NIS2 Personnel Redundancy: Why CIR 4.2.4(c) Needs Deputies With Authority, Not Just Know-How — and the 5 Records That Prove It

Short answer: point 4.2.4(c) of the Annex to Commission Implementing Regulation (EU) 2024/2690 requires “at least partial redundancy” of “personnel with the necessary responsibility, authority and competence”. A colleague who knows how the backup console works covers only one of those three words. If the only person who can activate your continuity plan or brief the board is unreachable, you have a skills backup and an authority gap. The authority gap is the one that stalls a recovery.

This guide turns the clause into something you can evidence: a four-question test for which roles need a deputy, five records that prove the redundancy exists, and two traps that turn a well-meant deputy arrangement into a new finding. It is a spoke of our NIS2 business continuity guide, which covers the rest of Article 21(2)(c).

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Does point 4.2.4 apply to you? Scope first

In plain terms: every NIS2 entity must have business continuity measures. Only eleven types of digital-sector entity are bound by the wording of point 4.2.4. For everyone else it is the most detailed EU-level benchmark of what “business continuity” means for people.

Your organisation	Binding rule	Role of CIR point 4.2.4(c)
DNS service provider, TLD registry, cloud, data centre, CDN, managed service provider, managed security service provider, online marketplace, search engine, social network, trust service provider	Article 21(2)(c) of the Directive, specified by the CIR Annex (Article 1 of the CIR)	Binding text. Your supervisor can test your plan against it.
Any other essential or important entity	Your national law transposing Article 21(2)(c) of the NIS2 Directive	Not binding, but a sensible benchmark. National rules may say more or less.
Management body (every entity)	Article 20(1): approves the Article 21 measures, oversees them, can be held liable	Approves the deputy arrangements as part of those measures.

What 4.2.4(c) actually requires: three attributes, not one

In plain terms: a deputy must be able to own the task, decide, and do the work. Most plans prove only the last of those.

The full sentence reads: “Based on the results of the risk assessment carried out pursuant to point 2.1 and the business continuity plan, the relevant entities shall ensure sufficient availability of resources by at least partial redundancy of the following”, followed by systems, assets, communication channels and, at point (c), “personnel with the necessary responsibility, authority and competence”. Two qualifiers set the scope. The risk assessment and the plan decide which people need cover, so not every job needs a twin. And “at least partial” means cover can be incomplete, provided it is deliberate.

Note what is missing. Many Annex points are softened by “where appropriate”, which under Article 2(2) of the CIR lets you skip them if you document your reasoning. Point 4.2.4 has no such qualifier. Proportionality enters through the risk assessment and the word “partial”, not through an opt-out.

Attribute	What the deputy needs	Where the CIR asks for it	Evidence
Responsibility	To be named for the role in the plan, so nobody debates who is in charge	4.1.2(b) roles and responsibilities; 1.2.1 assigning responsibilities to roles	Named deputy in the plan and role register
Authority	The power to decide without waiting for the primary: activate the plan, take crisis decisions, brief management	4.1.2(d) conditions for plan activation; 4.3.2(a) allocation of roles in crises; 1.2.3 reporting to management bodies	Written delegation approved by management
Competence	The skills and the access to carry out the work	8.2.1 role training; 11.3.2(c) individual admin privileges	Training record, own account, test result

Authority is the attribute plans forget. Technical recovery steps tend to be written into runbooks, so a capable colleague can follow them. Decisions are rarely written down: whether to fail over to the secondary site, isolate a business unit, invoke a supplier’s emergency clause or tell the authorities. In practice, an incident stalls while people wait for the one person allowed to say yes. In the continuity plans we review, the role names are usually there. A named deputy holding written authority is rare.

Which roles need a deputy? A four-question test

In plain terms: a role needs cover if your continuity plan depends on it. Four questions, each tied to a clause the CIR already contains, find those roles.

1. Business impact: does a process your business impact analysis marks as critical (point 4.1.3) stop or slow down when this person is unavailable?
2. Plan authority: is the role named in the plan’s roles (4.1.2(b)), its activation conditions (4.1.2(d)) or the crisis roles (4.3.2(a))?
3. Exclusive access: does this person hold access, keys or knowledge nobody else holds? Point 9.2(c)(iv) already asks how “authorised users obtain access to keys”.
4. Reporting line: is this the person who reports to the management body under point 1.2.3?

