Backup requirements under NIS2: why Microsoft 365 alone is not enough

Do you assume your files and email are safe because they are in Microsoft 365? That is an understandable assumption, but it is not quite right. NIS2 expects you to be able to restore your data after an incident, and Microsoft does not back that up by default. In this article you read what the backup requirements mean in practice and why a separate backup is not a luxury for SMEs.

Want to know first what NIS2 is and who it applies to? Then read NIS2 for SMEs. This piece is specifically about the backup part.

Does NIS2 require a backup?

Yes. NIS2 expects you to be able to safeguard the continuity of your organisation, and a reliable backup is a core part of that. The directive does not prescribe a specific product, but it does expect that after an incident, such as ransomware or human error, you can restore your data. Without a working backup you cannot demonstrate that, and you run unnecessary risk.

Why does Microsoft 365 not back up automatically?

Because Microsoft is responsible for the infrastructure, and you for your data. That is called the shared responsibility model. Microsoft ensures the service is available and replicates data against hardware failures, but does not restore your individual files if an employee deletes them or ransomware strikes. The recycle bin and retention periods in Microsoft 365 are limited: after a while, deleted data is gone for good.

What should a good backup under NIS2 be able to do?

A good backup covers everything and is demonstrably recoverable. Watch these points:

• Full coverage. Not just email, but also OneDrive, SharePoint and Teams. The shared files in particular are business-critical.
• Sufficient retention. You sometimes only notice an error or attack weeks later. A backup that only goes back thirty days is then too short.
• Tested recoverability. A backup you have never restored is not a backup. Recovery must demonstrably work.
• Separated from your environment. If the backup is separate from your Microsoft 365 environment, you do not lose it if that environment itself becomes infected.

What if you do not have a separate backup?

Then, in the event of an incident, your data may be gone for good, and you cannot demonstrate to NIS2 that your continuity is in order. In practice we see that organisations only discover this when things go wrong, when it is too late. A separate backup prevents exactly that scenario.

How IT-gemak arranges this

We provide a daily, automated Microsoft 365 backup of your email, files and Teams, separated from your environment and with a retention period that suits your situation. We test recovery, so you know for sure it works when needed. That way this part of your NIS2 foundation is demonstrably in order.

Want to know whether your environment is well set up for this? Schedule a no-obligation consultation. We take a look and tell you honestly where you stand.