URL: https://auditcybersecurity.ro/en/nis2-backup/ Updated: 2026-11-05. Legal texts last checked: 2026-11-05. Guide # Backups under NIS2: what DNSC asks for Backup is one of the ten minimum measures in [Art. 13](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690), and control PR.DS-11.1 is a key measure at all three levels. This guide quotes the exact text and shows the four questions most companies fail. - **Basis**: [Art. 13(h)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) - **Control**: PR.DS-11, [DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360) - **Offline copy**: "should", PR.DS-11.1 - **Restore test**: at least yearly, PR.DS-11.2 **Definition**An offline copy is a backup disconnected from the network, which an attacker on the network cannot delete or encrypt. A physically isolated copy has the same aim, through physical separation. ## What does the law say about backups? [Art. 13(h) of GEO 155/2024](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) lists among the minimum measures business continuity, including backup management, disaster recovery and crisis management. The details are in control PR.DS-11 of [the Measures approved by DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360): backups of data are created, protected, maintained and tested. ## What does control PR.DS-11 ask for? PR.DS-11.1, a key measure at every level, requires backups of critical data to be made and stored on a system different from the device holding the original data. PR.DS-11.2 requires regular checks of reliability and integrity, from Important level. PR.DS-11.3 requires a separate storage location, also from Important level. | Control | What it asks for | Levels | |---|---|---| | PR.DS-11.1 | Backups of critical data, stored on a system different from the original data. Key measure. | Basic, Important, Essential | | PR.DS-11.2 | Reliability and integrity of backups checked and tested regularly. | Important, Essential | | PR.DS-11.3 | Secure backups in a separate storage location, with controls equivalent to the main environment. | Important, Essential | | PR.DS-11.4 | Recovery tests coordinated with continuity and incident response. | Essential | | PR.DS-11.5 | Backups of critical systems kept separate from backups of critical information. | Essential | ## Does NIS2 require offline backups? The DNSC order on mandatory measures states that at least one backup copy should be kept fully offline or physically isolated. The wording appears in the implementation guide of control PR.DS-11.1 and uses "should". The control itself requires storage on a different system. The law names no technology; the offline copy is the DNSC reference point for ransomware recovery. "At least one backup copy should be kept fully offline or physically isolated to ensure recovery in the event of a network security breach or a ransomware attack." ([Implementation guide, PR.DS-11.1](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360), our translation) ## How often must a restore be tested? The implementation guide of control PR.DS-11.2 says testing should take place at least yearly, or more often on a sample basis, and should include all types of data sources. Recovery procedures are tested to confirm that data can be restored accurately and in full, not just that a backup job finished. Keep a written record of each test: what you restored, how long it took against the RTO target and what went wrong. That is the proof you show at an inspection. There is a model in the [free templates](https://auditcybersecurity.ro/en/nis2-templates/). ## Why do companies fail on backups? Attackers with administrator rights look for backups first, because a company with intact copies does not pay. If every copy can be reached from the network with the same accounts, one compromised account can destroy them all. That is why separation matters, and not only having a copy. ### The four questions 1. Are backups on a system separate from production? 2. Is at least one copy fully offline or physically isolated? 3. Was a full restore tested in the last 12 months, with a written record? 4. Could an attacker with administrator rights delete or encrypt every copy? Answer them in the self-assessment ## What options are there for the offline copy? The offline copy can sit on your own disconnected media, on tape, or in an external vault run by a provider. The choice depends on volume, recovery target and who has physical access. The PR.DS-11.3 guide mentions the 3-2-1 rule: three copies, two types of media, one copy in another location. | Option | Advantage | Watch out for | |---|---|---| | Own media | Full control, low cost for small volumes | Rotation discipline and keeping it at another site | | Tape | Large volumes, disconnected from the network | Equipment, read tests | | External vault | Physical separation run by someone else | The provider joins your supply chain ([Art. 11(8)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)) | See also the [guide to DNSC Order 1/2026](https://auditcybersecurity.ro/en/dnsc-order-1-2026/) and the [NIS2 fines](https://auditcybersecurity.ro/en/nis2-fines-romania/). ## What to do next Take the self-assessment Get the templates ## Frequently asked questions ### Is cloud backup enough? Control PR.DS-11.1 asks for a different system, and cloud can meet that. The practical question is whether a compromised administrator can also reach the cloud copy. If so, it does not protect you against an attack with administrator rights. ### Does a NAS on the same network count as a separate backup? It is a system different from the server, but the PR.DS-11.1 guide says backups should not be stored on the same network as the original systems. In practice it needs network and account separation. ### What are RTO and RPO? RTO is how quickly systems must be restored. RPO is how much data you can afford to lose. The PR.DS-11.1 guide says both should be defined and reviewed regularly. ### Does this apply to OT systems too? Yes. The PR.DS-11.1 guide says backup strategies should also cover OT systems: control system configurations, operational data and the settings of critical devices. ### Must backups be encrypted? Art. 13(c) asks for cryptography policies, and PR.DS-11.3 asks for backup storage controls equivalent to the main environment. Encrypting copies is the natural practice, especially when they leave the site. ### What fine does a company risk without adequate backups? Missing the Art. 11–13 measures falls in the highest band: up to 7,000,000 EUR or 1.4% for important entities and up to 10,000,000 EUR or 2% for essential entities ([Art. 60(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). ## Official sources - [GEO 155/2024, Art. 13(h), consolidated text](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) - [the Measures approved by DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360) - [DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/313799) Commercial communicationThe person behind this guide is involved in AirVault (airvault.ro), which keeps an offline copy of backups in a vault in Romania. How AirVault keeps an offline copy. About this guide Published by AuditCyberSecurity.ro. This site is informative and sells nothing. The person behind it is involved in AirVault, an offline backup service; the link is stated wherever AirVault appears on a page. Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.