+4. Business continuity and crisis management
---+4.1 Business continuity and disaster recovery plan
------+4.1.1 For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities …
------+4.1.2 The relevant entities’ operations shall be restored according to the business continuity and …
------+4.1.3 The relevant entities shall carry out a business impact analysis to assess the potential impact of …
------+4.1.4 The business continuity plan and disaster recovery plan shall be tested, reviewed and, where …
---+4.2 Backup and redundancy management
------+4.2.1 The relevant entities shall maintain backup copies of data and provide sufficient available …
------+4.2.2 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …
------+4.2.3 The relevant entities shall perform regular integrity checks on the backup copies.
------+4.2.4 Based on the results of the risk assessment carried out pursuant to point 2.1 and the business …
------+4.2.5 Where appropriate, the relevant entities shall ensure that monitoring and adjustment of resources …
------+4.2.6 The relevant entities shall carry out regular testing of the recovery of backup copies and …
---+4.3 Crisis management
------+4.3.1 The relevant entities shall put in place a process for crisis management.
------+4.3.2 The relevant entities shall ensure that the crisis management process addresses at least the …
------+4.3.3 The relevant entities shall implement a process for managing and making use of information received …
------+4.3.4 The relevant entities shall test, review and, where appropriate, update the crisis management plan …

4. Business continuity and crisis management

Business continuity and crisis management

1. Ħarsa ġenerali

4.1 Business continuity and disaster recovery plan

Mapping to standards and frameworks

ISO standard 27001:2022A5.29, A. 5.30
NIST Cybersecurity Framework v2.0ID.IM-02, ID.IM-03, ID.IM-04, GV.OC-04, GV.SC-08, RC.RP-01, RC.RP-02
ETSI Standard EN 319 401 V3.1.1Clause 7.11
CEN/TS 18026:2024BC-01, BC-02, BC-03, BC-04
BE-CyFun®2023BASIC: ID.BE-5.1, PR.IP-4.1
IMPORTANT: ID.SC-5.1, PR.IP-9.1
ESSENTIAL: ID.SC-5.2, PR.IP-4.4, PR.IP-4.5, PR.IP-9.2, RC.RP-1.2
FI-KybermittariRESPONSE-4, RESPONSE-5, CRITICAL-3
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 25.1a, 25.1b, 25.1c
Cybersecurity Handbook: Part B: 18.1, 18.2
Self-assessment tool: 19.1, 19.2, 19.3
ENS-Royal Decree 311/2022Article 26, Article 27
Annex II: [op.cont.1] Impact analysis, [op.cont.2] Continuity plan, [op.cont.3] Periodic tests, [op.cont.4] Alternative means, [op.ext.3] Protection of the supply chain
FR12.4-EE
13.1-IE/EE
13.2-IE/EE
13.3-IE/EE
13.4-IE/EE
13.5-EE
13.6-EE
13.7-EE
14.7-EE
14.9-EE
16.1-EE
4.2 Backup and redundancy management

Mapping to standards and frameworks

ISO standard 27001:2022A.8.13, A.8.14
NIST Cybersecurity Framework v2.0PR.DS-11, RC.RP-01, RC.RP-02, ID.IM-03
ETSI Standard EN 319 401 V3.1.1Clause 7.11.2
CEN/TS 18026:2024OPS-06, OPS-07, OPS-08, OPS-09
BE-CyFun®2023BASIC: PR.IP-4.1, RC.RP-1.1
IMPORTANT: PR.IP-4.2, PR.DS-3.3, PR.DS-5.1, PR.DS-6.1, PR.IP-4.3
ESSENTIAL: ID.BE-5.2, PR.DS-8.1, PR.IP-4.4, PR.IP-4.5
FI-KybermittariRESPONSE-4, ASSET-1, ASSET-2, CRITICAL-2, ARCHITECTURE-1, ARCHITECTURE-5
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 25.1d, 25.1e, 25.1f, 25.1g
Cybersecurity Handbook: Part B: 16.1, 16.2, 16.3, 16.4, 16.5, 16.6, 16.7
Self-assessment tool: 17.1, 17.2, 17.3, 17.4, 17.5, 17.6, 17.7, 17.8
ENS-Royal Decree 311/2022Annex II: [op.cont.1] Impact analysis, [op.cont.2] Continuity plan, [op.cont.3] Periodic tests, [op.cont.4] Alternative means, [mp.info.6] Backups
FR12.6-IE/EE
12.7-EE
13.1-IE/EE
13.2-IE/EE
13.3-IE/EE
13.4-IE/EE
13.5-EE
13.6-EE
13.7-EE
20.2-EE
4.3 Crisis management

Mapping to standards and frameworks

ISO standard 27001:2022A.5.26, A.5.29, A.5.30
NIST Cybersecurity Framework v2.0RS.CO-02, RS.CO-03. PR.IR-03, DE.CM-01, ID.AM-03, DE.AE-02, DE.AE-03, DE.AE-04, DE.AE-06, DE.AE-07, DE.AE-08
ETSI Standard EN 319 401 V3.1.1Clause 7.11.3
CEN/TS 18026:2024BC-03, OIS-03
BE-CyFun®2023BASIC: RS.CO-3.1
IMPORTANT: PR.IP-8.1, DE.DP-4.1, RS.CO-3.2
ESSENTIAL: PR.IP-4.4, PR.IP-9.2, RC.CO-2.1, RS.CO-2.2
FI-KybermittariRESPONSE-3, THREAT-2, CRITICAL-1, CRITICAL-3
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 25.2a, 25.2b
Cybersecurity Handbook: Part B: 17.2, 17.10, 18.1, 18.2, 18.8
Self-assessment tool: 18.2, 18.3, 19.2, 19.3, 19.8
ENS-Royal Decree 311/2022Article 26, Article 27
Annex II: [op.cont.1] Impact analysis, [op.cont.2] Continuity plan, [op.cont.3] Periodic tests, [op.cont.4] Alternative means, [mp.info.6] Backups
FR12.4-EE
12.6-IE/EE
12.7-EE
13.1-IE/EE
13.3-IE/EE
13.4-IE/EE
13.6-EE
13.7-EE
14.1-IE/EE
14.2-IE/EE
14.3-IE/EE
14.4-EE
14.5-EE
14.6-EE
14.7-EE
14.8-EE
14.9-EE

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is related to 4. Business continuity and crisis management (Article 21(2), point (c), of Directive (EU) 2022/2555)