Short answer: NIS2 and business continuity go hand in hand: the directive is not only about stopping attacks, it is also about keeping going when things do go wrong. Article 21 of the directive explicitly names business continuity as part of the duty of care: backup management, disaster recovery and crisis management. In the Netherlands this has applied since 15 August 2026 through the Dutch Cybersecurity Act (Cyberbeveiligingswet), with the board as the party ultimately responsible. Organisations must therefore be able to show how quickly critical processes run again, and how they keep communicating and sharing information securely during an incident.
Updated on 4 November 2026
When organisations think of NIS2, they often think of firewalls, MFA and patch policies first. That is understandable, but it is only half the story. The directive explicitly assumes that incidents will keep happening. The question is then not only how you prevent them, but also how quickly you are operational again and whether you can prove it.
In this article you will read what NIS2 and the Dutch Cybersecurity Act require for business continuity, what that means for industry, critical infrastructure and the financial sector, and why exchanging information during an incident is an often forgotten part of your continuity plan.
What does NIS2 require for business continuity?
Article 21 of the NIS2 Directive lists the minimum measures organisations must take. Business continuity is named explicitly, with backup management, disaster recovery and crisis management as examples. The directive also requires an incident handling policy and attention to supply chain security.
Three other elements make business continuity a board matter:
- Board accountability. Management bodies must approve the measures, oversee their implementation and take part in training themselves (Article 20).
- Reporting obligation. A significant incident is reported with an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23).
- Supervision. The supervisory authority can ask how you have organised continuity and whether you have tested it.
The Dutch implementation, the Cybersecurity Act, took effect on 15 August 2026 together with the Critical Entities Resilience Act, for over 8,000 organisations in 18 sectors (Dutch government, Dutch source). Read more about the law on our page about NIS2 and secure file sharing.
Ransomware is the biggest continuity risk
According to the Verizon Data Breach Investigations Report 2026, ransomware played a role in 48% of the breaches examined, up from 44% a year earlier. 69% of affected organisations did not pay. In most cases, recovery from your own backups and a well-rehearsed crisis plan make the difference between days and weeks of downtime.
The supply chain matters too: according to the same report, third parties were involved in 48% of breaches. An outage or attack at a supplier can hit your own continuity just as hard as an attack on your own systems.
NIS2 and business continuity by sector
Industry and manufacturing
Production lines are highly automated and connected to IT systems for planning and logistics. A ransomware attack on office systems can therefore also stop production. Separate IT and OT networks, set a recovery order per production line and use stock as a buffer. Also read how to share files in OT environments securely.
Energy, water, transport and other critical infrastructure
Here, an outage directly affects society. Redundancy, failover and scenarios for manual operation are essential. Organisations designated as critical entities also have obligations under the Critical Entities Resilience Act, which covers physical resilience as well.
Banks, insurers and other financial institutions
For the financial sector, DORA applies as the specific regime. DORA requires a dedicated ICT business continuity policy, recovery plans and regular testing, and puts strong emphasis on the continuity of ICT service providers. Read more about DORA and secure file sharing.
The forgotten link: sharing information during an incident
Continuity plans usually focus on systems and backups. But during an incident you also need to share information: log files with a forensic investigator, policy details with the insurer, a substantiated notification to the supervisory authority and updates to customers and supply chain partners. That is exactly when people are tempted to “quickly” send something by email or through a private channel.
So agree in advance:
- which channel you use in a crisis to share sensitive files with external parties;
- who has access to it, even if the usual workplace is unavailable;
- how you can show afterwards who received which information.
That last point is more than a formality. The reporting obligation requires a substantiated picture of what happened, and in the case of a data breach you must also be able to show which data ended up with whom. Read why emailing sensitive documents creates risks, especially then.
How to turn NIS2 and business continuity into action
- Map critical processes and dependencies. Which processes must run again first, and which systems and suppliers do they depend on?
- Set recovery objectives. Define the maximum recovery time (RTO) and maximum data loss (RPO) per process, and have the board approve them.
- Actually test recovery. A backup is only evidence once you have shown you can restore from it. Record the results.
- Assess supplier continuity. Ask about their recovery plans, recovery times and reporting arrangements, and include them in contracts.
- Rehearse the crisis, including communication. Run a tabletop exercise that also covers the reporting deadlines and secure information sharing with external parties.
Want to know how to organise this demonstrably? Read our article on demonstrable compliance and how the Dutch Cybersecurity Act asks for evidence per file transfer.
How Msafe supports continuity of information exchange
Msafe Secure File Transfer is built for sharing sensitive files securely with external parties. That helps in daily practice, and certainly during an incident:
- One fixed route for sensitive files, so nobody has to improvise in a crisis.
- Recipient verification with, for example, a one-time code by phone, also for external parties without an account.
- An audit trail per transfer, so you can show who received which information.
- Access you can revoke as long as a file has not been downloaded, and expiry dates per share.
- Large files up to 1 TB as standard, useful for log files and images.
Msafe is certified to ISO/IEC 27001:2022 and hosted in the Netherlands. A tool does not replace a continuity plan, but it does make information sharing an organised and demonstrable part of it.
Frequently asked questions about NIS2 and business continuity
NIS2 and business continuity: law and sectors
Article 21 of NIS2 names business continuity as a mandatory part of the duty of care, with backup management, disaster recovery and crisis management as examples. Organisations must be able to show that critical processes run again after an incident.
The Dutch Cybersecurity Act, the Dutch implementation of NIS2, took effect on 15 August 2026. The board is ultimately responsible for the measures.
For financial institutions, DORA applies as the specific regime. DORA sets its own requirements for ICT business continuity, recovery plans and testing, and for the continuity of ICT service providers.
NIS2 and business continuity in practice
The RTO (recovery time objective) is the maximum time within which a process must run again. The RPO (recovery point objective) is the maximum acceptable data loss, expressed in time. Together they determine how you set up backups and recovery.
During an incident you need to share sensitive information quickly with forensic investigators, insurers and supervisory authorities, among others. Without a secure route agreed in advance, workarounds appear and you cannot show afterwards who received which information.
Want to know how to cover information exchange in your continuity plan? Book a no-obligation demo.
