nis2

Art. 21(2)(c)

Full text: this article's wording is third-party regulatory text. See the official source for the authoritative provision.

Mapped SPARTA techniques (21)

Techniques referencing this article

  • DE-0002Disrupt or Deceive DownlinkST0006
    addresses
    moderate
    direct

    Telemetry continuity — alternate downlink stations, deferred playback recovery, and crisis-management procedures during loss-of-monitoring — falls under business continuity, backup management, and crisis management at Art. 21(2)(c).

  • DE-0002.02Jam Link SignalST0006
    addresses
    moderate
    direct

    Service continuity during downlink loss — alternate ground apertures, dwell-extension, deferred-recovery procedures — falls under business continuity, backup management, and crisis management at Art. 21(2)(c).

  • DE-0005Subvert Protections via Safe-ModeST0006
    addresses
    moderate
    direct

    Contingency-mode design — what command sets are accepted, what rate/size limits change, what alternate receivers activate — falls under business-continuity and crisis-management practice under Art. 21(2)(c); the obligation requires those procedures not to relax security to gain availability.

  • EX-0010.01RansomwareST0004
    addresses
    high
    direct

    Backup management, disaster recovery, and crisis management under Art. 21(2)(c) is the precise obligation that bounds ransomware impact — restoring engineering telemetry, payload data, command tables, and ephemerides without paying.

  • EX-0010.02Wiper MalwareST0004
    addresses
    high
    direct

    Backup management, disaster recovery, and crisis management under Art. 21(2)(c) are the obligations that ensure mission continuity in the face of irreversible data/image destruction — including custody of golden images and undo logs the wiper attempts to erase.

  • Contingency dictionary scope, alternate-receiver activation rules, and emergency-scheduling cadences are squarely within business-continuity, backup-management, and crisis-management practice under Art. 21(2)(c); the obligation requires those procedures not to relax security to gain availability.

  • EX-0013FloodingST0004
    addresses
    moderate
    direct

    Service availability under volumetric attack — backup paths, throttling regimes, and recovery procedures — falls under business continuity, backup management, and crisis management under Art. 21(2)(c).

  • EX-0016JammingST0004
    addresses
    moderate
    direct

    Service continuity under temporary RF interference — failover paths, alternate ground apertures, dwell-extension procedures — falls under business continuity, backup management, and crisis management under Art. 21(2)(c).

  • EX-0016.01Uplink JammingST0004
    addresses
    moderate
    direct

    Uplink outage continuity — dwell-extension, alternate apertures, deferred operations — is core business-continuity practice under Art. 21(2)(c) for missions where commandability availability targets must be maintained despite jamming.

  • EX-0016.02Downlink JammingST0004
    addresses
    moderate
    direct

    Downlink continuity for affected user terminals (alternate stations, beam reconfigurations, retasked relays) is core business-continuity practice under Art. 21(2)(c).

  • PNT-outage continuity — multi-source navigation, time-distribution fallbacks, alternate scheduling — is core business-continuity practice under Art. 21(2)(c) for missions where GNSS-derived time underpins essential services.

  • EX-0018Non-Kinetic Physical AttackST0004
    addresses
    moderate
    direct

    Catastrophic-component-loss continuity (failover to redundant electronics, alternate-orbit operations, mission-end-of-life rehearsals) is core business-continuity, disaster-recovery, and crisis-management practice under Art. 21(2)(c).

  • Backup management and crisis-management procedures under Art. 21(2)(c) are how the entity designs and exercises secondary/contingency communication channels — the obligation that should preserve security parity, not relax it for availability.

  • IA-0004.01Ground StationST0003
    addresses
    high
    direct

    Backup ground operations and the processes that shift traffic to the standby site (planned exercises, weather diversions, anomaly failover) are the precise scope of business continuity, backup management, and disaster recovery under Art. 21(2)(c).

  • IA-0004.02ReceiverST0003
    addresses
    moderate
    direct

    Backup receiver design — when it activates, what command set it accepts — falls under business-continuity and disaster-recovery design; Art. 21(2)(c) is the obligation that requires the entity to prove its contingency configurations don't relax security to gain availability.

  • IA-0008.03ASAT/Counterspace WeaponST0003
    addresses
    moderate
    direct

    Counterspace effects that force the target into contingency states with broader command acceptance are countered by business-continuity, backup-management, and crisis-management planning under Art. 21(2)(c) that ensures contingency states do not relax security.

  • IA-0010Unauthorized Access During Safe-ModeST0003
    addresses
    moderate
    direct

    Contingency-mode design, dictionary scope, and rapid-response procedures are squarely within business-continuity and crisis-management practice under Art. 21(2)(c); the obligation requires those procedures not to weaken security.

  • IMP-0002DisruptionST0009
    addresses
    moderate
    direct

    Business-continuity planning, backup communications paths, and crisis-management procedures under Art. 21(2)(c) limit mission impact when adversaries disrupt or modify communications during critical times.

  • IMP-0003DenialST0009
    addresses
    moderate
    direct

    Business continuity, backup management, disaster recovery, and crisis management under Art. 21(2)(c) are precisely the controls that bound the mission impact of a denial event.

  • IMP-0004DegradationST0009
    addresses
    moderate
    direct

    Disaster-recovery planning and crisis-management procedures under Art. 21(2)(c) define how the entity continues to deliver mission services as accelerated subsystem degradation shortens the spacecraft's useful lifespan.

  • IMP-0005DestructionST0009
    addresses
    moderate
    direct

    Backup management, disaster recovery, and crisis management under Art. 21(2)(c) are the obligations that ensure mission continuity (including data recoverability) in the face of destruction-class incidents.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.