When a cyberattack disrupts critical IT systems, the consequences can extend far beyond compromised data and unavailable applications. Organisations may also lose the communication channels needed to coordinate their response. As Europe strengthens its cybersecurity framework through the NIS2 Directive, the resilience of voice communications is becoming an increasingly important consideration for security professionals. Cloud-based telephony offers opportunities to improve availability and operational flexibility, but it also introduces dependencies that must be carefully managed. The central challenge is no longer simply keeping systems online, but ensuring that organisations can continue to communicate when their digital infrastructure is under attack.

A serious cybersecurity incident creates two simultaneous challenges. Technical teams must identify and contain the threat, while management, security personnel and external partners need to coordinate decisions under considerable time pressure. If the communication systems supporting these activities become unavailable, even a relatively contained incident can develop into a wider operational crisis. The ability to communicate reliably is therefore not merely a supporting function of incident response. It is one of the conditions that makes an effective response possible.

Across Europe, the growing integration of voice communications, collaboration platforms and business applications has increased operational efficiency while creating new forms of interdependence. Services that once operated independently now frequently rely on shared networks, identity management systems and cloud infrastructure. This convergence can create vulnerabilities when organisations need to disconnect affected systems or isolate parts of their networks to contain a cyberattack. The resulting challenge is particularly significant for critical infrastructure operators, industrial facilities and security organisations whose activities depend on continuous coordination across multiple locations.

NIS2 brings communication resilience into the regulatory framework

The European Union’s NIS2 Directive establishes a common cybersecurity framework covering 18 critical sectors, including energy, transport, healthcare, digital infrastructure and certain ICT services. Its approach extends beyond preventing cyberattacks to ensuring that organisations can withstand disruptions, manage incidents and maintain essential operations. Business continuity, incident handling and crisis management are therefore central elements of the legislation.

Article 21 of Directive (EU) 2022/2555 requires essential and important entities to implement appropriate and proportionate technical, operational and organisational cybersecurity risk-management measures. Article 21(2)(j) explicitly addresses secured voice, video and text communications, together with secured emergency communication systems where appropriate. This provision recognises that effective cybersecurity depends not only on protecting information systems but also on maintaining the communications necessary to manage disruptions.

The Directive does not prescribe a particular telephony architecture or require organisations to migrate from locally operated systems to cloud services. Instead, it establishes a risk-based approach in which measures must reflect the organisation’s exposure, operational requirements and the potential consequences of disruption. The distinction is important: adopting cloud telephony does not, by itself, establish compliance with NIS2, just as maintaining an on-premises system does not necessarily indicate inadequate resilience.

Although NIS2 provides a common European framework, its implementation and supervision operate through national authorities and legislation. Organisations working across several Member States must therefore consider both the Directive’s underlying requirements and the applicable national arrangements. For some categories of digital infrastructure and ICT service providers, Commission Implementing Regulation (EU) 2024/2690 establishes more detailed technical and methodological requirements at EU level. These include provisions addressing communication procedures, business continuity, disaster recovery and crisis management.

Cloud telephony: Greater flexibility, different vulnerabilities

Cloud-based telephony can reduce dependence on individual office locations and locally installed telephone exchanges. Centralised platforms can support geographically distributed users, consistent numbering plans, remote administration and predefined call-routing arrangements. Where appropriately designed, geographically redundant infrastructure and alternative carrier connections can reduce the operational consequences of certain equipment or site failures.

For organisations operating across national borders, such capabilities can offer significant practical advantages. Calls may be redirected between offices, mobile devices or designated crisis teams, allowing key personnel to remain reachable when a particular location becomes unavailable. Centralised administration can also simplify the management of permissions, emergency contact groups and communication procedures across geographically dispersed operations.

However, technological centralisation also changes the nature of operational risk. A cloud telephony platform may continue functioning while users remain unable to access it because of a local network failure, an interrupted internet connection or the unavailability of an authentication service. Similarly, geographically separated data centres may still depend on common management systems, telecommunications carriers or other shared components.

This distinction between platform availability and actual organisational reachability is fundamental. A contractual guarantee covering a cloud service does not necessarily describe the availability of the entire communication path from one user to another. For resilience assessments, organisations must consider network access, power supplies, routing infrastructure, identity services, endpoints and external telecommunications connections as part of an interconnected system.

