How Do You Build a Business Continuity Plan for NIS2?

A NIS2 business continuity plan is built from nine key elements. You can create it step by step: assess risks, analyse business impact, prepare response and recovery plans, arrange communication, add alternatives, protect data, secure your supply chain, then test with trained people.

What do you need before you start a NIS2 business continuity plan?

You need a mandate from top management, an overview of your critical processes and assets, the outcome of your NIS2 risk assessment, and people from IT, legal, finance, operations and communications. The plan supports article 21(2c) of NIS2, so treat it as a compliance deliverable with owners, not as an IT side project.

This guide follows The NIS2 Navigator's Handbook by Michiel Benda, which treats the business continuity plan (BCP) as a requirement under article 21(2c). The handbook describes the purpose of business continuity management like this: "Business continuity management supports the organization in: Preparing to deal with significant disruptions, Responding to a significant disruption in a structured and organized way…"

The urgency is real. The handbook's cybersecurity statistics (figure 2.3, section 2.5.1) state that "54% of organizations experienced a cyberattack in 2022". Disruption is something to plan for, not a remote possibility.

Step 1: How do you identify the risks that could disrupt your organization?

Run a risk assessment based on an all-hazards approach, as Recital 79 expects. Cover everything that threatens your network and information systems and their physical environment, from cyber-attacks to fire, flood, power failures and unauthorized physical access. The result is a list of realistic disruption scenarios that will trigger your continuity measures.

The handbook names examples such as cyber-attacks, theft, fire, flood, telecommunication or power failures, and unauthorized access to or interference with information processing facilities. The detailed NIS2 requirements for risk assessment are discussed in section 4.3.2.

Keep the scenarios grounded. The gap-assessment in Annex F.4 checks exactly this: "The organization has created a business continuity plan that addresses realistic disruptions that the organization could face."

Step 2: How do you run a business impact analysis?

List your processes, then determine for each one how long you can survive without it, to what state it must be recovered over time, and how much data you can afford to lose. These answers become your SDO, MTO, RTO and RPO values, and they decide which processes and assets get priority.

The handbook puts it this way: "A good BIA will provide you with insight into how long the organization can survive without each process, what state processes must be recovered to over time to be able to deliver on your organization's obligations, and what loss of data the organization can afford and eventually recreate after recovery." The analysis looks at the impact on your organization, your recipients, the economy, society and the welfare of natural persons. Based on that, you prioritize processes and the assets behind them, including key employees, vital systems and indispensable information.

Four objectives give the BIA its concrete output:

• Service delivery objectives (SDOs): the minimum you must deliver to stay viable. They can grow over time. A customer relations team may first need only a workplace and a phone, later a computer, and eventually its CRM system.
• Maximum tolerable outage (MTO): how long you can survive without a fully operational process. It sets the full period in which recovery must be completed.
• Recovery time objectives (RTOs): the time allowed to recover processes and assets, linked directly to the SDOs. If recovery cannot meet the RTOs, evaluate redundancy options.
• Recovery point objectives (RPOs): the amount of data you can accept losing, always expressed in time. The time needed to re-enter missing data, the work recovery time, is a key consideration.

The handbook calls the BIA results one of the most essential inputs for the plan, so finish this step before you write anything else.

Step 3: How do you set up incident, emergency and disaster recovery plans?

Write three linked plans. The incident response plan sets protocols and escalation to the crisis management team, the emergency response plan covers the first minutes when life or environment is at risk, and the disaster recovery plan restores assets in line with your BIA. Each plan gets a clear trigger and owner.

• Incident response plan: a quick, structured response reduces the impact on you and on others. Include protocols and, where appropriate, escalation to the crisis management team, which is mandated to invoke the business continuity plan. The handbook covers incident response in section 4.5.3.
• Emergency response plan: describe how to summon the emergency response team, start evacuation procedures, execute the communication plan and put health and safety first.
• Disaster recovery plan: cover everything needed to return to business as usual, with a large share devoted to recovering information and information assets. Align recovery efforts with the BIA. Section 4.5.2 goes deeper.

