Content library
NIS2 Directive
21.2.c: Business continuity and backups

How to fill the requirement

NIS2 Directive

21.2.c: Business continuity and backups

Task name
Priority
Status
Theme
Policy
Other requirements
Documenting and delegating ownership of own backup processes
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
18
requirements

Task is fulfilling also these other security requirements

I24: Varmuuskopiointi
Katakri
12.3.1: Information backup
ISO27 Full
12.3: Backup
ISO27 Full
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
1. Task description

In connection with the data systems listing, we describe for which systems we are responsible for the implementation of the backup. The organization’s own backup processes are documented and an owner is assigned to each. The documentation includes e.g.:

  • which system is used for backing up data?
  • how are the backups protected (encryption, physical location)?
  • how long are the backups retained?
Regular testing, evaluation, and recovery instructions for backups
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
22
requirements

Task is fulfilling also these other security requirements

12.3: Backup
ISO27 Full
12.3.1: Information backup
ISO27 Full
12.1.1: Documented operating procedures
ISO27 Full
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
1. Task description

The media used for backups and the restoration of backups are tested regularly to ensure that they can be relied on in an emergency.

Accurate and complete instructions are maintained for restoring backups. The policy is used to monitor the operation of backups and to prepare for backup failures.

Creating and documenting continuity plans
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Continuity management
34
requirements

Task is fulfilling also these other security requirements

T05: Jatkuvuuden hallinta
Katakri
17.1.2: Implementing information security continuity
ISO27 Full
​​​​​​​ID.SC-5: Response and recovery
NIST
PR.IP-9: Response and recovery plans
NIST
RC.RP-1: Recovery plan
NIST
1. Task description

Sometimes an unexpected event, such as a fire, flood, or equipment failure, can cause downtime. In order to be able to continue operations as quickly and smoothly as possible, continuity planning is carried out, i.e. planning the operations in advance for these exceptional situations.

Each continuity plan shall contain at least the following information:

  • Event for which the plan has been made
  • Goal for recovery time
  • Responsible persons and related stakeholders and contact information
  • Planned immediate actions
  • Planned recovery steps
Regular testing and review of continuity plans
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Continuity management
29
requirements

Task is fulfilling also these other security requirements

17.1.3: Verify, review and evaluate information security continuity
ISO27 Full
​​​​​​​ID.SC-5: Response and recovery
NIST
PR.IP-10: Response and recovery plan tests
NIST
RS.IM-2: Response strategies update
NIST
RC.IM-2: Recovery strategies
NIST
1. Task description

The organisation should regularly, at least annually, test and review its information security continuity plans to ensure that they are valid and effective in adverse situations.

Testing of continuity plans shall involve, as appropriate, stakeholders critical to each plan. The organisation should identify and document the necessary contacts with suppliers and partners

In addition, the adequacy of continuity plans and associated management mechanisms should be reassessed in the event of significant changes in operations.

Determining responsibilities for backing up important information assets
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Backups
16
requirements

Task is fulfilling also these other security requirements

I24: Varmuuskopiointi
Katakri
12.3.1: Information backup
ISO27 Full
12.3: Backup
ISO27 Full
PR.IP-4: Backups
NIST
TEK-20: Varmuuskopiointi
Julkri
1. Task description

With adequate backups, all important data and programs can be restored after a disaster or media failure. An important first step in a functional backup strategy is to identify who is responsible for backing up each piece of data. Determining the responsibility for backup is the responsibility of the owners of the information assets (systems, hardware).

If the backup is the responsibility of the partner, we will find out:

  • how comprehensively does the partner back up the data?
  • how the data can be recovered if necessary?
  • how the backups are agreed in the contracts?

If the backup is our own responsibility, we will find out:

  • whether the data backup process exists and is documented?
  • whether the coverage and implementation cycle of the backup is at the level required by the importance of the data?
Communication to stakeholders on continuity plans
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Risk management and leadership
Continuity management
11
requirements

Task is fulfilling also these other security requirements

VAR-03: Jatkuvuussuunnitelmat
Julkri
34: Sidosryhmien välisen viestinnän mahdollistaminen
Sec overview
21.2.c: Business continuity and backups
NIS2
CC2.3: Communication with external parties
SOC 2
CC7.5: Recovery from security incidents
SOC 2
1. Task description

The organization shall have procedures in place to communicate effectively with stakeholders and other participants during continuity plans and survival procedures.

Communication plans related to continuity plans shall include:

  • Responsible persons, related stakeholders and other necessary contact information
  • Clear criteria for the situation where continuity communication will be implemented
  • A clear description of the staff implementing the continuity communication in each situation and the recipients to whom the communication will be sent
  • References to the templates and tools to be used
No items found.