Austria’s national CSIRT demands legal clarity on two key points of NIS2 implementation: first, authorization for nationwide vulnerability scanning and data processing beyond regulated entities—lessons from Dutch counterparts—and second, precise definition of support tasks for essential entities through cyber-threat in