Detailed NIS2 process description: Business operations during a cyberattack

The goal of this process is to ensure that the company can continue business operations even in the event of a cyberattack. The implementation and regular updating of a Business Continuity Plan (BCP) play a decisive role here. This plan defines emergency measures and alternative operating procedures to ensure that critical business processes can continue even if certain systems fail.
 
The process covers all essential business processes, IT systems, applications, and infrastructures necessary for ongoing operations. A well-structured plan ensures that the impact of an attack is minimized and that the company quickly recovers.

Developing the Business Continuity Plan (BCP)

The development of the BCP begins with identifying all critical business processes. The Business Continuity Manager works closely with the IT Security Officer to establish alternative procedures in case of a cyberattack. The plan considers key roles, resources, and dependencies necessary for the continuity of business processes.

Identifying Critical Business Processes and Systems

Once the plan is developed, critical business processes and systems are identified. In collaboration with department heads, the Business Continuity Manager evaluates business processes and IT systems for their importance to the company. Dependencies between processes and systems are documented to develop targeted emergency measures.

Establishing Emergency Measures and Alternative Operating Procedures

A key component of the plan is defining specific emergency measures and alternative operating procedures that are implemented immediately when a cyberattack occurs. This includes developing backup processes, such as manual procedures or the use of backup systems, to maintain operations if primary systems fail.

Implementing and Communicating the BCP

After defining the measures, the Business Continuity Manager ensures the implementation and communication of the BCP. Employees are trained on their respective roles in the emergency plan, and the main measures and guidelines are communicated to ensure that everyone knows what to do when an incident occurs.

Annual Testing of the BCP

An important part of the process is the annual testing of the BCP. The Business Continuity Manager conducts tests at least once a year to verify the effectiveness of the emergency measures and alternative procedures. These tests can take the form of simulations, live exercises, or stress tests. The results are documented, and potential improvements are identified to continuously optimize the plan.

Regular Updates and Continuous Improvement

To keep the plan current and effective, regular updates and continuous improvement of the BCP are carried out. Insights from tests and new threat analyses are incorporated into the plan. Employees are informed of any changes and retrained as necessary to ensure readiness at all times.

Documentation and Tracking

The tracking and documentation of all activities related to the development, implementation, and adaptation of the BCP are essential. Test reports and training records are archived to meet audit and compliance requirements.

Responsibilities

The responsibilities in this process are clearly defined. The Business Continuity Manager is responsible for developing, implementing, and maintaining the BCP, as well as conducting tests and training. The IT Security Officer supports the technical implementation of emergency measures and identifies critical IT systems. Department heads ensure that emergency procedures are followed in their areas, and employees are required to know and apply the established emergency measures and operating procedures in the event of an emergency.

Reporting

Regular reporting to management documents the progress in developing, implementing, and testing the BCP. Reports also contain recommendations for future adjustments and improvements to promote the continuous improvement of the plan. The BCP is regularly reviewed and updated to always reflect the latest threat scenarios and organizational requirements. Regular training and tests ensure that the company is well-prepared for emergencies.
 
Conclusion
A robust Business Continuity Plan (BCP) is a central component of corporate security, ensuring that essential business processes can continue uninterrupted even in the event of a cyberattack. The structured development, regular testing, and continuous improvement of the plan enable the company to respond quickly and flexibly to threats, minimizing damage. Clear responsibilities, regular training, and targeted communication ensure that all employees are prepared for their roles in an emergency, strengthening the company’s resilience and responsiveness and ensuring long-term business continuity.