Are there back-ups and contingency measures to restore service delivery?

Backup and continuity stand as a separate measure in Article 21 paragraph 2

Yes, this is one of the ten measures in Article 21 paragraph 2 of the NIS2 Directive: subsection (c) explicitly mentions "business continuity, such as backup management and disaster recovery, and crisis management". The question about backups and contingency measures is therefore not a residual category or customer interpretation — it is stated literally in the Directive. Anyone receiving this question can assume it belongs to the same question block as the other nine measures: risk policy, incident handling, supply chain security, vulnerability management, testing, cyber hygiene, cryptography, access control and MFA.

What is concretely asked usually falls into two parts: are there backups (how often, where stored, when last tested) and is there a contingency measure that keeps service running or enables quick recovery after a disruption — a disaster recovery plan, alternative facilities, recovery times. A test report of a backup-restore or a continuity plan with last test date is stronger evidence than a policy document without test history. If the latter is missing, then "no" or "partial" is as useful an answer as "yes" — the customer mainly wants to know whether it is accurate, not that everything is green. This measure is often linked to the procedure for handling security incidents, because a contingency measure is usually triggered by an incident, and with the periodic testing of security measures, because a backup without test results says little about the actual recovery time.

Where exactly this is stated in the Directive

Article 21 paragraph 2 sub (c) of Directive (EU) 2022/2555 mentions "business continuity, such as backup management and disaster recovery, and crisis management" as one of the ten technical and organisational measures that fall under the security policy of an entity. The Directive itself provides no minimum testing frequency or recovery time — that determination is left to the entity and, where applicable, to national implementing legislation or sectoral requirements from the customer.