Business Continuity

27. The head of the cybersecurity entity or a person authorised by them must approve a business continuity management plan for network and information systems, which must specify:

• 27.1. the conditions under which the network and information systems business continuity plan is triggered

• 27.2. the operational criteria for the network and information systems by which it can be determined whether their operation has been restored

• 27.3. the persons responsible for implementing the network and information systems business continuity plan, their duties and functions

• 27.4. provisions setting out the requirements for the composition and functions of the network and information systems business continuity management team, including the requirement that the team include the cybersecurity manager and/or the security officer

• 27.5. provisions setting out the requirements for the composition and functions of the network and information systems recovery team

• 27.6. a detailed recovery plan for the network and information systems

• 27.7. requirements for testing the effectiveness of the network and information systems business continuity management plan

• 27.8. requirements for preparing reports on the results of testing the effectiveness of the network and information systems business continuity management plan

• 27.9. the recovery parameters for backup data copies according to the recovery time objective (RTO) established by the cybersecurity entity for the network and information systems or part of them, and the requirements for testing those parameters

• 27.10. the data loss period (recovery point objective, RPO) for the network and information systems or part of them, and the requirements for testing it.

28. The cybersecurity entity must establish requirements for creating and storing backup data copies and for restoring data from them, and define the scope and frequency of backup, having regard to the recovery requirements established for the network and information systems in the business continuity management plan (RTO, RPO).

29. The cybersecurity entity submits the approval details of the report on testing the network and information systems business continuity management plan — stating the date of approval and the registration number — to KSIS no later than 5 working days from the approval of those documents.

30. When carrying out an inspection of a cybersecurity entity, the NCSC has the right to require the entity to provide a copy of the report on testing the business continuity management plan. The cybersecurity entity must submit these documents to KSIS no later than 5 working days from the date of receipt of the NCSC request.

31. The technical requirements applicable to cybersecurity entities are set out in Table 2.