# Does NIS2 require backups and a business continuity plan?

Yes. Article 21(2)(c) lists business continuity, such as backup management and disaster recovery, and crisis management among the minimum measures. In practice, an entity in scope should be able to show: which services and systems are critical and how long they may be down; backups of those systems, kept so that an attacker who controls the network cannot delete or encrypt them, for example offline or immutable copies; restore tests with recorded results and times; a recovery order; and a crisis plan with roles, contact lists on paper and a way to communicate without company e-mail. Practise it at least yearly. Supervisors and insurers both ask for restore-test evidence. NetSenX does not back up or restore anything; it can raise an alert when a device starts touching many file shares or sending data out, which often comes before ransomware locks systems.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/does-nis2-require-backups-and-business-continuity

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What does NIS2 say about supply chain security?](https://netsenx.com/en/faq/what-does-nis2-say-about-supply-chain-security)
- [Does NIS2 require an inventory of IT assets?](https://netsenx.com/en/faq/does-nis2-require-an-asset-inventory)
- [Who supervises NIS2 compliance, and what can the supervisor do?](https://netsenx.com/en/faq/who-supervises-nis2-and-what-can-they-do)
- [Does NIS2 apply to companies based outside the EU?](https://netsenx.com/en/faq/does-nis2-apply-to-companies-outside-the-eu)
- [What evidence will a NIS2 supervisor ask for?](https://netsenx.com/en/faq/what-evidence-will-a-nis2-supervisor-ask-for)