Article 21(2)(c) for essential and important entities

NIS2 Business Continuity: BCM, Backup and Disaster Recovery

Article 21(2)(c) NIS2 requires business continuity, such as backup management and disaster recovery, and crisis management.

  • 01Business impact analysis with defined RTO and RPO
  • 02Tested continuity and recovery plans
  • 03Backup concept with proven restorability
  • 04Audit-ready documentation for supervisory review
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

Business continuity under NIS2 Article 21(2)(c)

NIS2 does not use the term business continuity management literally, but Article 21(2)(c) requires its core: business continuity, backup management, disaster recovery and crisis management. Item (j) adds secured emergency communication systems. For cloud, data centre, managed service and other digital providers, Implementing Regulation (EU) 2024/2690 specifies the requirements in section 4: continuity and recovery plans, backup and redundancy management, and crisis management.

We start with a business impact analysis of your time-critical processes, derive recovery objectives and strategies, and create continuity, recovery and backup plans including redundancies and supplier dependencies. We then test the plans in exercises and anchor responsibility and reporting lines with management.

2 service modules

Service scope

01

NIS2 Business Impact Analysis

Systematic analysis of your critical business processes and their dependencies in the context of NIS2 requirements.

  • Identification of critical business processes according to NIS2 criteria
  • Assessment of dependencies and single points of failure
  • Definition of Recovery Time and Recovery Point Objectives
  • Prioritization of recovery measures
02

BCM Strategy and Governance

Development of a comprehensive Business Continuity strategy with corresponding governance structures.

  • NIS2-compliant BCM policy and strategies
  • Establishment of BCM governance structures
  • Definition of roles and responsibilities
  • Integration with existing management systems

5 phases

Our NIS2-BCM Approach

We develop a systematic Business Continuity Management that is fully aligned with the specific requirements of the NIS2 Directive.

  1. Assessment of current BCM maturity and NIS2 gap analysis

  2. Identification of critical business processes and dependencies

  3. Development of NIS2-compliant BCM strategies and policies

  4. Implementation of emergency plans and testing procedures

  5. Establishment of continuous monitoring and improvement

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn

Our NIS2-BCM Expertise

  • 01In-depth knowledge of the NIS2 Directive and its national implementation
  • 02Extensive experience in Business Continuity Management for critical infrastructures
  • 03Proven methodologies and established international BCM standards
  • 04Comprehensive approach to cyber security and business continuity

Mandatory for essential and important entities

Business Continuity Management is a central pillar of the NIS2 Directive. Organizations must demonstrate that they have taken appropriate measures to ensure business continuity and minimize the impact of security incidents.

Further reading

6 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about NIS2 Business Continuity Management

What does NIS2 Article 21(2)(c) require for business continuity?

NIS2 Article 21(2)(c) requires essential and important entities to ensure business continuity through three core elements: backup management with defined RPO/RTO values, disaster recovery after emergencies, and crisis management. All BCM measures must be documented, regularly tested and kept current. The BSI provides an implementation framework through BSI-Standard 200‑4.

What must a NIS2-compliant BCM program include?

A NIS2-compliant BCM program must include: Business Impact Analysis (BIA) of critical processes, Business Continuity Plans (BCP) with defined recovery timeframes, Disaster Recovery Plans (DRP) for IT systems, backup concepts following the 3‑2-1 rule, crisis management procedures with defined roles and escalation paths, and regular tests. All plans must be accessible to relevant personnel and kept current.

How often must BCM plans be tested under NIS2?

NIS2 does not prescribe a fixed testing frequency. For cloud, data centre and other digital providers, Implementing Regulation (EU) 2024/2690 requires plans to be tested at planned intervals and after significant incidents or changes. In practice, annual tabletop exercises and less frequent full-scale exercises work well. Test results and improvements must be documented.

Does NIS2 business continuity apply to financial entities under DORA?

Not directly. In Germany, Sections 30 to 32 BSIG do not apply to financial entities within the meaning of DORA (Regulation (EU) 2022/2554), see Section 28(6) BSIG; DORA itself is lex specialis to NIS2. Their business continuity, backup and recovery obligations follow from DORA, including digital operational resilience testing and threat-led penetration testing (TLPT) for selected entities. Groups with financial and non-financial companies need a clear split of which entity falls under which regime.

Does NIS2 BCM compliance satisfy ISO 22301 requirements?

NIS2 BCM compliance and ISO 22301 certification are related but distinct. ISO 22301 is the international BCM management system standard. Organizations with ISO 22301 certification largely meet NIS2 BCM requirements. However, NIS2 compliance alone does not fulfill ISO 22301 certification requirements. BSI-Standard 200‑4 is the recommended German implementation guide.

What backup requirements does NIS2 mandate?

NIS2 explicitly mandates backup management as part of BCM obligations under Article 21(2)(c). Best practice framework: 3‑2-1 rule (3 copies, 2 different media, 1 offsite), defined RPO and RTO targets, regular backup tests with documented restore verification, secured offsite/cloud backups, and ransomware protection through immutable backups. Backup strategies must be regularly tested, not just implemented.