 no. 11 BSIG.
- Notification: three stages under § 32(1) no. 1–4 BSIG — early warning within 24 hours, notification with an initial assessment within 72 hours, final report within one month — to the joint reporting office of the BSI and the BBK.
- Competent authority: Federal Office for Information Security (BSI).
- Fine: under § 65 BSIG up to EUR 10 million or 2% of worldwide annual turnover (particularly important entities), up to EUR 7 million or 1.4% (important entities).
Austria (NISG 2026)
- Term: The 'significant cybersecurity incident' (erheblicher Cybersicherheitsvorfall) is defined in § 35(1) NISG 2026.
- Notification: three stages under § 34(2) no. 1–5 NISG 2026 — early warning within 24 hours, notification within 72 hours, final report within one month — to the competent sector-specific or national CSIRT (not to the BSI).
- Competent authority: Cybersecurity Authority (Cybersicherheitsbehörde, Austria), a subordinate authority of the Federal Minister of the Interior.
- Administrative penalty: under § 45(2) NISG 2026 up to EUR 10 million or 2% of worldwide annual turnover (essential entities), up to EUR 7 million or 1.4% (important entities).