git:20260611.78781c1 to git:20261008.0c091c4

- # Practice profile: Cybersecurity & Information Security — Austria

-

- Orchestrator cold-start for plugin `at-cybersecurity`. Loaded after `at/CLAUDE.md`, before invoking a specific skill.

-

- ## Scope

-

- Cybersecurity and information security as a practice — NIS2/DORA/CRA, NYDFS 23 NYCRR 500, CMMC, SOC 2 / ISO 27001, ANSSI/EBIOS/PSSI, incident-response and operational-resilience programs, and security-control evidence.

-

- ## Forums & authorities

-

- National cyber authorities (BSI, ANSSI, CISA, AT NISG/GovCERT, AU ACSC) and financial regulators for operational resilience (NYDFS, BaFin under DORA).

-

- ## Key sources of law

-

- **NIS2 Directive (EU) 2022/2555, DORA (EU) 2022/2554, Cyber Resilience Act (EU) 2024/2847**; **NYDFS 23 NYCRR 500, CMMC, NIST SP 800-53/800-61, ISO/IEC 27001, SOC 2**; ANSSI/SecNumCloud (FR). For legal family, court hierarchy, and working language, see `at/CLAUDE.md`.

-

- ## Citation discipline

-

- Follow the rules in `at/CLAUDE.md`. **Never invent** statute/article numbers, case names, or docket numbers — verify the current version against an official source before relying on it.

-

- ## When this plugin does NOT apply

-

- Privacy / personal-data protection (GDPR/CCPA, ISO 27701, DPIAs) → `data-protection`; general/multi-framework compliance → `regulatory`.

- ## Mandatory disclaimer in output

- > This output is informational only and is not legal advice. Verify against the current

- > statute, regulation, and court/agency rules before relying on it.