Sign In
Compliance · NIS2

Continuityis notrecovery.

Article 21(2)(c) of the NIS2 directive names both in one sentence. Most continuity plans answer only the second half. For the mail channel the first half is the expensive one.

Request a demoSee the emergency mailbox

Where email continuity plans regularly fail review

Four findings that keep coming up in audits.

The backup is offered as the answer to both

A backup restores data after the incident is over. It says nothing about how work continues during it. Answering the continuity question with a backup strategy does not answer the question.

The plan relies on foreign deadlines

Inbound mail not being lost immediately is due to sending servers retrying. How long that lasts is their configuration, not yours.

The escalation path runs on email

An escalation plan whose first step is an email does not work during a mail outage.

The plan was never exercised

The directive requires the continuity plan to be applied. An untested recovery path is the single most common finding.

What the mail channel concretely needs

Three building blocks that can be reviewed and evidenced.

1. Detection with a timestamp

An outage must be detected and recorded, not noticed by chance. Conbool records the state per domain including start and end.

2. A substitute for reachability

Staff must be able to read and reply during the outage. That is the core of continuity and the point most often missing.

3. Evidence instead of assertion

When emergency mode applied, for how long and how many messages were affected is available as a history. That is the basis for notification and later review.

What Conbool contributes to business continuity

Honestly scoped: the mail channel, not your entire crisis management.

Continuity for the mail channel

Reading and replying continue while the primary system is down. Exactly the half of the requirement backups do not cover.

Recorded state

Start, end and duration of every emergency mode are documented and usable for the notification duty.

Protection stays on during an incident

Even during an outage every message passes full inspection. An emergency exception would be precisely the entry point attackers look for.

No additional vendor

The mail path stays unchanged. No further processor and no further contract is added.

Processing in the EU

Operation and storage sit in the EU with no subprocessors outside. Relevant for your own supply chain assessment too.

Also in your own data centre

Anyone who does not want to hand continuity to an operator runs the same function in their own environment.

Recovery and continuity compared

Both are named in Article 21(2)(c). They do different things.

 
Continuity of operations
Backup and recovery
Effective during the incident
yes
no
Effective after the incident
not required
yes
Prevents data loss
no, the sender queue does that
yes
Prevents work stoppage
yes
no
Evidenced by a record
yes
only by a tested restore
Sufficient without the other
no
no

This comparison describes operation across a company. For individual users, encryption inside the client remains a workable solution.

Frequently asked questions

What exactly does Article 21(2)(c) require?
Business continuity, backup management, disaster recovery and crisis management. The German implementation specifies a continuity plan for maintaining and restoring operations that is actually applied during security incidents.
Is a backup enough to satisfy the requirement?
For recovery yes, for continuity no. Both sit in the same sentence of the directive and mean different things.
Does this apply to us if we are not a critical infrastructure operator?
NIS2 covers essential and important entities well beyond the previous critical infrastructure scope, based among other things on size and sector. It also reaches suppliers through the supply chain even when they are not directly in scope.
Does Conbool replace our continuity plan?
No. Conbool covers the mail channel. Detection, escalation, responsibilities, restart order and exercising remain yours. We supply the building block and the evidence, not the document.
What is the evidence in an incident?
The recorded state per domain with start, end and scope. That demonstrates a substitute procedure was not merely planned but actually took effect.
How does this relate to the notification duty?
Notification deadlines run from awareness. A documented detection with a timestamp is therefore not only continuity but also the basis for a timely notification.
Does the plan have to be exercised?
The directive requires the continuity plan to be applied during security incidents. A plan never exercised is a document in an incident, not a procedure.
Can we run this in our own data centre?
Yes. The same function is available for operation in your own environment when continuity should not be handed to an operator.

Verwandte Lösungen

E-Mail-Notfallpostfach

Lesen und antworten, waehrend das eigene Mailsystem steht.

Microsoft 365 Ausfall

Weiterarbeiten, wenn Exchange Online keine Nachrichten annimmt.

NIS-2 E-Mail-Sicherheit

Alle E-Mail-Anforderungen nach Paragraf 30 BSIG im Ueberblick.

Microsoft 365 E-Mail-Sicherheit

Warum der eingebaute Schutz von Microsoft 365 nicht ausreicht.

Hold your own plan against the requirement

We walk through your email continuity plan with you and show which half of the requirement is missing.

Request a demoGet in touch