The appropriate measure is therefore not simply whether individual components are redundant, but whether the failure of one component can disrupt other supposedly independent elements. Without this broader assessment, organisations risk replacing identifiable local vulnerabilities with less visible dependencies on external infrastructure.

The incident response dilemma: What happens when the network must be disconnected?

One of the most challenging scenarios arises when cybersecurity teams need to isolate compromised systems. Network segmentation and the disconnection of affected infrastructure are established incident-containment measures. Yet the same action may interrupt IP-based telephony, collaboration applications or administrative services required to coordinate the response.

This creates a potentially serious conflict between containment and operational continuity. A security measure intended to limit an attack can inadvertently restrict an organisation’s ability to manage the incident. The problem becomes particularly acute where emergency communications depend on the same infrastructure that has been compromised.

Effective planning therefore requires communication arrangements that do not rely entirely on the systems most likely to be isolated during an incident. Depending on operational requirements, these may include independent mobile connections, dedicated emergency devices or alternative communication services with separate technical dependencies. Their suitability must be assessed against realistic failure scenarios rather than the assumption that using different applications automatically provides independent communications.

The European Union Agency for Cybersecurity, ENISA, has reinforced the importance of structured business continuity and incident-management measures through its technical implementation guidance published in June 2025. Developed to support the requirements of Commission Implementing Regulation (EU) 2024/2690, the guidance addresses incident handling, crisis management, supply-chain security and the assessment of cybersecurity controls. Although the guidance applies specifically to the sectors covered by that regulation and is not legally binding in itself, it provides a useful reference for evaluating operational resilience.

A credible crisis communication strategy must address both technology and procedures. Organisations need current contact information, clearly defined escalation responsibilities and communication methods that remain accessible when normal business systems are unavailable. They must also consider confidentiality, since switching to unapproved messaging applications or insecure channels during an emergency can create additional information security risks.

Securing the communications infrastructure itself

The integration of telephony into enterprise IT environments has implications beyond service availability. Modern platforms frequently connect with identity management systems, customer relationship management software and collaboration applications through administrative interfaces and application programming interfaces. These integrations can increase efficiency but may also expand the potential attack surface.

Compromised administrative accounts can, depending on the system and permissions involved, enable unauthorised changes to call-routing configurations, access controls or communication services. Inadequately secured interfaces, vulnerable endpoints and weaknesses in provider infrastructure can create further opportunities for disruption or misuse.

Security controls must consequently extend beyond the protection of transmitted voice data. Strong authentication for privileged accounts, restrictive access management, logging of configuration changes and continuous monitoring of critical systems are essential elements of a comprehensive architecture. Encryption technologies can protect signalling and media traffic, although organisations must distinguish between encryption of individual transmission segments and genuine end-to-end protection.

External service providers add another dimension. Article 21(2)(d) of NIS2 includes supply-chain security among the required cybersecurity risk-management measures. Organisations must therefore consider risks associated with their direct suppliers and service providers rather than treating outsourced communications as infrastructure that falls outside their security responsibilities.

In practical terms, this requires scrutiny of provider dependencies, contractual service levels, incident escalation procedures and the evidence available to demonstrate the effectiveness of security controls. Recovery arrangements and the ability to maintain or restore communications during a provider outage should form part of procurement and ongoing risk management.

Implications for European security operations and critical infrastructure

For the European security industry, the availability of communication services has particular operational significance. Security control rooms, corporate security departments, industrial protection teams and intervention services frequently depend on rapid coordination between personnel, facilities and external responders. Interruptions can delay operational decisions, complicate incident escalation and undermine the continuity of security services.

The distinction between general business telephony and dedicated safety- or security-critical communications must nevertheless remain clear. Alarm receiving centres, emergency call-handling arrangements and specialised alarm transmission systems may be subject to specific European or national standards and operational requirements. General-purpose cloud telephony may support these environments, but it cannot automatically replace infrastructure designed and approved for dedicated alarm transmission or other specialised functions.

For security managers, the appropriate approach is to assess communications according to operational criticality. Temporary disruption of routine administrative calls may be tolerable, while the loss of communication between a security control room and intervention personnel may require more stringent continuity arrangements. Recovery objectives, alternative communication methods and escalation procedures should reflect these differences.

