Are întreprinderea un plan pentru continuarea activității în caz de perturbații grave?

Business continuity as a separate measure within Article 21(2)

This question concerns business continuity management: does the enterprise have a plan to continue operations if an incident disrupts normal activities. This is one of the ten measures that Article 21(2) of the NIS2 Directive lists, alongside risk analysis, incident handling and access control, among others. The wording of that provision explicitly mentions backup management, disaster recovery and crisis management as components of this theme — so it is not merely about a written plan, but about a coherent set of recovery arrangements.

A full "yes" presumes more than a statement of intent. Questioners typically expect that a continuity plan exists, that it has been tested or exercised, and that it contains concrete elements: an alternative location or facility, a backup strategy with recovery points, and a crisis organization with defined roles and escalation lines. If any of these components is missing, "to be determined" or "partial" is often a more honest answer than a full "yes" — especially since many customer portals follow up with a request to upload the plan or a summary of it.

What is requested as evidence

The basis follows directly from Article 21(2)(c) of Directive (EU) 2022/2555: business continuity, including backup management and disaster recovery, and crisis management. This is one of the ten concrete measures the Directive lists as part of the risk management that entities must implement. Those who substantiate the answer typically do so with the continuity plan itself, a test report from the last exercise, or an overview of backup and alternative facilities. This aligns with how sectorul în care operează întreprinderea affects what a questioner considers "adequate": a critical sector often receives stricter follow-up questions than an enterprise that only occasionally supplies larger customers. The question about the number of employees of the enterprise also sometimes plays a role here, because the size of the organization influences what a realistic continuity plan should contain — a sole proprietor with an external hosting provider simply has different recovery needs than an enterprise with its own server infrastructure.