NIS2Art. 21(2)(c)voice-validated
NIS2 Art21c: Art. 21(2)(c)
Network and Information Security Directive 2 (EU 2022/2555)
AL
Founder at SQUR · last verified 2026-10-06
Regulation text
Essential and important entities must implement business continuity measures, such as backup management and disaster recovery, and crisis management arrangements to ensure continuity of critical functions during and after incidents.
ATT&CK techniques this article tests · 15
| Technique | Why it maps | Confidence |
|---|---|---|
| T1486 | 1. This technique, Data Encrypted for Impact, directly threatens business continuity by rendering data inaccessible. 2. NIS2 Art. 21(2)(c) mandates backup management and disaster recovery to counter such impacts, ensuring critical functions remain operational. | 90% |
| T1490 | 1. Inhibit System Recovery directly targets an entity's ability to restore operations, undermining business continuity. 2. NIS2 Art. 21(2)(c) requires robust backup management and disaster recovery plans to mitigate this specific threat. | 90% |
| T1498 | 1. Denial of Service attacks disrupt critical functions, directly opposing the continuity requirement. 2. NIS2 Art. 21(2)(c) necessitates crisis management and recovery measures to address service unavailability. | 80% |
| T1529 | 1. System Shutdown/Reboot directly impacts the availability of critical functions. 2. NIS2 Art. 21(2)(c) requires business continuity measures to ensure resilience against such disruptive actions. | 80% |
| T1041 | 1. Exfiltration Over C2 Channel can precede or accompany disruptive attacks, compromising data integrity and availability. 2. Business continuity measures under NIS2 Art. 21(2)(c) include protecting data essential for critical functions. | 70% |
| T1048.001 | 1. Exfiltration Over Web Service represents data theft, which can lead to data loss or integrity issues, impacting continuity. 2. NIS2 Art. 21(2)(c) requires measures to ensure continuity, which includes safeguarding critical data. | 70% |
| T1005 | 1. Data from Local System collection often precedes data destruction or exfiltration, both impacting business continuity. 2. NIS2 Art. 21(2)(c) mandates measures to protect critical data and ensure its availability. | 60% |
| T1039 | 1. Data from Network Shared Drive collection can lead to compromise or destruction of critical information. 2. NIS2 Art. 21(2)(c) requires business continuity plans that account for the integrity and availability of shared data. | 60% |
| T1021.001 | 1. Remote Desktop Protocol abuse enables lateral movement to critical systems, facilitating disruptive actions. 2. NIS2 Art. 21(2)(c) implies securing access to systems supporting critical functions to prevent such compromises. | 60% |
| T1003.001 | 1. OS Credential Dumping (LSASS Memory) provides access to critical systems, enabling further disruptive actions. 2. NIS2 Art. 21(2)(c) requires securing critical functions, which includes protecting credentials that control them. | 60% |
| T1053.005 | 1. Scheduled Task persistence allows adversaries to maintain access for long-term disruption or repeated attacks. 2. NIS2 Art. 21(2)(c) requires continuity measures to ensure resilience against persistent threats. | 50% |
| T1078 | 1. Valid Accounts provide initial access, which can be used to initiate disruptive campaigns. 2. NIS2 Art. 21(2)(c) implicitly requires secure access controls to prevent unauthorized use of accounts that could impact continuity. | 50% |
| T1027 | 1. Obfuscated Files or Information helps adversaries evade detection while preparing or executing disruptive attacks. 2. Effective crisis management under NIS2 Art. 21(2)(c) relies on early detection of threats. | 50% |
| T1018 | 1. Remote System Discovery allows adversaries to map critical infrastructure for targeted disruption. 2. NIS2 Art. 21(2)(c) requires understanding and protecting critical functions, which includes preventing their discovery by attackers. | 50% |
| T1047 | 1. Windows Management Instrumentation (WMI) can be abused for lateral movement, execution, and system manipulation, leading to disruption. 2. NIS2 Art. 21(2)(c) requires measures to ensure continuity of critical functions, which includes securing management interfaces. | 60% |
Defending mitigations · 6
| Mitigation | What it does | Confidence |
|---|---|---|
| M1049 | 1. Data Backup directly addresses the 'backup management' requirement in NIS2 Art. 21(2)(c). 2. This mitigation ensures data availability and recoverability following incidents, supporting business continuity. | 100% |
| M1030 | 1. Network Segmentation limits the spread of attacks, containing incidents and protecting critical functions. 2. This directly supports the 'crisis management arrangements' and 'continuity of critical functions' mandated by NIS2 Art. 21(2)(c). | 90% |
| M1053 | 1. Data Loss Prevention prevents unauthorized exfiltration or destruction of critical data. 2. This mitigation supports the integrity and availability of data, essential for business continuity under NIS2 Art. 21(2)(c). | 80% |
| M1031 | 1. Antivirus/Antimalware prevents malicious software from disrupting critical functions. 2. This is a foundational control for maintaining system integrity and availability, supporting NIS2 Art. 21(2)(c). | 80% |
| M1047 | 1. Audit capabilities enable detection of incidents and provide data for post-incident analysis. 2. This is crucial for effective 'crisis management arrangements' and 'disaster recovery' as required by NIS2 Art. 21(2)(c). | 80% |
| M1028 | 1. Operating System Hardening reduces the attack surface and prevents exploitation that could lead to disruption. 2. This strengthens the resilience of critical functions, aligning with NIS2 Art. 21(2)(c)'s continuity objectives. | 70% |
Underlying weaknesses · 6
| CWE | Why it persists | Confidence |
|---|---|---|
| CWE-400 | 1. Uncontrolled Resource Consumption directly leads to denial of service, impacting critical function continuity. 2. NIS2 Art. 21(2)(c) requires measures to ensure continuity during and after incidents, including resource exhaustion attacks. | 90% |
| CWE-306 | 1. Missing Authentication for Critical Function allows unauthorized access and potential disruption. 2. NIS2 Art. 21(2)(c) implies securing critical functions to prevent their compromise and ensure continuity. | 80% |
| CWE-287 | 1. Improper Authentication enables unauthorized access to systems supporting critical functions. 2. NIS2 Art. 21(2)(c) requires robust security to prevent such access, which could lead to continuity breaches. | 80% |
| CWE-20 | 1. Improper Input Validation can lead to various vulnerabilities, including data corruption or system crashes. 2. Such issues directly impact the availability and integrity of critical functions, contrary to NIS2 Art. 21(2)(c). | 70% |
| CWE-798 | 1. Use of Hard-coded Credentials compromises access to critical systems, facilitating disruptive attacks. 2. NIS2 Art. 21(2)(c) requires securing critical functions, which includes strong credential management. | 70% |
| CWE-787 | 1. Out-of-bounds Write can lead to system instability, crashes, or arbitrary code execution. 2. These outcomes directly threaten the continuity of critical functions, which NIS2 Art. 21(2)(c) aims to protect. | 70% |
What SQUR Covers
Web application + API pentesting for OWASP Top 10, business logic flaws, authentication bypass, injection attacks, and other application-layer vulnerabilities. €1,995 per scan, 24-hour turnaround, EU-only data.
What SQUR Does Not Cover
Internal network pentesting, endpoint security testing, physical security assessments, social engineering, or ICT third-party concentration risk reviews. Engage a complementary provider for those scope items.
Provenance
Mapped Q2.2026 using gemini-2.5-flash · €0.0199 compute · voice-rubric self-validated