Index
From a focus on protection to a resilience strategy
BCDR as a core business decision
New protective measures are required in the face of modern threats
BSI-Standard 200-4: The roadmap for business continuity
Organization trumps technology
How to create BCDR strategy, step by step
Resilience as a competitive advantage
Further content from the it-sa Expo&Congress on this topic
Business Continuity FAQ
At the same time, cyber resilience is taking on a new strategic significance in Europe. Attacks on businesses are no longer aimed solely at extorting ransom payments, but increasingly target economic stability, supply chains and critical infrastructure. States and state-affiliated actors are deliberately using cyber operations as a geopolitical tool. For businesses, this means that resilience is no longer just about IT security – it is becoming an integral part of economic and social stability.
It’s Monday morning, 7:52 a.m. Employees at a medium-sized company turn on their computers and find that nothing works. Their files are encrypted and a ransom note appears on their screens. Production comes to a standstill. What follows are not just hours, but often weeks of downtime, resulting in data loss, contractual penalties, and reputational damage. For many companies, such an incident can threaten their existence.
The latest figures from the Federal Office for Information Security(BSI, in German) show that such scenarios are by no means exceptional: In January 2026 alone, around 4.61 million new malware variants were registered. That equates to 149,000 new malicious programs per day. Meanwhile, the BSI botnet index reached 800 points, indicating eight times more actively infected systems than in 2019.
What can companies do if an attack succeeds, despite numerous security measures? This is where business continuity planning comes into play – the strategy that ensures a company can continue to operate even if part of its IT infrastructure fails or is compromised. Without such a plan, a company must improvise when it matters most.
From a focus on protection to a resilience strategy
For a long time, companies operated under the simple principle that if they were protected enough, they wouldn't be attacked. Firewalls, virus scanners, and access restrictions were the tools of this fortress-like logic. However, this way of thinking has a fundamental flaw: it only works as long as the walls hold.
Today, more and more European security leaders are thinking differently. This new principle is called “Assume Breach.” In other words: Assume that the attack has already taken place. This is not pessimism, but rather a strategy. Those who ask, "How do we remain capable of acting if an attack succeeds?" rather than "How do we prevent every attack?" make fundamentally different decisions.
This transformation is not just technical. Resilience means an organization can continue to function even when parts of it fail because employees know what to do. There are communication channels that are independent of the affected systems.
In Europe, where supply chains, energy supplies, and production processes are deeply intertwined with digital systems, a single failure can have far-reaching consequences.
Operators of critical infrastructure (KRITIS) – such as energy, transport, healthcare or financial systems – are a particular target of modern cyberattacks. In such cases, an IT failure can not only cause economic damage but also have wider societal implications.
The economic consequences are sobering. The costs resulting from downtime, such as lost orders, contractual penalties, restoration costs, and reputational damage, often exceed the actual damage caused by the attack itself. Downtime is expensive. Often, it is more expensive than anything else.
Business continuity and disaster recovery (BCDR) is the organized response to this reality. There's no emergency folder gathering dust. It's not a crisis plan that nobody knows about. Instead, it involves concrete preparations to ensure that decisions can be made, delivered, and communicated even when the usual infrastructure breaks down. Companies that take BCDR seriously have a decisive advantage over attackers and the competition when it matters most.
BCDR as a core business decision
For a long time, business continuity was the responsibility of the IT department, including backup frequencies, storage locations, and recovery times. But those days are over because behind the dry acronyms RTO (Recovery Time Objective) and RPO (Recovery Point Objective) lie questions that strike at the very heart of a business.
- How long can a production line remain idle before contracts fall through?
- How many hours can a payment service provider be offline before customers lose trust?
- How much data loss is economically tolerable?
These are not infrastructure parameters. They are management decisions and should be treated as such.
For European companies, there is an additional dimension: resilience must function properly. It must also be compatible with local requirements for data protection, governance, and regulation. Examples include DORA for the financial sector and NIS2 for critical infrastructure. In recent years, European lawmakers have made it unmistakably clear that resilience is not optional.
In Europe, therefore, resilience means not only getting back on your feet quickly, but also doing so on the right foundation.
New protective measures are required in the face of modern threats
Those who believe that a good backup is the answer to every attack underestimate how professionally today's attackers operate. Modern ransomware groups know that companies with intact backups have little reason to pay. So, they target the backups first.
Their approach is often alarmingly patient. Attackers can move undetected through a network for weeks. They map the infrastructure. They identify backup systems. Then, before launching their actual extortion attempt, they delete or encrypt them. The result is a company that believed it was prepared but wasn’t when it mattered most.
This leads to a rethinking of what a backup must be capable of:
- Immutable backups cannot be altered or deleted after the fact, even if attackers have gained administrative privileges.
- Physically or logically isolated storage environments ensure that compromised systems cannot serve as a bridge into the backup infrastructure.
- Zero-trust principles, originally developed for network access, are increasingly being applied in the backup domain: No system is automatically trusted, not even the company’s own.
The concept is straightforward yet far-reaching: treat the recovery infrastructure as critical infrastructure. A company is only as resilient as its last clean, unassailable copy.
