the work
backups and recovery
A backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that shows the control runs.
the reality
This duty has the shortest route from reading to real evidence. A single restore test is small enough to do this month, and its record shows that the control runs, which a policy document cannot show. You also find out how long recovery takes before you need it.
For the board, the question is plain: how long can we be down, and has anyone proved we can come back in that time?
basis NIS2 Art. 21(2)(c); GDPR Art. 32(1)(c)
what to decide
- How long each service can be down, and how much data you can losechief executive, with operations
- What comes back firstchief executive
- Who runs a crisis when email is downchief executive
basis NIS2 Art. 21(2)(c); DORA Art. 11(1). Who decides is practice.
who decides when the systems are down
basis working practice. No legal text sets this.
what to build
- Write the down-time and data-loss limits for your five main services.
- Restore one real system from backup to a clean place. Time it and write down what was missing.
- Keep one backup out of reach of your normal admin accounts, then test whether one stolen admin login could delete all of them.
- Write a short crisis plan: who decides, how you talk when email is down, who speaks to customers.
- Print the contact sheet and keep a copy away from your systems.
basis NIS2 Art. 21(2)(c); DORA Art. 12(1); GDPR Art. 32(1)(c); KSC Art. 8(1)(2)(f); IR 2024/2690 Annex 4.1, 4.2, 4.3 as a reference
a backup counts once you have restored from it
- 1back upscope and frequency written down
- 2restoreone real system, to a clean place
- 3time itagainst what the business said it could stand
- 4write the gapswhat was missing, who fixes it
- 5fixand change the plan
again on a schedule, with a different system
basis NIS2 Art. 21(2)(c); DORA Art. 12(1); GDPR Art. 32(1)(c); KSC Art. 8(1)(2)(f)
the evidence it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| restore test record: date, system, duration, gaps | head of IT | at least yearly |
| continuity plan with recovery targets | operations lead | yearly |
| backup policy: scope, frequency, retention | head of IT | yearly |
| crisis exercise record | chief executive | yearly |
basis DORA Art. 12(1); KSC Art. 8(1)(2)(f). The refresh rates are practice.
what goes wrong
backups never restored
The job reports success for years and nobody has tried the other direction.
one login deletes everything
If the same admin account reaches production and backups, one stolen password reaches both.
the plan lives in the system that is down
Keep a paper copy of the contact sheet and the first steps.
IT sets the priorities alone
What comes back first is a business decision. Make it before the day it matters.
basis working practice. No legal text sets this.
what the texts leave open
- How often to test, and what recovery time is acceptable. NIS2 gives no numbers, so set yours from the business and write them down.
- How DORA's detail applies at your size. It is proportionate, and your supervisor will have a view.
basis NIS2 Art. 21(2)(c); DORA Art. 4(1)
check it yourself
what each text says, for whoever checks this page
| text | says |
|---|---|
| NIS2 Art. 21(2)(c) | Business continuity, such as backup management and disaster recovery, and crisis management. |
| IR 2024/2690 Annex 4.1 | Listed digital providers: a continuity and recovery plan. Annex 4.2 covers backup, Annex 4.3 crisis management. |
| DORA Art. 11(1) | An ICT business continuity policy. |
| DORA Art. 12(1) | Documented backup policies, with scope and minimum frequency, and restoration procedures. |
| GDPR Art. 32(1)(c) | The ability to restore availability and access to personal data in a timely manner. |
| KSC Art. 8(1)(2)(f) | Poland: implement, document, test and maintain continuity and recovery plans. |
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Pick one system and restore it this month, with a stopwatch.