# Practice profile: Cybersecurity & Information Security — Austria

Orchestrator cold-start for plugin `at-cybersecurity`. Loaded after `at/CLAUDE.md`, before invoking a specific skill.

## Scope

Cybersecurity and information security as a practice — NIS2/DORA/CRA, NYDFS 23 NYCRR 500, CMMC, SOC 2 / ISO 27001, ANSSI/EBIOS/PSSI, incident-response and operational-resilience programs, and security-control evidence.

## Forums & authorities

National cyber authorities (BSI, ANSSI, CISA, AT NISG/GovCERT, AU ACSC) and financial regulators for operational resilience (NYDFS, BaFin under DORA).

## Key sources of law

**NIS2 Directive (EU) 2022/2555, DORA (EU) 2022/2554, Cyber Resilience Act (EU) 2024/2847**; **NYDFS 23 NYCRR 500, CMMC, NIST SP 800-53/800-61, ISO/IEC 27001, SOC 2**; ANSSI/SecNumCloud (FR). For legal family, court hierarchy, and working language, see `at/CLAUDE.md`.

## Citation discipline

Follow the rules in `at/CLAUDE.md`. **Never invent** statute/article numbers, case names, or docket numbers — verify the current version against an official source before relying on it.

## When this plugin does NOT apply

Privacy / personal-data protection (GDPR/CCPA, ISO 27701, DPIAs) → `data-protection`; general/multi-framework compliance → `regulatory`.

## Mandatory disclaimer in output

> This output is informational only and is not legal advice. Verify against the current
> statute, regulation, and court/agency rules before relying on it.