One “yes” puts the role in scope for 4.2.4(c). Then apply a stress test that needs no risk model: the four-week test. Under Article 7 of the Working Time Directive 2003/88/EC, every worker is entitled to “paid annual leave of at least four weeks”, and that minimum cannot be replaced by a payment while the job continues. A role held by one person is therefore uncovered, by law, for at least four weeks a year, before you count illness, resignation or the person being caught up in the incident. A plan that says “call Anna” with no fallback fails on a date you can predict.

Role	Question it usually trips	Partial-redundancy option
Security lead / CISO	Q2, Q4	Named deputy with written delegation to brief the management body
Continuity or crisis lead	Q2	Second decision-maker for each activation level in the crisis management plan
Owner of incident notifications	Q2	Trained alternate with their own access to the national reporting channel
Domain or cloud tenant administrator	Q3	Second individual admin account plus a documented emergency-access procedure
Backup and restore operator	Q1, Q3	Alternate who has completed a restore during a test
Specialist engineer (OT, legacy system)	Q1, Q3	Job rotation, recorded procedures or retained vendor support
Owner of a critical supplier relationship	Q1	Second named contact in the contract and on the supplier’s escalation list

The five records that prove personnel redundancy

In plain terms: ENISA accepts thin evidence for this point. A file that proves each of the three attributes separately is much harder to fault.

Under 4.2.4, the ENISA Technical Implementation Guidance (version 1.0, June 2025) lists personnel options as “job rotation, backup assignments, emergency drills” (an indicative, non-exhaustive list) and gives a single example of evidence: “One or more of the above mechanisms are in place.” That is guidance, not law, and it does not show that the cover includes authority. The five records below connect into one chain, so each attribute has its own proof.

1. Critical-role register with a deputy matrix. One row per in-scope role: the critical processes it supports, the primary, the named deputy, which of the three attributes the deputy currently covers, any gap, and the next review date. ENISA’s guidance on roles makes the point directly: “Make sure that each role has its deputy or that measures ensuring continuity in the event of the role representative’s absence are in place, where possible.”

2. Delegation of authority. A short written instrument that states what the deputy may decide, when the delegation takes effect (for example, primary unreachable for a set number of hours, or plan activated) and when it ends. Point 1.2.1 requires responsibilities and authorities to be assigned to roles and communicated to the management body, and Article 20(1) of the Directive makes that body approve the measures. Authority that exists only in someone’s head does not exist when the incident starts at 3 a.m.

3. Deputy training and vetting. Point 8.2.1 requires you to identify roles needing security skills and give them regular training, and 8.2.4 applies training to staff who “transfer to new positions or roles”. Reading a deputy designation as such a role is our interpretation, but it is the safe one. If the role is on your background-verification list under 10.2.2(a), point 10.2.2(b) requires verification before the person starts exercising it. Vet the deputy when you designate them, not on the day you need them. Our guide to role-based security training covers the training criteria.

4. A redundancy test with the primary absent. Point 4.2.6 requires “regular testing of the recovery of backup copies and redundancies”, covering “the copies, processes and knowledge to perform an effective recovery”, with documented results and corrective action. Knowledge is a people word. The simplest valid test is a drill in which the primary does not take part: the deputy runs the restore, or leads the tabletop exercise, and gaps go into a corrective-action list.

5. The annual role review. Point 10.1.3 requires you to review the assignment of personnel to roles “at planned intervals and at least annually”, one of the few fixed cadences in the Annex. ENISA’s example evidence is an “up-to-date list of employees and their assignment to roles” plus records of the review, “including the criteria used, the findings and any changes made”. Point 1.2.6 adds a review after significant incidents or changes, so a resignation or reorganisation should trigger an update without waiting for the anniversary.

Record	CIR point	Attribute proven	Common failure
Role register + deputy matrix	1.2.1, 4.2.4(c)	Responsibility	Deputy column says “IT team”, not a name
Delegation of authority	1.2.1, 4.1.2(d), Art. 20(1)	Authority	Never written, or signed by the primary instead of management
Training and vetting record	8.2.1, 8.2.4, 10.2.2(b)	Competence	Deputy trained once, at onboarding, for a different job
Primary-absent test	4.2.6	Competence, in practice	Only the primary has ever run the procedure
Annual role review	10.1.3, 1.2.6	All three, over time	Deputy left the company; the register still names them

Control 22 of our business continuity audit checklist asks for “cross-training records” as evidence of personnel redundancy. These five records are what sits behind that line.

