NIS2 One Pager

NIS2 Directive
What you can do

now to prepare for
compliance
Beginning October 17, 2024, the Network
and Information Security Directive (NIS2)
will set a new standard for cybersecurity
risk management measures and reporting
obligations. Organizations must take measures
to minimize cyber risks and ensure business
continuity to ensure compliance with NIS2.
* Business continuity:
Refers to the high level of
readiness an organization
maintains in order to
confidently execute critical
functions during or after an
What to do now:
emergency or disruption.
Get your business ready

with best practices
What you should do now is run a risk analysis to establish which of your data is
business-critical to back up, create a strong disaster recovery plan, and test to
know if it works. You can use the following Map-Prioritize-Test framework to help
guide you through the process:
1. Map critical systems 3. Test that your backup works

Assess and analyze critical infrastructure Testing is a key element of continuity.
across on-premises, native cloud, and public Ensure data recovery:
cloud environments. Identify and prioritize – Validate restoration capability promptly.
crucial data, ensuring business continuity*. – Determine acceptable downtime.
Don’t overlook SaaS applications like Entra – Regularly test backups for confidence in
ID; safeguarding identities and credentials is your dynamic disaster recovery plan and
supporting software.
vital. Neglecting identity and access data can
impact business continuity even if other data
is fully restored. Microsoft recognizes identity
systems as more critical than human life
support systems: Read more about this.
2. Prioritize: What is critical to maintain

access to?
What kind of data do you have? How do you
protect it? What is the most critical data to
regain access to in the event of an attack? Are
your CEO’s emails critical to your business
continuity? Or maybe your logistics data,
customer data, intelligence dashboards, or
code? Find out what you need to recover first.
Choosing a backup and
disaster recovery partner
After implementing the above framework, your next task is to explore solutions
tailored to your requirements. When selecting a vendor, adhere to industry best
practices for data protection. Consider the following:
Data sovereignty and privacy: Encryption and immutability:

To align with EU regulations like GDPR, ensure As natural targets for cybercriminals, backups
your data is stored in a specific geographic need robust data protection measures, both
location adhering to regional laws. Implement at rest and during transfer. Vitally important
access controls to safeguard against is ensuring data encryption and immutability
unauthorized access, and process data in to keep hackers from altering or deleting your
compliance with privacy laws. Choose a data — even if they were to gain access.
vendor experienced in data residency and
privacy regulations and one that offers a no- Vendor independence:
transmission guarantee to confidently manage Choose a cloud backup provider that ensures
data location and access. separation from your SaaS vendor’s public
cloud. Employ air-gapping measures and
Recovery time: secure data on distinct logical and physical
Recognize the impossibility of recovering infrastructures. This safeguards against
petabytes of data within seconds. Prioritize data loss during public cloud unavailability
solutions that enable the swift recovery of and prevents ransomware attacks from
identified critical data. Business continuity compromising your backups.
depends on both uninterrupted data
availability and minimizing downtime through
rapid recovery. Opt for a solution supporting
granular, instant, and prioritized recovery of
essential data.
Who do you trust to keep your data safe?
Here at Keepit, we:
– Are European born and built,
– Own and operate our infrastructure and data center regions across the globe — including two EU
locations (Denmark and Germany) and one in the UK,
– Ensure full data sovereignty with a no-transmission guarantee, regardless of privacy shield status,
– Deploy leading security measures, such as air gapping, immutability, and encryption both in
transfer and at rest,
– Guarantee full compliance with current and future EU regulations, such as NIS2 and GDPR.
NIS2 at a glance
What is the purpose of NIS2?
The purpose of NIS2 is to strengthen EU-wide cybersecurity resilience which includes a requirement for
business continuity via backup management and disaster recovery. As such, organizations must maintain
a high level of readiness to execute critical functions during a disruption (e.g., a cyberattack) or an
emergency. There is a clear priority on protecting critical business SaaS data.
NIS2 requires backup and disaster recovery

In Article 21 of NIS2, it lists several cybersecurity risk-management measures businesses need to adhere
to for business continuity, specifically “backup management and disaster recovery.”
Learn about Article 21.
Who does NIS2 apply to?

The directive applies to sectors and entities that are classified as “essential” and” important” critical
infrastructure like energy, transportation, health, and digital infrastructure. As with GDPR, which protects
personal data, NIS2 applies to the organizations on the frontlines and also their contractors.
Start a conversation today

If you’d like to receive advice on your compliance journey and discuss which steps your
business needs to take now to comply with the NIS2 directive, let’s have a conversation.
Book a meeting
www.keepit.com

NIS2 One Pager

Uploaded by

Copyright:

Available Formats

NIS2 One Pager

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

NIS2 One Pager

Uploaded by

Copyright:

Available Formats

NIS2 Directive

What you can do

Get your business ready

1. Map critical systems 3. Test that your backup works

2. Prioritize: What is critical to maintain

Data sovereignty and privacy: Encryption and immutability:

NIS2 requires backup and disaster recovery

Who does NIS2 apply to?

Start a conversation today

You might also like