Continuity in NIS2: what article 21(2)(c) requires

In this lesson

• Read article 21(2)(c) exactly, and explain why backup management and disaster recovery are examples of business continuity while crisis management is a component of its own.
• Explain why continuity is a cybersecurity measure under NIS2, including for failures that involve no attacker.
• Separate three layers: what the directive requires of every essential and important entity, what Implementing Regulation (EU) 2024/2690 adds for the entity types in its article 1, and what remains good practice.
• Place continuity next to incident handling and the article 23 reporting chain, which does not pause while you recover.

One point, three disciplines

Art. 21(2)(c)

Article 21(2) lists the ten measures that every essential and important entity must take as a minimum. Point (c) reads: “business continuity, such as backup management and disaster recovery, and crisis management”.

The words such as introduce examples of business continuity. They do not mark the boundary of the measure: continuity also covers manual workarounds, alternative suppliers, staff cover and anything else that keeps a service running or brings it back. Crisis management follows a second and. It is a component of its own, not a sub-topic of continuity. An entity with excellent backups and no way to take decisions under pressure has covered only part of point (c).

The point does not say how. It does not mention a business impact analysis, recovery time objectives, a second site, offline copies or annual exercises. The how comes from three places: the general test of article 21(1), the detailed Annex of Implementing Regulation (EU) 2024/2690 for the entities it covers, and good practice. A supervisor will ask which of your choices are obligations and which are yours.

Formally, article 21 is addressed to Member States, which “shall ensure” that entities take the measures. The obligation reaches you through national law, which may add detail or guidance. Check your national text on the transposition tracker.

Why continuity is a cybersecurity measure

Art. 6(2), 6(6), 6(8)

Continuity can sit in a risk or facilities department, far from IT security. The definitions of article 6 explain why the directive puts them together.

• Security of network and information systems is, under article 6(2), “the ability of network and information systems to resist, at a given level of confidence, any event that may compromise the availability, authenticity, integrity or confidentiality” of data or services.
• An incident, under article 6(6), is an event compromising any of those four properties. Availability is one of them.
• Incident handling, under article 6(8), is “any actions and procedures aiming to prevent, detect, analyse, and contain or to respond to and recover from an incident”.

Availability is therefore a security property and recovery is part of incident handling. Recital 78 says the measures should include measures “to prevent, detect, respond to and recover from incidents and to mitigate their impact”. Article 21(1) states the purpose of all ten measures: to manage the risks posed to the security of network and information systems and “to prevent or minimise the impact of incidents on recipients of their services and on other services”. Minimising impact once prevention has failed is the job of continuity.

All hazards, not only attackers

Art. 21(2), recital 79

The measures of article 21(2) must be “based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents”. Recital 79 gives examples of the events meant: “theft, fire, flood, telecommunication or power failures, or unauthorised physical access”, and adds system failures, human error, malicious acts and natural phenomena.

Your plan must therefore cover ransomware, but also the cooling failure, the cut fibre, the faulty supplier update and the administrator who deletes the wrong volume. None needs an attacker; all are incidents within article 6(6) when they compromise availability. For the entity types it covers, Implementing Regulation (EU) 2024/2690 attaches the protection of supporting utilities, such as electricity, telecommunications, water supply, ventilation and air conditioning, expressly to point (c) (Annex, points 13.1.1 and 13.1.2).

Three layers: law, implementing regulation, practice

Reg. 2024/2690, art. 1

Layer 1: the directive. Every essential and important entity must have business continuity, such as backup management and disaster recovery, and crisis management, and the measures must be appropriate and proportionate. Article 21(1) sets the test: a level of security appropriate to the risks, taking into account the state of the art, relevant European and international standards where applicable, and the cost of implementation. Proportionality takes account of “the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact”. Article 20(1) makes the management body approve the measures and oversee their implementation; article 21(4) requires corrective measures without undue delay when the entity finds it does not comply.

Layer 2: Implementing Regulation (EU) 2024/2690. Its article 1 limits it to a closed list of relevant entities: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. For them, section 4 of the Annex is binding. For a hospital, a water utility or a manufacturer it is not an obligation. It remains a detailed EU-level reference for a gap analysis.

Layer 3: good practice. Recovery time objectives, immutable copies, a yearly exercise calendar, a secondary data centre: excellent choices, some of which a supervisor may regard as the state of the art for your risk. Unless a binding text imposes them on your entity, you choose and justify them; you cannot quote them as law.

Where the middle column says not mentioned and you are not an article 1 entity, the element is good practice.

Proportionality and “where appropriate”

Reg. 2024/2690, art. 2(2)

Even the implementing regulation is not a uniform checklist. Article 2(2) requires relevant entities to take due account of their exposure to risks, their size, and the likelihood and severity of incidents. Several items in section 4 apply only “where appropriate”, including the eight contents of the plan listed in point 4.1.2. Where a relevant entity considers such an item not appropriate, not applicable or not feasible, it “shall in a comprehensible manner document its reasoning to that effect”. Recital 5 adds that entities which cannot implement some requirements because of their size should be able to take compensating measures. Other entities can borrow the discipline: write down why you did not adopt an element.

Where point (c) meets point (b) and article 23

Art. 21(2)(b), 23(4)

Incident handling, point (b), and continuity, point (c), overlap by design: recovery appears in both. For relevant entities, the Annex requires the incident handling policy to be “coherent with the business continuity and disaster recovery plan referred to in point 4.1” (point 3.1.2). In practice that means one severity scale, one escalation path, one set of contact lists, and a defined hand-off from the incident team to the continuity or crisis organisation when an incident becomes a disruption.

The reporting chain does not wait for recovery. If an incident is significant, article 23(4) requires the early warning within 24 hours and the incident notification within 72 hours of becoming aware of it, whatever the state of the restore. Lesson 4.2 shows how to run both at once.

What a supervisor will ask

• Which documents implement point (c), and who approved them? The continuity and recovery plans, the crisis management process, and the management body's approval record.
• Does Implementing Regulation (EU) 2024/2690 bind you? Your analysis of your entity type against its article 1.
• Which hazards does your plan cover besides cyberattacks? The risk assessment, with scenarios for utility failure, physical damage, supplier failure and human error.
• Which elements did you decide not to adopt, and why? The documented reasoning, signed off by the person accountable for the risk.

Key points

• Point (c) names business continuity, with backup management and disaster recovery as examples, and crisis management as a separate component.
• Availability is a security property and recovery is part of incident handling: continuity is a cybersecurity measure, under an all-hazards approach.
• The directive requires the measure; section 4 of the Annex to Implementing Regulation (EU) 2024/2690 details it for the article 1 entity types only.
• Business impact analysis, recovery objectives, restore tests and exercises are practice for other entities, adopted and justified under article 21(1).
• Recovery never pauses the article 23 deadlines.