This broader risk perspective is also relevant to the EU’s Critical Entities Resilience Directive, Directive (EU) 2022/2557. While NIS2 primarily addresses cybersecurity, the Critical Entities Resilience framework focuses on the ability of designated critical entities to withstand and recover from a wider range of disruptions, including physical threats and other emergencies. The two frameworks have distinct scopes and obligations, but they illustrate the increasing importance of coordinated physical and digital resilience across Europe.

Not every private security company is automatically subject to NIS2 or the Critical Entities Resilience Directive. Nevertheless, security providers working with critical infrastructure operators may face demanding contractual requirements concerning service continuity, incident reporting and the reliability of supporting communications. These dependencies make communication resilience relevant well beyond organisations directly regulated under either framework.

Cross-border operations require more than national contingency plans

The European dimension becomes particularly important when businesses, service providers and security teams operate across multiple jurisdictions. A disruption affecting a shared communications platform may simultaneously impact offices, operational centres or suppliers in several countries. In such circumstances, incident response requires coordination not only between internal teams but potentially also between national authorities and external service providers.

Article 23 of NIS2 establishes a staged reporting framework for significant incidents. Under the Directive’s general regime, affected entities must submit an early warning within 24 hours of becoming aware of a significant incident, followed by an incident notification within 72 hours. Further reporting obligations include a final report, generally due no later than one month after the incident notification. The detailed reporting arrangements and competent authorities depend on the applicable provisions and national implementation.

Meeting these obligations requires more than the ability to transmit an electronic notification. Organisations need reliable processes for collecting information, determining the potential impact of an incident and coordinating decisions across business units and jurisdictions. If normal communication systems are compromised or unavailable, these processes may become considerably more difficult.

Multinational organisations should therefore consider whether crisis communication plans are genuinely interoperable across locations. Differences in telecommunications infrastructure, national operating arrangements and outsourced service dependencies can complicate recovery. A centralised communications platform may simplify coordination during normal operations, but resilience depends on whether alternative arrangements remain viable when shared infrastructure becomes unavailable.

Operational resilience must be tested, not assumed

Technical redundancy and documented continuity plans provide a foundation for resilience, but neither guarantees performance during a real incident. Organisations need to establish whether alternative communication routes work under realistic conditions and whether personnel can activate them without relying on unavailable systems.

Exercises should therefore include scenarios involving the loss of internet connectivity, the failure of identity services, disruption to a telecommunications provider or the deliberate isolation of compromised network segments. Tests involving several simultaneous failures can be particularly valuable because they reveal dependencies that may remain hidden during routine system checks.

The results should inform business impact assessments, incident response procedures and continuity planning. Alongside technical recovery times, organisations need to consider how quickly a crisis team can be assembled, whether external partners remain reachable and how critical decisions can be documented when standard business applications are inaccessible.

NIS2 has given these considerations a clearer place within Europe’s cybersecurity framework. The underlying operational challenge, however, extends beyond regulatory compliance. A communication system cannot be regarded as resilient merely because its infrastructure is modern, cloud-based or geographically distributed. Its resilience must be demonstrated through architecture, governance and repeated testing.

For European organisations, the decisive question is not where their telephony systems are hosted, but whether critical communication can continue when the infrastructure supporting everyday operations fails. Cloud-based solutions can contribute to that objective, provided their dependencies are understood and appropriate alternatives are available. In a major cyber incident, the ability to communicate is not simply a matter of convenience or technical availability. It is a prerequisite for maintaining command, coordinating security operations and preserving organisational control.

Sources and regulatory references

• European Parliament and Council: Directive (EU) 2022/2555 (NIS2), particularly Articles 21 and 23.
• European Commission: Commission Implementing Regulation (EU) 2024/2690, concerning cybersecurity risk-management requirements for specified digital infrastructure and ICT service providers.
• European Union Agency for Cybersecurity (ENISA): NIS2 Technical Implementation Guidance, June 2025.
• European Parliament and Council: Directive (EU) 2022/2557 on the resilience of critical entities.
• reputatio systems GmbH & Co. KG: “NIS2 im Fokus: Cloud-Telefonie als Rückgrat der Krisenkommunikation”, press release, 28 October 2026.