NIS2: evidence for backup management and disaster recovery

The NIS2 Directive (EU 2022/2555) asks essential and important entities to take measures that include business continuity, such as backup management and disaster recovery (Article 21(2)(c)), and to assess whether those measures are effective (Article 21(2)(f)). For a database, an effective backup is one that restores.

What Verestore gives you

• Regular restore tests. Daily, weekly or monthly, of your newest PostgreSQL backup, into a disposable database that's deleted when the run ends.
• What was checked. Every table restored, row counts against the previous run, checksums of the tables you choose, and your own SQL checks against a baseline.
• Evidence you can't edit. Each result is signed by the run and countersigned by Verestore. Anyone can check a report at /verify.
• EU hosting. The hosted runners, the control plane and the evidence are in the EU (Scaleway, Paris region).
• An evidence pack per period. A ZIP with the reports, the signed results and a summary, for your national authority, an auditor or your management body.

How to use it in your NIS2 measures

1. In your business continuity measures, state how often database backups are restore-tested and what counts as a pass.
2. Connect the backup location with a read-only key (how access works) and set the schedule to match.
3. Keep the evidence packs as the record that the measure is applied and effective; Article 21(2)(f) asks you to assess effectiveness.

Verestore produces evidence for one measure; it doesn't make your organisation NIS2-compliant. Your national transposition and your auditor decide what is sufficient.