NIS2 is now law in most EU member states, DORA applies to the whole financial sector, and the GDPR to everyone with personal data. All of them want to see that backups, recovery and incident handling are arranged, and that you can show it.
A quick overview for the European Union. Whether your organisation is in scope is something you determine yourself, with your national authority or adviser.
Energy, transport, healthcare, drinking water, digital infrastructure, manufacturing, government and more. Each EU member state has its own law, such as the Cyberbeveiligingswet in the Netherlands and the NIS2 law in Belgium and Germany.
Backup and recovery: Article 21 names business continuity, such as backup management and disaster recovery, and crisis management explicitly.
MSPs and managed security providers are a sector of their own in NIS2. From medium size (50 employees or €10 million turnover) they are in scope in every member state.
Backup and recovery: Your own continuity, and the questions of every client who has to check its supply chain.
Banks, insurers, investment firms and other financial entities across the EU. Applies since 17 January 2025.
Backup and recovery: Backup policies, restore and recovery procedures, and control over ICT suppliers.
Article 32 requires appropriate security of personal data, everywhere in the EU.
Backup and recovery: The ability to restore the availability of and access to personal data in a timely manner after an incident.
The Baseline Informatiebeveiliging Overheid (version 1.3, aligned with the Cbw) and the information security standard for healthcare.
Backup and recovery: Backups, continuity and availability of data are part of the measures you have to demonstrate.
Where most of our customers are, and where the rules are already in force.
In force since 15 August 2026. Organisations in scope register with the NCSC. The duty of care explicitly includes business continuity, such as backup management, and the board has to approve and oversee the measures.
In force since 18 October 2024, supervised by the CCB. By 18 April 2026 essential entities had to show they follow a recognised route: CyberFundamentals (CyFun) or ISO 27001, with full ISO 27001 certification due by April 2027.
The backup and recovery part of those frameworks: immutable backups, tested restores, a recovery plan and the reports to prove it. We don’t make you compliant; we make that part demonstrable.
Sources: CCB on the 18 April 2026 deadline and the NCSC flyer on the Cyberbeveiligingswet.
From rule to evidence
Each framework asks in its own words for the same thing: that you can get your data and systems back, and prove it. Pick a framework to see which parts of our service give you that evidence.
“Business continuity, such as backup management and disaster recovery, and crisis management”, plus the security of your supply chain.
Backup policies, and restoration and recovery procedures that are tested. Plus a grip on the ICT suppliers you depend on.
“The ability to restore the availability and access to personal data in a timely manner” after an incident, and a processor you have an agreement with.
Dutch baselines for government and for healthcare. Backups, continuity, availability of patient data and supplier control are part of them.
We deliver measures and evidence. Whether your organisation complies is assessed by you, your auditor or your regulator.
The details differ per member state, the core is the same everywhere.
| Obligation | What it means | Where Immutec helps |
|---|---|---|
| Duty of care | Take appropriate measures for your network and information systems, based on a risk analysis. | Immutable backups outside your network, disaster recovery and tested restores |
| Reporting | Early warning within 24 hours, notification within 72 hours, final report within one month. | Logs and an incident timeline from your backup history |
| Board responsibility | The board approves the measures, oversees them and follows training. | Clear reports and test results the board can understand |
| Supply chain | Assess the security of your suppliers. | ISO 27001:2022 certified supplier, data in the EU, documented scope |
| Registration | Register with your national authority if your organisation is in scope, in the Netherlands with the NCSC. | You do this yourself; we can tell you what information is usually needed |
NIS2 allows fines of up to €10 million or 2% of worldwide turnover for essential entities. This page is general information, not legal advice. Check your own obligations with the official sources, for example the NCSC flyer on the Dutch Cyberbeveiligingswet and BIO2 version 1.3.
Managed backup Disaster recovery Cyber recovery Evidence for your boardSomething else? Call us on +31 (0)85 482 3400.
No supplier can make you compliant. Compliance is about your whole organisation. We take care of an important part of the measures, backup and recovery, and give you the evidence to show it.
Managed service providers are a separate sector in NIS2. With 50 or more employees or more than €10 million turnover you are very likely in scope. Check it with your national authority; in the Netherlands the government has a self-assessment tool. Even if you are not in scope, your clients will ask you about it.
Yes. Your backups are in our own private cloud in a data centre in Amsterdam.
Restore and recovery test reports, the recovery plan with RPO and RTO per service, backup logs and, during an incident, a timeline from your backup history. Plus our ISO 27001:2022 certificate for your supplier file.
We go through your backup and recovery arrangements with you and tell you what is missing for NIS2, DORA or the GDPR.