From Maturity Check to Resilient Implementation Roadmap
The classification notices in accordance with the Resilience of Critical Facilities Act (RKEG) are currently being served. The legal deadlines for critical facilities begin to run with delivery: a central contact point must be designated within four weeks, the risk analysis must be available within nine months, and after ten months the resilience measures must be implemented and set out in a resilience plan. At the end of the ten months, the obligation to report security incidents also applies.
This makes resilience a top priority. Violations can result in administrative penalties of up to 50,000 euros, and up to 100,000 euros in the event of a repeat offense. In addition, every critical institution is considered an essential institution under the NISG 2026, which came into force on 1 October 2026. Their management bodies are therefore personally responsible. The central question is therefore not only what is required, but also how the requirements can be integrated into existing structures in a timely and meaningful manner.
Three interconnected levels provide orientation: the European CER Directive, the Austrian RKEG as well as the guidelines from the Project for the Support of Critical Institutions (PUKE) and the guidelines of the Directorate of State Protection and Intelligence (DSN).
In practice, this means that how the obligations are to be implemented in concrete terms depends on the essential service, the individual risk situation and the protective measures already in place. The guidelines are expressly based on existing regulations and measures. It is therefore crucial to systematically evaluate what is available and to supplement it in a targeted manner.
How we support companies in implementing the RKEG requirements
Many companies are not starting from scratch when implementing the RKEG. Suitable structures and measures are often already in place. What is usually lacking is a consolidated overview: Which requirements are covered, which evidence is reliable and where is there a concrete need for action?
Our RKEG Maturity Check provides this assessment. We combine the analysis of your documents with on-site discussions and evaluate not only whether measures are documented, but whether they actually work in an emergency.
This is how we proceed:
- Kick-off and Scoping: We clarify the essential service, the relevant locations and the status of your classification and determine the scope of the audit.
- Document analysis: We review existing risk analyses, concepts for business continuity management (BCM), crisis management and security as well as evidence, also from existing NIS2 projects.
- Interviews with those responsible for the subject: Using a structured questionnaire, we examine how the measures are lived in everyday life.
- Evaluation according to maturity model: We evaluate each requirement from the RKEG and the PUKE and DSN guidelines according to the degree of implementation and practical effectiveness.
- Presentation of the results: We present the results to the management and the technical managers and coordinate the next steps.
The entire check usually takes three to six weeks. As a result, you will receive a compact report with an audit dashboard that shows the maturity level and degree of fulfillment per topic area, the gaps prioritized according to risk, and an implementation roadmap as a basis for decision-making by the management.
Your added value
With our RKEG Maturity Check, you will receive:
- An objective assessment of the current status of implementation.
- Transparency about existing measures, evidence and critical gaps.
- Clear priorities so you can target resources where the risk is greatest.
- Clarity about which verifications from existing NIS2 projects you can already use for the RKEG.
Why Us
Since 2017, we have been supporting companies in business continuity, crisis and resilience management in a wide range of sectors such as energy, healthcare, transport, banking and public administration. Our team combines regulatory know-how on RKEG, NISG 2026 and ISO 22301 with expertise from national and international projects in critical infrastructures. Experience from over 5,000 evaluated processes, more than 1,000 risks collected and over 250 crisis exercises carried out for more than 80 customers is incorporated into each check. The RKEG Maturity Check is already successfully used by several critical infrastructure companies, including an Austrian transport company and an Austrian energy supplier.
Where does your company stand in the implementation of the RKEG?
Has your decision arrived or will it come in the next few days? Then every week counts. Arrange a non-binding 30-minute initial consultation now. We will discuss your decision, assess your current implementation status and show you how the RKEG Maturity Check works in your company.
