[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-c":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-c","Article 21(2)(c)","Business continuity, backups and crisis management (Article 21(2)(c))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (c) requires measures for business continuity, such as backup management and disaster recovery, and for crisis management. Entities must be able to keep operating or recover essential services after a serious incident.\n\n**In practice.** The entity performs business impact analysis, defines recovery objectives, maintains continuity and disaster recovery plans, and keeps protected backups, including copies isolated from production. Plans and restores are tested, and a crisis management structure with clear roles and communication channels is in place. Evidence includes plans, test results, backup reports and crisis exercise records.\n\n**Common gaps.** Backups are frequently untested or reachable by the same credentials an attacker would compromise. Crisis management plans often ignore the scenario where IT and communication tools are themselves unavailable.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},13,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"faa-communications-failure-halts-all-us-flights","FAA Communications Failure Halts All U.S. Flights","2026-11-13T22:20:21.497+00:00",{"slug":24,"title":25,"published_at":26},"microsoft-365-outage-exposes-risks-of-unvalidated-network-changes","Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes","2026-11-13T20:20:57.119+00:00",{"slug":28,"title":29,"published_at":30},"microsoft-365-cascading-failure-exposes-risks-of-hyperscaler-dependency","Microsoft 365 Cascading Failure Exposes Risks of Hyperscaler Dependency","2026-11-13T18:20:58.32+00:00",{"slug":32,"title":33,"published_at":34},"ransomware-encrypts-cloud-providers-infrastructure-disrupting-customers-for-days","Ransomware Encrypts Cloud Provider's Infrastructure, Disrupting Customers for Days","2026-11-13T15:20:40.884+00:00",{"slug":36,"title":37,"published_at":38},"faulty-update-triggers-global-microsoft-outage-echoing-crowdstrike-incident","Faulty Update Triggers Global Microsoft Outage, Echoing CrowdStrike Incident","2026-11-13T14:20:22.59+00:00",{"slug":40,"title":41,"published_at":42},"beast-ransomwares-hidden-control-panel-enables-targeted-encryption-across-networks","Beast Ransomware's Hidden Control Panel Enables Targeted Encryption Across Networks","2026-11-13T09:20:42.408+00:00",{"slug":44,"title":45,"published_at":46},"microsoft-365-global-outage-exposes-gaps-in-resilience-and-configuration-recovery","Microsoft 365 Global Outage Exposes Gaps in Resilience and Configuration Recovery","2026-11-13T08:21:35.526+00:00",{"slug":48,"title":49,"published_at":50},"microsoft-cloud-outage-exposes-infrastructure-resilience-gaps","Microsoft Cloud Outage Exposes Infrastructure Resilience Gaps","2026-11-12T22:20:36.446+00:00",{"slug":52,"title":53,"published_at":54},"microsoft-365-outage-highlights-cloud-resilience-and-business-continuity-risks","Microsoft 365 Outage Highlights Cloud Resilience and Business Continuity Risks","2026-11-12T21:21:12.784+00:00",{"slug":56,"title":57,"published_at":58},"ot-resilience-gap-cisos-overconfident-engineers-know-better","OT Resilience Gap: CISOs Overconfident, Engineers Know Better","2026-11-12T06:20:18.783+00:00",{"slug":60,"title":61,"published_at":62},"polands-epuap-cyberattack-highlights-importance-of-rapid-detection-and-precautionary-shutdown","Poland's ePUAP Cyberattack Highlights Importance of Rapid Detection and Precautionary Shutdown","2026-11-11T14:21:36.986+00:00",{"slug":64,"title":65,"published_at":66},"ddos-for-hire-group-extorts-victims-for-5000-to-stop-attacks","DDoS-for-Hire Group Extorts Victims for $5,000 to Stop Attacks","2026-11-10T14:23:02.184+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",8,{"slug":74,"name":75,"problem":76,"stories":77},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",5,{"slug":79,"name":80,"problem":81,"stories":82},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",4,{"slug":84,"name":85,"problem":86,"stories":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,{"slug":89,"name":90,"problem":91,"stories":87},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":93,"name":94,"problem":95,"stories":96},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,[98,102,107,113,118,122,126,130],{"family":5,"item":99,"code":100,"title":101,"together":77},"21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",{"family":103,"item":104,"code":105,"title":106,"together":82},"nist-800-53","cp-2","CP-2","Contingency Plan",{"family":108,"item":109,"code":110,"title":111,"together":112},"cis","11","Control 11","Data Recovery",3,{"family":114,"item":115,"code":116,"title":117,"together":112},"nist-csf","rc-rp","RC.RP-1","Recovery Planning (CSF 1.1)",{"family":114,"item":119,"code":120,"title":121,"together":112},"rs-co","RS.CO-2","Incident Response Reporting and Communication",{"family":114,"item":123,"code":124,"title":125,"together":87},"de-cm","DE.CM-1","Continuous Monitoring",{"family":114,"item":127,"code":128,"title":129,"together":87},"gv-rm","GV.RM","Risk Management Strategy",{"family":103,"item":131,"code":132,"title":133,"together":87},"cp-10","CP-10","System Recovery and Reconstitution"]