This guide shows how to build this in six steps, what matters in production and OT, and which records an audit wants to see. The examples are invented.
What the law and the standards require
- BSIG: § 30(2) no. 3 BSIG lists business continuity, such as backup management and disaster recovery, and crisis management as a minimum measure. Under § 30(1) BSIG the measures must be appropriate, proportionate and effective, and you must document compliance.
- Management: Under § 38(1) BSIG, management must implement the measures under § 30 and oversee their implementation. Business continuity is a leadership task, not just an IT topic.
- Implementing Regulation (EU) 2024/2690: For eleven types of entity, such as DNS service providers, cloud and data center providers, managed service providers, managed security service providers and trust service providers, no. 4 of its Annex sets out the requirements in detail. Under § 30(3) BSIG it takes precedence for these types of entity. For everyone else it is a good guide to what "appropriate" can mean. The EU agency ENISA has published technical implementation guidance on it.
- BSI-Standard 200-4: The BSI standard on business continuity management describes the business impact analysis, emergency preparedness, plans and exercises. It offers an entry in stages, from the reactive BCMS through the build-up BCMS to the standard BCMS.
- ISO 22301: The international standard "Security and resilience – Business continuity management systems – Requirements", 2019 edition, describes a certifiable management system for business continuity. ISO/IEC 27001 contains two related controls in Annex A: information security during disruption (A.5.29) and ICT readiness for business continuity (A.5.30).
The terms in one sentence each
- Business impact analysis (BIA): For each process you assess the damage if it is down for an hour, a day or a week.
- Maximum tolerable period of disruption (MTPD): From this point on, the damage is no longer bearable for the company.
- Recovery time objective (RTO): By then the process should run again, at least in emergency operation. The RTO is below the MTPD.
- Recovery point objective (RPO): The maximum number of hours of data you can afford to lose. It tells you how often to back up.
- Emergency operation: The process continues in a limited way, for example with paper lists, a spare machine or a partner plant.
Business continuity in six steps
- Set scope and ownership. Decide on sites, processes and one responsible person. Management decides on the approach and the objectives and receives regular reports.
- Carry out the business impact analysis. For each process, rate the damage over time, for example to delivery capability, finances, legal standing and the safety of people. Record dependencies: systems, machines, staff, suppliers.
- Set recovery objectives. Derive MTPD, RTO and RPO per process from the BIA. An objective that your technology cannot meet today is not a mistake but a result you work on.
- Plan strategies and backups. Decide per process how to reach the objectives: emergency operation, redundancy, spare parts, an alternate site, backups at the right frequency.
- Write plans and name the crisis management team. Recovery, emergency operation and alerting plans, a crisis management team with deputies and reachable contacts, all in one emergency manual.
- Exercise and improve. Test plans, backups and alerting regularly, record the results and work through the findings.
Backups that hold up in an emergency
No. 4.2 of the Annex to Implementing Regulation (EU) 2024/2690 describes what makes a backup reliable. Even if your company is not covered by the regulation, these are good test questions:
- Complete: Are configuration data and data in cloud services backed up as well?
- Separate: Is at least one copy outside the same network and far enough away from the main site?
- Protected: Is access to the backups controlled as strictly as access to the original data?
- Checked: Do you check the integrity of the backups and test restores regularly, with documented results?
In production there is more to it than servers and ERP: control programs, engineering projects, configurations of operator stations and switches, recipes, plus the matching firmware versions and licenses. If these files only live on a service laptop, restarting after a controller replacement is down to luck.
An example from industry
The example is invented. A maker of plastic parts supplies automotive suppliers on call-off. An attack encrypts the ERP and the manufacturing execution system (MES); the injection molding machines keep running technically. The company had done its BIA beforehand:
| Process | MTPD | RTO | RPO | Emergency operation |
|---|---|---|---|---|
| Shipping to customers | 48 hours | 24 hours | 4 hours | Delivery notes from a template, call-offs via the customer portal |
| Production control | 72 hours | 36 hours | 8 hours | Order list on paper, inspection plan printed per machine |
| Purchasing | 5 days | 3 days | 24 hours | Orders placed directly with the supplier |
| Payroll | 10 days | 5 days | 24 hours | Advance payment based on the previous month |
- What the earlier exercise had shown: A restore test of the MES took 40 hours, above its RTO. The ERP was only backed up at night, so the 4-hour RPO for shipping could not be met.
- What changed as a result: ERP backups every four hours, one immutable copy outside the production network, a prepared restore procedure for the MES and printed inspection plans at every machine.
