N.5.04 Backups of OT systems
Control Overview
This control mandates that the organization defines, executes, and regularly tests a dedicated backup and recovery workflow tailored specifically to Operational Technology (OT) infrastructure. To safeguard physical operations from prolonged downtime due to ransomware, system degradation, disasters, or human error, organizations running OT environments must securely preserve and update system configurations, PLC code, machine logic, and critical operational parameters. These backups must be isolated from the live environment and validated through scheduled restoration drills.
Applicability Status
- Applicable for anDREa: NO
Justification & Strategic Approach
This control addresses the preservation and recovery of physical cyber-physical systems, proprietary industrial software configurations, and localized machine parameters. As stated in previous declarations, anDREa is a fully remote, cloud-native SaaS/PaaS organization that delivers its data and analytics platform (myDRE) completely inside Microsoft Azure.
Because anDREa maintains no physical infrastructure, manufacturing lines, assembly gear, or industrial facility management software:
- There are no OT configuration profiles, firmware images, or PLC parameters to back up.
- There is no physical factory floor or industrial network segment requiring disaster recovery coordination.
Consequently, all requirements under the NIS 2 Operational Technology (OT) backup domain are Not Applicable.
All data retention, system state resilience, and platform disaster recovery protocols for anDREa's cloud assets are instead handled comprehensively by our IT-focused backup infrastructure. These mechanisms follow a logical 3-2-1 strategy and are governed explicitly under Control N.4.05 (Backup and Restore) via our Baseline Recovery of myDRE Service playbooks and A.08.13 - Information backup configurations.
Audit Summary
- Compliance Status: Not Applicable (Exempt via Architecture)
- Gaps Identified: None. The justification for non-applicability is logically absolute. No further action or documentation is required for this control profile.