Handling incidents, backups, keeping going

In detail

Handling incidents

Point (b) requires incident handling § 32(4)(b) NISG 2026. Under the EU catalogue § 2 NISV 2026 this includes (Implementing Regulation (EU) 2024/2690, Annex point 3):

• a policy with roles, responsibilities and procedures for detecting, analysing, containing, recovering, documenting and reporting, a way to categorise incidents, communication and escalation plans, and documents such as playbooks, contact lists and templates; tested and reviewed at planned intervals (point 3.1);
• monitoring and logging, automated where feasible. Where appropriate, the logs include relevant inbound and outbound network traffic, creating, changing and deleting users and permissions, access to systems, authentication events, all privileged access, access to configuration and backup files, and alerts from anti-virus, intrusion detection and firewalls. Logs are kept for a set period, protected against change, reviewed regularly, and system clocks are synchronised (point 3.2);
• a simple reporting channel through which staff, suppliers and customers can report suspicious events; staff are trained to use it regularly (point 3.3);
• assessment and classification against criteria set in advance, and a quarterly check for recurring incidents (point 3.4; cf. § 7 NISV 2026);
• response under documented procedures: contain, eradicate, recover; with plans for communicating with the CSIRT and internally; with evidence collected; practised regularly (point 3.5);
• a post-incident review with the root cause and lessons learned, fed into policies and measures (point 3.6).

Business continuity

Point (c) requires business continuity, such as backup management and disaster recovery, and crisis management § 32(4)(c) NISG 2026:

• A continuity plan for keeping going and recovering, based on the risk assessment: purpose, roles, contacts and channels, conditions for activating and ending it, order of recovery, recovery objectives, resources needed. Plus a business impact analysis from which the continuity requirements for the systems follow; tested and reviewed (point 4.1).
• Backups under a backup plan with recovery times; complete and accurate, including configuration data and data in cloud services; online or offline at secure locations that are not on the same network as the system and far enough away to survive a disaster at the main site; with access controls and retention periods; with regular integrity checks and regular, documented restore tests (point 4.2).
• Redundancy, at least partly, of systems, premises and equipment, staff with the necessary authority, and communication channels (point 4.2.4).
• Crisis management with roles, communication with the authorities, including the mandatory reports and their deadlines, and a way to handle warnings from CSIRTs; tested at planned intervals (point 4.3).
• Supporting utilities: protection against failures of power, telecoms, air conditioning and the like, with redundancy and emergency supply where appropriate (point 13.1).

Note the link to the reporting duty: if an incident leads to activating crisis management or a disaster recovery plan, the incident is significant in any case § 5(1) no. 9 NISV 2026 (lesson 5.1).