What it asks for. Point (c) requires measures for business continuity, such as backup management and disaster recovery, and for crisis management. Entities must be able to keep operating or recover essential services after a serious incident.
In practice. The entity performs business impact analysis, defines recovery objectives, maintains continuity and disaster recovery plans, and keeps protected backups, including copies isolated from production. Plans and restores are tested, and a crisis management structure with clear roles and communication channels is in place. Evidence includes plans, test results, backup reports and crisis exercise records.
Common gaps. Backups are frequently untested or reachable by the same credentials an attacker would compromise. Crisis management plans often ignore the scenario where IT and communication tools are themselves unavailable.