Backup and Recovery Requirements Under NIS2 and DORA
Ransomware has made backups a regulatory topic. Both NIS2 and DORA set specific expectations: what a backup plan contains, where copies are kept, how often restores are tested and how fast you must recover. Here they are side by side.
Where the requirements are
- NIS2: business continuity, "such as backup management and disaster recovery", is one of the ten minimum measures (Article 21(2)(c) of Directive (EU) 2022/2555). For digital providers, section 4.2 of the Annex to Implementing Regulation (EU) 2024/2690 spells out backup and redundancy management.
- DORA: Article 12 of Regulation (EU) 2022/2554 sets backup policies, restoration and recovery for financial entities, and Article 11 the business continuity and testing around them.
Side by side
| Topic | NIS2 (2024/2690 Annex 4.2) | DORA (Art. 11 and 12) |
|---|---|---|
| Backup plan or policy | Backup plans based on the risk assessment and continuity plan (4.2.2) | Backup policies setting the scope of data and minimum frequency by criticality or confidentiality (12(1)(a)) |
| Completeness | Assurance copies are complete and accurate, including configuration data and data in cloud services (4.2.2(b)) | Backup systems activated according to the policy without jeopardising security (12(2)) |
| Where copies are stored | Online or offline, in a safe location not in the same network as the system, far enough away to escape a disaster at the main site (4.2.2(c)) | When restoring with own systems, use ICT systems physically and logically segregated from the source (12(3)) |
| Access to backups | Physical and logical access controls in line with asset classification (4.2.2(d)) | Protected from unauthorised access or ICT corruption (12(3)) |
| Integrity | Regular integrity checks on backup copies (4.2.3) | Checks and reconciliations to ensure data integrity when recovering (12(7)) |
| Recovery objectives | Recovery times in the backup plan (4.2.2(a)) | Recovery time and recovery point objectives for each function (12(6)) |
| Retention | Retention periods based on business and regulatory requirements (4.2.2(f)) | Not specified in Article 12; set it in your backup policy in line with your other legal obligations |
| Testing | Regular testing of recovery from backups and redundancies, with results documented and corrective action (4.2.6) | Periodic testing of backup and restoration procedures (12(2)); continuity and recovery plans tested at least yearly (11(6)) |
| Redundancy | At least partial redundancy of systems, assets, personnel and communication channels (4.2.4) | Redundant ICT capacities, except microenterprises, which assess the need (12(4)) |
The common thread: a backup that has never been restored is an assumption, not a control. Both frameworks require you to test recovery and keep the results.
A backup set-up that meets both
- Classify systems and data by criticality, and set recovery time and recovery point objectives for each critical function.
- Write the backup plan: scope (including configuration and SaaS data), frequency, retention, storage locations and who may access copies.
- Separate the copies: at least one copy outside your production network and identity domain, immutable or offline, in a different location.
- Protect access: separate credentials and MFA for backup administration; ransomware often targets backup consoles first.
- Check integrity automatically and review failures.
- Test restores on a schedule: individual files monthly, a full critical system at least yearly, and record the time it took against your objectives.
- Review after incidents, major changes and test failures.
Do not forget SaaS data
Cloud services are not automatically backed up for you in a way you can restore on your own terms. The 2024/2690 Annex explicitly includes data stored in cloud computing environments in the completeness requirement. Check what each provider offers, its retention, and whether you can export data independently.
Procedures you can adopt today. The Cybersecurity Starter Pack includes a backup and restore procedure, an asset inventory, a patch and vulnerability procedure, an access review procedure and an incident response plan.
Sources
- Commission Implementing Regulation (EU) 2024/2690, Annex, section 4 (business continuity, backup and redundancy), EUR-Lex
- Regulation (EU) 2022/2554 (DORA), Articles 11 and 12, EUR-Lex
- Directive (EU) 2022/2555 (NIS2), Article 21(2)(c), EUR-Lex
Related tools
Further reading: Tabletop Exercise Scenarios · DORA ICT Risk Management Framework
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.