Does the undertaking have a plan to continue operations in case of serious disruption?

Business continuity as a separate measure under Article 21(2)

This question concerns business continuity management: does the undertaking have a plan to continue its business operations if an incident disrupts normal operations. This is one of the ten measures listed in Article 21(2) of the NIS2 Directive, alongside risk analysis, incident handling and access control, among others. The wording of that paragraph explicitly mentions backup management, disaster recovery and crisis management as components of this theme — so it is not merely about a written plan, but about a coherent set of recovery measures.

A complete "yes" presupposes more than a statement of intent. Questioners typically expect that a continuity plan exists, that it has been tested or exercised, and that it contains concrete elements: an alternative site or facility, a backup strategy with recovery points, and a crisis management structure with roles and escalation lines. If any of these elements is missing, "to be determined" or "partial" is often a more honest answer than a complete "yes" — particularly since many customer portals follow up by requesting that the plan or a summary be uploaded.

What is requested as evidence

The justification follows directly from Article 21(2)(c) of Directive (EU) 2022/2555: business continuity, including backup management and disaster recovery, and crisis management. This is one of the ten concrete measures the Directive lists as part of the risk management that entities must implement. Those substantiating their answer typically do so with the continuity plan itself, a report of the most recent exercise or test, or an overview of backup and alternative site provisions. This aligns with how the sector in which the enterprise operates affects what a questioner considers "adequate": an entity in a critical sector often receives stricter follow-up questions than an undertaking that only occasionally supplies larger customers. The question about the number of employees of the undertaking sometimes plays a role here, as the size of the organisation is relevant to what a realistic continuity plan should contain — a sole proprietor with an external hosting provider has different alternative site requirements than an undertaking with its own server infrastructure.