NIS2 Art.21.2c: Business Continuity and Crisis Management

Run a business impact analysis (BIA) to identify critical business functions, their dependencies on IT systems, and the maximum tolerable downtime for each. Use this to set recovery time objectives (RTO) and recovery point objectives (RPO) for every critical system. Build a business continuity plan that addresses cyber-specific scenarios. A compromised environment is fundamentally different from a damaged one - you may be dealing with corrupted data integrity, a persistent attacker presence, or encrypted backups. Your BCP must account for these realities. Implement a backup strategy that covers regular automated backups of critical data and systems, offline or air-gapped copies that ransomware cannot reach, regular restoration testing, and encryption of backup data at rest and in transit. If you do not have immutable or offline backups, fix that first. Write a disaster recovery plan with detailed procedures for restoring critical systems. Include recovery steps for different scenarios (ransomware, data breach, infrastructure failure) and define the restoration order based on business criticality. Establish a crisis management framework defining command structures, communication channels, decision-making authority, and escalation procedures for major incidents. Prepare templates for internal and external communications - you do not want to be drafting customer notifications under pressure. Test everything regularly. Run backup restoration tests at least quarterly, tabletop exercises for crisis scenarios at least annually, and full disaster recovery drills once a year. Document results and fix the gaps you find. Keep all plans current. Update them whenever you make significant changes to your IT environment, business processes, or organisational structure.