AUSTRIA Law and Practice Contributed by: Martin Schiefer and Christian Richter-Schöller, Schiefer Rechtsanwälte GmbH
5.3 Classified Information and Official Secrets The Information Security Act and the Information Security Regulation govern classified information, with four levels: restricted ( Eingeschränkt ), confi - dential ( Vertraulich ), secret ( Geheim ) and top secret ( Streng Geheim ). The core obligations are need-to- know access, personnel and facility clearances, phys - ical and IT protection measures, registry handling and the flow-down of all requirements to subcontractors through security annexes to the contract. Provisions of the Criminal Code sanction the disclo - sure of official secrets and intelligence offences to the detriment of Austria. International exchanges of clas - sified information rest on bilateral security-of-informa - tion agreements and on Austria’s arrangements with the EU; equivalence tables map foreign classification levels to the Austrian ones. 5.4 Critical National Infrastructure and Defence Assets Austria has no statutory list designating defence assets as critical national infrastructure. Protection is organised through the Austrian Programme for Criti - cal Infrastructure Protection as a policy framework, the crisis structures of the Federal Crisis Security Act, and NIS legislation for the cyber dimension, with the Network and Information System Security Act 2026 replacing the Network and Information System Secu - rity Act 2018 from 1 October 2026. The implementa - tion of the Critical Entities Resilience Directive (EU) 2022/2557 was still pending at the time of writing and should be verified. Military installations enjoy specific protections under the Military Powers Act, including protected zones and security areas. Defence contractors are captured indirectly: through classified-contract requirements, through NIS-2 supply chain duties and through sec - tor coverage where they also operate in listed sectors such as manufacturing or transport. 5.5 Cybersecurity Requirements for Defence Contractors There is no Austrian equivalent of the US CMMC cer - tification scheme. Cybersecurity requirements arise from three sources.
• The Defence Act 2001 and the Military Powers Act govern the armed forces and military security powers, including the military intelligence services ( Heeresnachrichtenamt and Abwehramt ). • The State Protection and Intelligence Service Act governs the Directorate for State Protection and Intelligence within the Federal Ministry of the Inte - rior. • The Information Security Act governs classified information. • The Federal Crisis Security Act establishes crisis co-ordination structures and a federal situation centre. The espionage and secrecy offences of the Criminal Code protect against intelligence activities to Aus - tria’s detriment. The Network and Information Sys - tem Security Act 2026 adds cybersecurity regulation from October 2026. Administration is spread across the Federal Ministry of Defence, the Federal Ministry of the Interior and the Federal Chancellery, with dedi - cated parliamentary oversight subcommittees for the intelligence services. 5.2 Security Vetting and Clearance Requirements Two security clearance tracks exist. In the military domain, reliability checks ( Verlässlichkeitsprüfungen ) under the Military Powers Act are conducted by the Abwehramt for persons with access to military instal - lations or classified material. In the civilian domain, security screenings are conducted by the Directorate for State Protection and Intelligence under the state protection framework. The depth of vetting is gradu - ated in line with the classification levels. Companies performing classified contracts require a facility security clearance under the Information Secu - rity Act framework, administered for defence contracts by the Federal Ministry of Defence; the personnel con - cerned receive individual clearances. Checks require the consent of the person concerned, and they involve registry and intelligence queries and, at higher levels, extended vetting. Clearances are time-limited and can be revoked at any time where the underlying reliability ceases to exist.
21 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook