[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-c":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-c","Article 21(2)(c)","Business continuity, backups and crisis management (Article 21(2)(c))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (c) requires measures for business continuity, such as backup management and disaster recovery, and for crisis management. Entities must be able to keep operating or recover essential services after a serious incident.\n\n**In practice.** The entity performs business impact analysis, defines recovery objectives, maintains continuity and disaster recovery plans, and keeps protected backups, including copies isolated from production. Plans and restores are tested, and a crisis management structure with clear roles and communication channels is in place. Evidence includes plans, test results, backup reports and crisis exercise records.\n\n**Common gaps.** Backups are frequently untested or reachable by the same credentials an attacker would compromise. Crisis management plans often ignore the scenario where IT and communication tools are themselves unavailable.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]