Crisis management and business continuity: preparing for NIS2 raises a practical question. If your usual tools become unavailable, how will teams access instructions, communicate and maintain priority operations?
What NIS2 says about continuity
Article 21 of Directive (EU) 2022/2555 includes business continuity and crisis management among cybersecurity risk management measures. It also covers secure emergency communications where appropriate. These elements form part of a broader risk management framework. Source: ANSSI, NIS2 FAQ, Articles 20 and 21, updated 24 October 2024 (French).
Move from a plan to practical readiness
Work through five points with management, business teams and IT:
- Priorities: which operations must continue, and at what service level?
- Roles: who decides, coordinates, communicates and covers for unavailable people?
- Access: where can teams find procedures, contacts and essential information when normal IT systems are isolated?
- Communications: which channels should teams and providers use?
- Exercises: can the people involved activate the response under the planned conditions?
A practical exercise: remove access to normal tools
Choose one priority operation and a defined scenario: unavailable email, an inaccessible directory or a stopped business application. Check participant access, document availability, decision sharing and missing information. Record gaps, assign corrective actions and run the scenario again.
How Shadline can support preparation
Shadline provides communications and access to essential data and documents in an environment independent of normal IT systems. This scope can support your crisis team and fallback procedures. Project scoping covers the operations to maintain, users, data to prepare and exercises to conduct.
Does a software product establish NIS2 compliance?
No. Selecting a tool does not, by itself, demonstrate compliance. Your organisation must establish its scope, applicable legislation and the full set of technical, operational and organisational measures.
For preparation in France, ANSSI has made ReCyF available since 17 March 2026. Its NIS2 page describes it as a working document. Follow this source for developments and check the requirements applicable to your situation. National requirements must be assessed for the countries concerned. Source: ANSSI, “The NIS2 Directive”, accessed 15 October 2026 (French).
Regulatory preparation: NIS2 and business continuity · GDPR and personal data breaches