NIS2 Crisis Management

NIS 2 Article 21(2)(c) requires crisis management as part of business continuity obligations. Entities must establish structured procedures for managing cybersecurity crises: a crisis plan with defined triggers and escalation levels, a named crisis team with clear roles, communication channels internally and externally including BSI notification, immediate damage mitigation measures, and recovery steps.

A NIS2-compliant crisis plan must contain: escalation criteria (when is the crisis plan activated?), crisis team composition with deputies, internal and external communication concept, decision-making authority during a crisis, immediate damage limitation measures, medium and long-term recovery steps, and interfaces to BCM and incident response processes. The plan must be accessible, current and tested.

BCM and crisis management under NIS 2 are closely linked but distinct: BCM focuses on maintaining and restoring operations after disruptions (technical perspective: backup, DRP, RTO). Crisis management addresses leadership and coordination during acute crisis situations (management perspective: decision structures, communication, stakeholder management). Both disciplines must be aligned with each other.

NIS 2 requires regular testing to ensure effective crisis plans. Best practice: annual tabletop exercises with the crisis team, full crisis simulations every

2 to

3 years. Tests should cover different scenarios: ransomware attack, supplier failure, DDoS attack. Exercise results must be documented, improvements implemented and plans updated accordingly.

DORA for financial entities has more specific crisis management requirements than NIS2: it mandates scenario-based testing (Threat-Led Penetration Testing for significant institutions), stricter communication obligations and more detailed crisis plans. Financial companies subject to both frameworks should establish DORA-compliant crisis plans as the baseline, as these simultaneously fulfill NIS 2 requirements.

During a crisis under NIS2, multiple communication obligations apply: BSI notification (24h early warning, 72h follow-up,

1 month final report), potential BaFin notification in the financial sector, internal crisis communication with employees and management, and external communication with customers and partners. The crisis plan must clearly define communication channels and responsibilities.