Evidence · NIS2 · critical infrastructure · BSI
Backed up is good. Provably backed up is better.
Anyone who falls under NIS2, operates critical infrastructure or works to BSI IT-Grundschutz has to be able to show that backups run, are kept and are restored. For this, the AegisGrid backup server keeps a log that cannot be changed unnoticed – and turns it into a signed report every month.
What is recorded
- Every incoming backup and mirroring with computer, address and amount of data
- Every restore and every check restore with its result
- Every job with its trigger: schedule, event, previous job or who started it
- Interventions in the data: deleted backups, changed retention, space freed
- Damage found and backups rejected because of a quota
- The server's clock: daily time synchronisation, jumps are noted
Chained and sealed
- Every entry carries the SHA-256 checksum of its predecessor – across all days
- Every day is signed with its own Ed25519 key and checked right afterwards
- The server reports a deviation by email at once
- Entries go to disk immediately; gaps after a crash are noted
- Kept for ten years by default – and never shorter than the oldest existing backup
A copy in a second place and to the SIEM
- Every entry at once to your syslog server or SIEM (RFC 5424, over UDP, TCP or TLS)
- In addition or instead, every sealed day to a second backup server that checks it and stores it immutably
- A differing second version of a day is rejected and reported
- If the other side fails, nothing is lost: the transfer catches up
Report and export for auditors
- Monthly evidence report as a PDF: backups, failures, restores, check restores, interventions, damage
- With the state of the log and the mapping to the requirements
- Signed and sent by email to the operator, also per customer if you wish
- Export as CSV for Excel or as JSON, filtered by period, kind, customer or directory
- Every export and every report can be checked against its signature
- In the target console: the log with filters, “Check chain”, export and report with one click
3-2-1-1-0 in one run – and proven
The BSI recommends the 3-2-1 rule: three copies, two media, one off site. The 3-2-1-1-0 rule adds an immutable copy and zero errors in the check. With AegisGrid this happens in a single run: the source is read once and up to eight destinations are written at the same time – a USB disk, a WORM backup server on site and a backup server off site, for example.
Every copy on a backup server is recorded there in the evidence log. The regular check of all data and the check restore prove the “0” – both logged as well and included in the monthly report.
- 3 copies – up to eight destinations in one run
- 2 media – disk, NAS, backup server, tape or USB disk
- 1 off site – second site or cloud storage
- 1 immutable – WORM with a retention lock
- 0 errors – check and check restore, proven
What the log proves
The evidence report contains the same mapping.
| Requirement | Content | What AegisGrid proves |
|---|---|---|
| NIS2 Directive Art. 21(2)(c) | Backup management and disaster recovery | Every backup, every restore, every check restore with its result, checks and damage |
| BSI IT-Grundschutz CON.3 | Backup concept | Regularity and completeness of the backups, retention, deletions, restore tests |
| BSI IT-Grundschutz OPS.1.1.5 | Logging | Tamper-proof log with chain, seal, time synchronisation and a copy in a second place |
| Critical infrastructure operators | Proof of appropriate precautions to the authority | The same records as a signed report and export for audits |
The report supports the proof. Whether an organisation meets the requirements depends on more than the backup – on the concept, the organisation and further measures. We will gladly advise you on what makes sense for your company.
Questions about the evidence
Do we automatically comply with NIS2 with AegisGrid?
No, no software alone makes a company NIS2-compliant. For the area of backup and restore, AegisGrid provides solid, signed records. They are one building block of your overall concept.
Does the log replace a SIEM?
No, it complements your SIEM. Every entry can go to your SIEM at once via syslog (RFC 5424, also encrypted over TLS) and be evaluated there together with other events. The log on the backup server also remains as a verifiable source.
Is a backup to a USB disk recorded in the log, too?
The backup server keeps the evidence log of what arrives and happens there. A backup straight to a USB disk or a NAS reports its result in the log of the backed-up computer and by email. Whoever needs evidence additionally writes to a backup server in the same run.
What is not in the log?
The evidence log is about the data: what was backed up, restored, checked, deleted or changed. Logins to the server and changes of the configuration are in the system log of the server.
Would you like to see a sample report?
We show you the log and the evidence report in a conversation or in a pilot project on your own systems.