Backups and NIS2: where SMEs should really start

When SMEs hear NIS2, the conversation often jumps straight to regulations, audits, and documentation. In practice, resilience starts with a smaller question: if an attacker encrypts or deletes something critical today, how fast can the business recover safely? A strong backup programme is not just storage Backups only create resilience when they are protected, segmented, monitored, and tested. Copies that cannot be restored under pressure are not a control; they are only a hope. That is why business continuity and backup governance belong in the same conversation. Define which systems are operationally critical and assign recovery priorities. Separate backup credentials and access paths from daily administration. Run restore tests on a schedule that reflects business impact. Document who decides, who executes, and who communicates during recovery. Make compliance useful to operations NIS2 should push organisations toward clearer ownership, repeatable controls, and evidence that continuity can work under pressure. If the process improves recovery confidence, the compliance effort is helping. If it only generates paperwork, it is not mature enough yet.