NIS2 and backup: what companies have to prove

What NIS2 says about backup

The NIS2 Directive (EU) 2022/2555 obliges companies in important sectors to take measures for their cybersecurity. Article 21(2) lists the minimum measures. Point (c) covers business continuity, such as backup management and disaster recovery, and crisis management.

Two further points of the same list concern backup directly: point (f) requires policies and procedures to assess the effectiveness of the measures – for backups this means testing the restore. Point (h) requires the use of cryptography and encryption where appropriate.

Article 20 places responsibility with the management: the management bodies must approve the measures, oversee their implementation and receive training on them. Backup is thus explicitly a matter for the top.

Who is affected

NIS2 applies to companies in the sectors listed in Annexes I and II of the Directive – for example energy, transport, health, digital infrastructure, IT services for other companies (managed services), waste, chemicals, food, manufacturing of critical products and digital services. As a rule, medium-sized and large companies in these sectors are affected, that is, those with 50 or more employees or an annual turnover and balance sheet total of more than 10 million euros. For some areas, NIS2 applies regardless of size.

In Germany, the NIS2 Implementation Act transposes the Directive into the BSI Act. Entities concerned must register with the BSI, Germany's Federal Office for Information Security. Whether and how your company is covered should be checked case by case; the BSI offers an online check for this. In other EU countries, the national transposition law and the competent authority there apply.

What auditors want to see in backups

Laws name objectives, not products. In practice, however, audits come down to the same questions:

Five steps to backups you can prove

1. Write a plan: define the systems, data volumes, backup frequency, retention and the maximum tolerable downtime for each system. What belongs in it is shown in the guide Backup plan.
2. Several copies in several places: at least one copy off-site and one immutable – the 3-2-1-1-0 rule is a good guideline for this.
3. Test the restore regularly – not just once a year by hand, but continuously and documented. How to do this automatically is shown in the article Testing restores.
4. Log everything that happens to the backups, and protect the log against later changes.
5. Report: management regularly receives an understandable report and can thus prove that it fulfils its oversight duty.

What happens if it is missing

The Directive provides for substantial fines: for essential entities up to 10 million euros or 2% of worldwide annual turnover, for important entities up to 7 million euros or 1.4% – whichever is higher. Often the damage itself weighs more heavily: without a working restore, a company stands still for days or weeks after a ransomware attack.

How AegisGrid helps

AegisGrid writes to up to eight destinations in one run, including immutable and off-site ones. The backup server automatically restores backups as a test and starts virtual machines in an isolated sandbox. Every backup, restore, check and deletion is recorded in a chained, daily signed evidence log, which can be sent to your SIEM immediately if you wish. Every month it produces a signed evidence report as a PDF – for auditors and for management.

This article is a general introduction and not legal advice. No software on its own makes a company NIS2-compliant; backup is one building block of an overall concept.