Two traps that turn a deputy into a new finding

Shared credentials. The quickest way to “give the deputy access” is an envelope with the admin password. Point 11.3.2(c) requires you to “individualise and restrict system administration privileges to the highest extent possible”, so a shared account trades a continuity gap for an access-control finding. Give the deputy their own privileged account under the same strong authentication (11.3.2(a)) and the same periodic review (11.3.3). Our guide to privileged access management covers the account rules.

Conflicting duties. Point 1.2.5 requires conflicting duties to be segregated “where applicable”. The natural deputy is often the person next to the primary, which can be exactly the wrong person: the deputy for the change approver should not be the engineer whose changes need approval. Where the team is too small to avoid it, “where applicable” lets you record why, and the compensating control, under Article 2(2) of the CIR.

Small teams: what “at least partial” can look like

In plain terms: cover for authority mostly costs paperwork. Cover for competence costs time or money, and “partial” allows you to stage it.

Small teams are the norm, not the exception. In ISC2’s 2025 Cybersecurity Workforce Study of 16,029 professionals, 33% said their organisations “do not have the resources to adequately staff their teams”, and 72% agreed that reducing security personnel significantly increases breach risk. For an SME owner, the practical options are:

Option	Covers	Effort	Watch out for
Second decision-maker from management, with a written delegation	Responsibility, authority	Low	They still need a one-page briefing on what each decision means
Written procedures for the critical tasks, kept outside the affected systems	Part of competence	Low to medium	Untested procedures; prove them in the 4.2.6 test
Cross-training a colleague from IT or operations	Competence	Medium	Segregation (1.2.5) and an individual admin account (11.3.2(c))
Retained external provider (managed service or incident-response retainer)	Competence, some responsibility	Medium to high	Named people and skills written into the contract

Can the deputy be a supplier? The CIR does not say personnel redundancy must be in-house, and point 4.3.2(a) expressly allocates crisis roles to suppliers and service providers “where appropriate”. Treat an external provider as cover for competence, not authority. Decisions about your services stay with you, and Article 20(1) holds your management body accountable for the measures. Point 5.1.4(b) lets you write the provider’s skills and training requirements into the contract, where appropriate. Redundancy planning that covers only servers was one of the six common business continuity mistakes we flagged, and outsourcing without a named internal decision-maker repeats that mistake for people.

Who owns what

Role	Owns
Management body / board	Approves the delegations of authority and the risk-based choice of which roles get full, partial or no cover (Article 20(1))
Security lead / CISO	Runs the four-question test, the deputy matrix and the individual admin accounts
HR	Background checks before designation (10.2.2(b)), leave planning so primary and deputy are not away together, and updates when someone leaves
Continuity coordinator	Schedules the primary-absent tests and records the corrective actions (4.2.6)
Compliance officer	Keeps the five records together and runs the annual review (10.1.3)

Frequently asked questions

What does personnel redundancy mean under NIS2?

In CIR 2024/2690 point 4.2.4(c), it means at least partial backup for the people your continuity plan depends on, with the “responsibility, authority and competence” to act. The Directive itself only names business continuity in Article 21(2)(c); the CIR supplies the detail.

Does every employee need a backup?

No. The risk assessment and the continuity plan decide which roles need cover, and “at least partial” allows staged or incomplete cover. Roles that pass none of the four questions above usually need none.

How often must deputy arrangements be reviewed?

Point 10.1.3 requires a review of personnel assignments to roles at least annually, and point 1.2.6 adds a review after significant incidents or changes. Testing under 4.2.6 must be “regular”, with no fixed interval.

We are not a digital-infrastructure provider. Is key-person risk still an issue?

The CIR wording does not bind you, but your national law still requires business continuity measures under Article 21(2)(c), and supervisors may use the CIR and ENISA guidance as a reference. A continuity plan that depends on one unavailable person is hard to defend under any reading.

Sources

1. European Commission. Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, Articles 1–2 and Annex points 1.2, 4.1–4.3, 5.1.4, 8.2, 9.2, 10.1–10.2, 11.3. Official Journal of the EU, L series, 18.10.2024.
2. European Parliament and Council. Directive (EU) 2022/2555 (NIS 2 Directive), Articles 20 and 21. Official Journal of the EU, L 333, 27.12.2022.
3. ENISA. Technical Implementation Guidance on cybersecurity risk-management measures, version 1.0. June 2025.
4. European Parliament and Council. Directive 2003/88/EC concerning certain aspects of the organisation of working time, Article 7.
5. ISC2. ISC2 Publishes 2025 Cybersecurity Workforce Study. December 2025.