Business continuity and crisis management

Catalog reference

Have an adopted business continuity policy for your network and information systems, put it in writing and apply it demonstrably (art. 9(1)). Set processes and procedures that secure your business continuity, including at least restoring your network and information systems and making and periodically verifying the reliability of backups of software and data; apply them demonstrably and test them periodically (art. 9(2)). Have an adopted business continuity plan, put it in writing, apply it when an incident endangers continuity and test it periodically (art. 9(3)). Have a recovery plan, put it in writing, apply it in case of an incident and test it periodically (art. 9(4)). Have a crisis management plan, put it in writing, apply it in a crisis, and test and exercise it periodically; it holds at least the tasks, responsibilities and authorities of staff and others in a crisis, a description of the means of communication in a crisis, and, when appropriate, a description of the emergency facilities available, including secured emergency communication (art. 9(5)). The Cyberbeveiligingsregeling IenW (BWBR0052878, art. 11) elaborates this for essential and important entities in its sectors: the backup procedures say which software and data are backed up and set recovery times and recovery points, safeguards for the completeness, accuracy, integrity, confidentiality and availability of backups and for restoring from them, and retention periods; the business continuity plan takes the risk assessment of art. 7 into account and holds its purpose and scope, tasks and responsibilities, key contacts and communication channels, conditions to activate and deactivate it, the resources required including backups and redundancy, and the conditions to recover and resume activities. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement