Pursuant to Art. 44 Par. 1 of the Telecommunications Act 2021 (TKG 2021), operators of public communications networks and providers of public communications services are required to implement cybersecurity measures in accordance with other applicable legal provisions.
Where such legal provisions are not sufficient to ensure the security of networks and services, the regulatory authority is empowered, in agreement with the Federal Chancellor, the competent Federal Minister, and the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit; BCS), to lay down more detailed technical and organisational security measures by regulation. In doing so, it must take into account, in particular, relevant international rules, the national cybersecurity strategy, the type of network or service concerned, the technical possibilities, and the legitimate interests of users worthy of protection.
In addition, operators of public communications networks or public communications services that operate their networks or services in Austria and do not have a residence or registered office in the European Union may be required to designate an address for service in Austria at which final documents in proceedings under the TKG 2021 may be validly served. This also applies to manufacturers and service providers of network components if they offer their products or services in Austria or if such products or services are imported into Austria.