DEContact
Applies toEUDEAT

BCM (Business Continuity Management) — NIS2

Maintaining critical business processes during cyber incidents.

Definition

BCM (Business Continuity Management) means maintaining operations during cyber incidents: backup management, disaster recovery and crisis management. The basis in EU law is Art. 21(2)(c) of the NIS2 Directive (Directive (EU) 2022/2555) – that directive is not, however, directly applicable; it becomes operationally binding through the national laws (see below). Typical elements: business impact analysis (BIA), recovery time objectives (RTO), recovery point objectives (RPO), contingency plans and exercises. Typical documents: a BCM concept + an RTO/RPO matrix.

The NIS2 Directive prescribes BCM as a risk management measure; what applies in binding form are the national implementing laws. In both jurisdictions the measure is anchored in identical wording.

Germany

In Germany, the BCM obligation arises from § 30(2) no. 3 of the German BSI Act (BSIG). Particularly important entities and important entities must implement, as a risk management measure, 'maintaining operations, such as backup management and disaster recovery, and crisis management' (§ 30(1) in conjunction with (2) no. 3 BSIG). The competent authority is the Federal Office for Information Security (BSI).

Austria

In Austria, § 32(4)(c) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) contains the identical requirement. Essential and important entities must ensure 'maintaining operations, such as backup management and disaster recovery, and crisis management' as part of their risk management measures (§ 32(1) NISG 2026).