Step 4: How do you plan communication during a disruption?

Map every party you must inform, then prepare who tells them what, when and through which channel. Include the crisis management team, staff, critical suppliers, insurance agents, authorities and CSIRT, customers and media. The result is a communication plan with a notification protocol and ready-made templates.

Section 4.5.1.3 of the handbook gives practical pointers per audience:

• Crisis management team: notified first for significant disruptions. Its chairperson should be able to decide to invoke the plan and relocate critical processes.
• Personnel: use notification rosters and call trees. Explain in broad terms what happened, what is being done and how staff can help, and say when the next update will come.
• Critical suppliers: ideally they already know and are contractually bound to their role. Stress confidentiality.
• Insurance agents: know your agreements beforehand, including any duty to report intended financial commitments.
• Authorities and CSIRT: significant disruptions must be reported. Ideally a legal representative verifies these messages.
• Customers: inform them without undue delay when services are likely affected (article 23(1)), including measures they can take.
• Media: approach proactively with controlled statements and work with communication specialists.

One rule is easy to forget. Assume the media will learn what staff are told, so share with staff only what would be harmless if it reached the media.

Step 5: How do you cover alternate solutions, data protection and suppliers?

Decide what keeps essential processes running when recovery within your requirements is unfeasible, how data stays protected while normal controls are impractical, and how you handle supplier failure. Typical outcomes are secondary locations or systems, alternate protection measures, and named alternative suppliers with a strategy to keep goods or services flowing.

• Alternate solutions: secondary locations, systems or, if necessary, alternate staff. These matter when recovery cannot meet the requirements you set in the BIA.
• Data protection: working differently during a disruption must not introduce extra breaches. This applies to personal data and to any other data of value, so define alternative ways to protect information and systems.
• Supply chain continuity: your services often depend on your suppliers' services. Identify alternative suppliers and plan how to keep the flow going.

Step 6: How do you organize crisis management and the right skills?

Form a crisis management team with a chairperson mandated by top management and a scribe, add finance, legal, operations, IT and communications, and define roles for every response team. Select members by capability rather than title, and name backups so no single point of failure remains.

The handbook separates two things that are often confused. Business continuity management keeps service and product delivery going at a sustainable level, while crisis management focuses on resolving the crisis itself through containment and eradication. Together with disaster recovery, they are jointly referenced in article 21(2c).

Practical points from sections 4.5.1.4 and 4.5.1.5:

• Formalize any limits on the chairperson's mandate, such as financial ones, in the crisis management plan.
• The scribe tracks notes, action items and open issues, and needs to be stress resistant.
• More and more, the CISO or an information security specialist joins the team because of their insight into information risks.
• Describe the roles and relationships of the crisis management, crisis response, emergency response and crisis communications teams before any disaster.
• Make sure someone can assess the disruption and has the authority to invoke the plan based on predetermined criteria and thresholds.
• Identify who joins the core team as the crisis grows, so the team can scale.

The team can follow the OODA cycle: observe, orient, decide and act.

Step 7: How do you test and train your business continuity plan?

Schedule regular training and exercises for everyone with a role in the plan, starting with the crisis management team. Repeat them whenever members leave or are replaced. The result is a plan people can execute under pressure; the handbook covers testing and training in section 4.5.1.6.

The handbook is clear about commitment. Crisis team members must attend regular trainings and exercises, review their roles and responsibilities, and keep their knowledge current, or step back in favor of someone more capable. Backup members need the same preparation, otherwise they cannot take over when a primary member is unavailable.

Communication deserves its own rehearsal. The handbook notes that a well-rehearsed communication plan lets you inform all stakeholders efficiently and helps limit the impact on the organization.

Let the BIA drive the plan

The priorities, RTOs and RPOs from your business impact analysis shape every other part of the plan, from recovery to alternate solutions.