The NIS2 directive (Network and Information Security 2) came into force on October 17, 2024, with mandatory transposition into national law before January 2025. This new European regulation significantly strengthens cybersecurity requirements, and backups hold a central place in the required technical measures.
To meet NIS2 requirements without technical complexity, a compliant managed cloud PBS like NimbusBackup natively integrates Article 21's required business continuity, encryption and geo-redundancy measures. This offsite Proxmox backup is operational in less than 15 minutes with 24/7 monitoring, automatic updates and guaranteed GDPR/NIS2 compliance. The sovereign hosted PBS in France simplifies demonstrating your compliance during audits through complete documentation and certifiable architecture. We detail below the backup obligations of the NIS2 directive and how a professional cloud Proxmox backup helps you meet these requirements without heavy infrastructure investment.
What is the NIS2 directive?
NIS2 replaces the 2016 NIS directive and significantly broadens its scope. While NIS covered approximately 10,000 entities in Europe, NIS2 applies to more than 160,000 organizations, including about 15,000 in France.
NIS2 aims to ensure a high level of cybersecurity across the European Union, with penalties up to 10 million euros or 2% of global turnover.
Affected sectors:
Essential entities (EE)
- - Energy (electricity, gas, oil)
- - Transport (air, rail, maritime, road)
- - Healthcare (hospitals, laboratories)
- - Drinking water and wastewater
- - Digital infrastructure
- - Public administration
- - Space
Important entities (IE)
- - Postal services
- - Waste management
- - Manufacturing (chemicals, medical, electronics)
- - Food
- - Digital providers
- - Research
- - Critical B2B services
Classification criteria are based on size (more than 50 employees or 10 million euros in turnover) and sector of activity. Certain entities are designated as essential regardless of their size (critical infrastructure).
Backup obligations under NIS2
Article 21 of the NIS2 directive defines the "cybersecurity risk management measures" that entities must implement. Backups are explicitly mentioned as an essential component.
Article 21 - Key excerpts:
"The measures referred to in paragraph 1 shall be based on an all-hazards approach [...] and shall include at least the following: [...] (c) business continuity, such as backup management and disaster recovery, and crisis management."
Article 21 also requires continuous incident detection capability and a formal response plan, which implies staffing coverage outside business hours. For organizations without an internal NOC, the typical answer is an outsourced 24/7 on-call service.
Implicit backup requirements:
Resilience and availability
Backups must allow restoring essential services within "appropriate" timeframes in the event of an incident. This implies regular restore tests and documented RTO/RPO.
Protection against cyberattacks
Backups themselves must be protected against ransomware and other threats. This requires isolation (air-gap) or immutability of backed-up data.
Encryption and confidentiality
Article 21(2)(h) explicitly mentions "encryption and, where appropriate, pseudonymisation" as a security measure. Backups must therefore be encrypted.
Secure supply chain
Article 21(2)(d) requires an assessment of supply chain security. Your backup providers must themselves present adequate guarantees.
Backup compliance: practical checklist
To meet NIS2 requirements, your backup strategy must integrate the following elements:
NIS2 Compliance Checklist - Backups
Warning: NIS2 provides for controls and audits. Entities must be able to demonstrate their compliance with documented evidence: test reports, access logs, contracts with subcontractors, etc.
How NimbusBackup meets NIS2 requirements
Our managed PBS plans for offsite backup have been designed to meet the strictest disaster recovery requirements, including those of NIS2 for essential and important entities.
100% French hosting
Equinix datacenters in the Paris region, own infrastructure (AS206014). Data sovereignty guaranteed.
Native geo-redundancy
Automatic replication across 2 separate sites with our Double Drive PBS and higher plans (from 22 EUR/TB).
Air-gapped protection
AirGapped Drive PBS (disk rotation) and Bank PBS (bank vault) plans for complete physical isolation.
Long-term archiving
Magnetic PBS and AirGapped LTO PBS plans with LTO tape archiving: 30+ year durability, cyberattack resistance.
AES-256 encryption
Client-side encryption before transmission. You alone hold the keys, we never have access to your data in clear text.
Support and documentation
French technical team, complete documentation, and assistance for your compliance audits.
Our PBS range for NIS2:
- Single Drive PBS (12 EUR/TB) - Basic encrypted backup
- Double Drive PBS (22 EUR/TB) - Geo-redundancy across 2 sites
- AirGapped Drive PBS (34 EUR/TB) - Ransomware protection through isolation
- Drive Bank PBS (69 EUR/TB) - Bank vault
- Magnetic PBS (89 EUR/TB) - HDD + automatic LTO tape archiving
- AirGapped LTO PBS (119 EUR/TB) - Air-gapped LTO tape in DC safe
- Magnetic Bank PBS (149 EUR/TB) - LTO in bank vault, maximum compliance
Conclusion: act now
The NIS2 directive is not a simple administrative formality. With penalties up to 2% of global turnover and personal liability for executives, compliance is a strategic issue for every affected organization.
Backups are a central pillar of this compliance. A robust backup strategy using a cloud PBS solution, integrating air-gap, encryption and regular testing protects you not only against regulatory penalties, but above all against the operational consequences of a cyberattack. Check our offsite backup pricing guide, our guide on Backup as a Service and account segregation, and discover our legal on-call obligations (fr) and our certified Proxmox managed services.
Don't wait for an incident or an audit to act. Achieving NIS2 compliance for your backups is an investment in your organization's resilience.
Sources and references
Protect your Proxmox VMs with NimbusBackup
Offsite, immutable and sovereign backup. Starting at 12 EUR/TB/month.