- When it happened: The crisis management team meets according to the alerting plan, shipping runs in emergency operation after 20 hours, and the MES is back after 30 hours. The situation log records every decision with its time.
Exercises: start small, build up regularly
BSI-Standard 200-4 describes several kinds of exercise. You do not have to start with a full-scale exercise:
- Plan review (tabletop): The people involved walk through a plan at the table and find gaps without touching any technology.
- Alerting exercise: Does the alert reach the crisis management team and the deputies, also at night and on weekends?
- Command post exercise: The crisis management team works through a scenario and makes decisions under time pressure.
- Function and restore test: A system is actually switched over or restored from backup, and the time is measured.
- Full-scale exercise: Several areas practice an outage together, as close to reality as possible.
What counts is not the size of the exercise but the result: measured times compared with the objectives, findings with owners and dates, updated plans.
The evidence an audit wants to see
- An approved BIA with its date, objectives per process and next review date.
- Released plans in traceable versions and a current emergency manual.
- A list of the crisis management team with deputies and availability.
- The backup concept, records of restore tests and their results.
- Exercise reports with findings and the status of their follow-up.
- A management decision and reports on the state of implementation.
Also keep the emergency manual available offline, printed or on a separate device. If IT fails, the plan still has to be readable.
Checklist
- Scope, responsible person and management decision are in place.
- Every important process has a BIA with dependencies.
- MTPD, RTO and RPO are set per process, and the RTO is below the MTPD.
- Backups match the RPO, and one copy is kept separate and protected.
- Control programs, engineering projects and OT configurations are backed up.
- Recovery, emergency operation and alerting plans are released.
- The crisis management team is named, with deputies and current contacts.
- The emergency manual is also available offline.
- Exercises and restore tests are planned, carried out and evaluated.
- Findings from exercises have owners and dates.
Business continuity in Complass
The BIA in Excel, plans in Word, the crisis team in an email list: by the time of the audit, the connections are lost. In the business continuity module of Complass, everything fits together:
- Business impact analysis: You rate the damage per category over time in a matrix. Complass suggests MTPD and criticality from it and checks that the RTO is below the MTPD.
- Plans with approval: Recovery, emergency operation and alerting plans are prefilled from the BIA. Every release is stored as an unchangeable version, optionally with the four-eyes principle.
- Crisis team and emergency manual: Crisis management team, emergency teams and external contacts with deputies and availability. You get the emergency manual as a PDF or Word file, and Complass shows who has downloaded an outdated copy.
- Exercises per BSI-Standard 200-4: From the plan review to the full-scale exercise, with measured recovery times compared with the objectives, findings as tasks and the exercise report as a PDF.
- Backups and restore: Per system you see whether the backup matches the tolerable data loss, whether a copy is offline or immutable and when a restore last succeeded.
- Evidence in one click: You file the emergency manual and the exercise report as evidence in your NIS2 project.
Frequently asked questions
Do we need ISO 22301 certification?
No, NIS2 and the BSIG do not require certification to ISO 22301. The standard and BSI-Standard 200-4 do help you build business continuity management in a structured way. Whether a certificate makes sense usually depends on your customers.
How often do we have to run exercises?
Neither § 30 BSIG nor Art. 21 NIS2 Directive sets a fixed interval. For the services it covers, Implementing Regulation (EU) 2024/2690 provides for tests at planned intervals and after significant incidents or major changes. Set up an exercise program that covers your critical processes at a traceable rhythm.
Isn't business continuity a job for IT?
IT restores systems and backups. Which process has to run first and how long an outage can be tolerated is decided by the business units and management. That is why the BIA belongs in their hands.
Does this apply to production equipment too?
§ 30(1) BSIG refers to the IT systems, components and processes you use to provide your services. Networked controllers and control systems are often among them; check this for your plants. Either way, they are frequently the bottleneck when restarting.
How do business continuity and the reporting duty fit together?
A serious outage can also be a reportable security incident under § 32 BSIG. Plan the report into the crisis management team's work so it is not forgotten in an emergency.
In a demo we use the demo company to show you how a BIA turns into plans, exercises and evidence for NIS2.
Request a demo Try it for 14 days
Read more
- Guide "Implementing NIS2: the step-by-step guide"
- Guide "The NIS2 reporting duty in practice"
- Guide "Management and NIS2: what § 38 BSIG requires"
- Whitepaper on business continuity (BCM) per BSI 200-4
- Business continuity in Complass
- NIS2 in Complass
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG, the NIS2 Directive and Implementing Regulation (EU) 2024/2690, the BSI publications and your licensed editions of the standards are authoritative. As of November 2026.