![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig1-437x127.png\")
<\/p>\n<\/p>\n
This figure reveals a profound shift: backups, often considered the last resort, have now become prime targets for attackers. When faced with a major cyberattack, traditional continuity plans are no longer sufficient.<\/strong> Indeed, they fall short in industrial environments, particularly given the nature of the stakes involved: physical safety, environmental impact, continuous production, and more.<\/p>\n This is why the most advanced organizations are now building dedicated OT cyber-resilience programs<\/strong>, designed to manage crises in the face of major disruptions or incidents. That aim to ensure the continuity of essential operations and restore compromised assets.<\/p>\n The NIS2 Directive \u2014 and particularly ANSSI’s RECYF framework \u2014 supports this effort by introducing clear cyber-resilience obligations for essential and important entities.<\/p>\n Where to start, what obstacles to anticipate, and how to build OT resilience that meets NIS2 requirements?<\/p>\n The growing integration of IT into industrial processes \u2014 MES, ERP systems connected to production <\/em>lines; the gradual shift away from paper-based processes \u2014 has profoundly changed the operational reality of manufacturing plants. Dependencies are numerous, often poorly mapped, and an IT failure can bring OT to a halt even when the physical equipment remains fully functional. In this regard, strengthening the cyber resilience of industrial environments has become a priority .<\/em><\/span><\/p>\n The NIS 2 directive significantly broadens the scope of entities subject to cybersecurity obligations. Two objectives are crucial in terms of resilience:<\/p>\n While industrial organizations have gradually invested in securing their OT environments, maturity around continuity and recovery remains insufficient to meet NIS 2 requirements. Several gaps are observed systematically:<\/p>\n Without the necessary maturity on these topics, a cyber incident can result in weeks of downtime<\/p>\n Before building a recovery, plan or testing anything, the groundwork must be laid. Including knowing what to protect, how to hold up during an incident, and what to back up.<\/strong><\/p>\n A cyber-resilience program driven solely by Cyber or IT teams risks failing to reflect operational realities and address the true business stakes: without the involvement and buy-in of operators, the initiative will struggle to move forward. This requires an evangelization phase, concretely explaining what an incident costs their operations, and identifying the right stakeholders in each department from the outset.<\/p>\n The goal of cyber-resilience is not to produce an exhaustive inventory of the industrial asset base. It is to identify the assets that underpin critical business processes<\/strong>. The starting point is to establish a BCP at the global level, followed by a BIA at the site level, which will define the RTO and RPO for each critical process.<\/p>\n Asset collection relies on a hybrid approach:<\/p>\n Network probes may seem like an obvious choice, but they only detect assets that are actively generating traffic. Any equipment that is not communicating at a given moment will simply disappear from the mapping. In OT environments, a significant number of devices are configured once and then operate autonomously, which severely limits their network visibility. Furthermore, some systems are entirely standalone and emit no traffic at all \u2014 even though they may be critical to operations. Relying solely on probes therefore provides a partial and potentially misleading view of the environment, with a real risk of overlooking essential assets.<\/em><\/span><\/p>\n Asset mapping makes it possible to catalogue and prioritise the systems that need to be protected based on their criticality, as validated with business teams<\/strong>. For each asset, the minimum backup content and backup frequency are then defined: Backup infrastructure<\/em> is not merely technical storage systems: they are themselves sensitive targets and must be treated as critical systems, with the appropriate level of protection.<\/em><\/p>\n The first step of the BCP is to identify the crisis scenarios that need to be addressed<\/strong>, as these determine which stakeholders to involve, which procedures to define, and which operating modes to adopt. This work is carried out jointly with the HSE, business, cybersecurity, and risk management teams.<\/p>\n For each critical process identified, the following must then be defined in collaboration with the production, maintenance, and quality teams:<\/p>\n An untested DRP is a theorical DRP.<\/p>\n Tests can be conducted in the following ways to limit the impact on production:<\/strong><\/p>\n These tests should be validated at least once a year.<\/p>\n Progression is gradual: Each test is documented<\/strong>: actual RTO and RPO measured, comparison against theoretical targets, gaps identified, and corrective actions planned.<\/p>\n RTO\/RPO objectives may not be realistic in the context of a major cyber crisis. They should therefore not act as a blocking factor for conducting tests or for validating cyber-resilience principles under NIS2.<\/em><\/span><\/p>\n The DRP defines how to restart critical systems following a disaster<\/strong>. It covers several scenarios: hardware failure, ransomware, and OT network loss.<\/p>\n For each scenario, it is necessary to:<\/p>\nNIS 2 and Industrial Resilience: Requirements and Current State<\/strong><\/h1>\n
What NIS 2 Concretely Requires<\/strong><\/h2>\n
![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig2-393x191.png\")
<\/p>\nIndustrial State of Play<\/strong><\/h2>\n
\n
\n
![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig3-296x191.png\")
<\/p>\nBuilding OT Resilience for NIS 2: A Practical Roadmap<\/strong><\/h1>\n
![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig4-322x191.png\")
<\/strong>Foundations and Prerequisites<\/strong>\u00a0 \u00a0 \u00a0<\/strong><\/h2>\nWhich stakeholders to involve from the start?<\/strong><\/h2>\n
Which business perimeters to prioritise?<\/strong><\/h2>\n
\n
What data to backup and how?<\/strong><\/h2>\n
![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig5-437x184.png\")
Several principles then structure the backup security strategy:<\/strong><\/span><\/p>\n\n
How to ensure continuity during an incident?<\/strong><\/h2>\n
Validation and Recovery<\/strong><\/h1>\n
How to validate that recovery works?<\/strong><\/h2>\n
\n
![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig7-437x179.png\")
<\/p>\nHow to rebuild after an incident?<\/strong><\/h2>\n
![\"\"](\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2026\/07\/NIS2_EN_fig8-437x120.png\")
<\/p>\n","protected":false},"excerpt":{"rendered":"