NIS2 and backup: what the law expects from your backups

Who NIS2 applies to

The European NIS2 directive was transposed in Belgium by the law of 26 April 2024, with the Centre for Cybersecurity Belgium (CCB) as supervisor. It applies to "essential" and "important" entities in sectors such as energy, transport, health care, water, digital infrastructure, food, chemicals, waste and the manufacturing of machinery and vehicles, among others. The threshold is usually medium-sized companies (50 employees or 10 million euro turnover), but suppliers of a NIS2 entity often get the requirements passed on contractually.

So even those outside the law's scope have to deal with it: through customers, through insurers, through tenders.

What article 21 says about backup

Article 21, paragraph 2 lists ten measures every entity must take. Point (c) reads: business continuity, such as backup management and disaster recovery, and crisis management. In addition, (a) risk analysis, (f) policies and procedures to assess the effectiveness of measures and (h) cryptography and encryption are directly relevant to backups.

Three words do the work: management, disaster recovery and assess effectiveness. Having a backup is not enough. You must be able to show that it is managed (who, how often, how long retained), that there is a plan to recover with it, and that you regularly check whether that plan works.

How CyFun translates it

The CCB has published the CyberFundamentals Framework (CyFun) as a practical implementation, with the levels Basic, Important and Essential. For backup these requirements matter most:

CyFun	Requirement	What you must be able to show
PR.IP-4	Backups of information are made, maintained and tested	schedule, retention, test results per system
PR.DS-1	Data at rest is protected	encryption, and who holds the key
PR.PT-5	Mechanisms for resilience	immutable copy, separate location
RC.RP-1	Recovery plan is executed during or after an incident	a tested recovery plan with measured recovery times
DE.CM	Continuous monitoring	alerts on failed backups and anomalies

The Important level explicitly requires that the integrity of backups is checked and that backups are kept offline or separated from the network. The Essential level adds regular recovery tests.

What an auditor wants to see

An auditor does not read promises. Per period they want:

1. Which systems are protected, and how often.
2. That the backups succeeded, with date and size.
3. That they were restored, by whom, when, how long it took.
4. That the storage is immutable and where it is.
5. Who can access the keys.
6. That none of this can have been rewritten afterwards.

That last point is the hardest. A log in a spreadsheet proves nothing. A ledger that can only grow, where every record refers to the previous one and which is publicly anchored every day, does.

What Zekura does for NIS2

Zekura issues a report per organisation every quarter with exactly those six points, in Dutch, French or English. At the back is the norm mapping: for every requirement from NIS2 article 21(2)(c), ISO/IEC 27001:2022 A.8.13, CyFun PR.IP-4, DORA articles 11 and 12 and GDPR article 32(1)(c), which evidence is in the report and whether the requirement is met, judged on the facts of that period. The sha256 of the report goes into the evidence chain, which the auditor can recompute without Zekura.

The report does not have to come from us to be useful: an auditor can check the chain export themselves against the daily published anchor.

A practical checklist

• Is it defined which systems get a backup, how often and for how long? Is that in a policy an owner has signed?
• Is at least one copy immutable, with a retention period that covers your risk?
• Is every backup verified automatically, and is at least one system really restored every week?
• Do you know your actual recovery time, measured rather than estimated?
• Does someone get an alert when a backup fails or does not start, and is that alert acknowledged?
• Can you still demonstrate all of this for an arbitrary quarter of last year?

Whoever answers yes to all six has the backup part of NIS2 in order. For the rest of the chain (policy, risk analysis, incident reporting) Zekura works with Konforma, which maintains the compliance file.

Frequently asked questions

Do I have to report my backups to the CCB?

No. You have to report incidents (a first notification within 24 hours, an update within 72 hours). Your backups are what helps you recover from such an incident, and the proof that you took the measures of article 21.

Is my IT partner's backup sufficient?

If your IT partner gives you the evidence every quarter, yes. Ask for it. A good partner has it ready; Zekura is built so that IT partners can do that automatically for every customer.

Does this also apply to Microsoft 365?

Yes. Your mail and documents fall under your information security, not Microsoft's. Read the guide on Microsoft 365 backup.