Are events in the systems recorded and retained?

Logging falls under multiple measures of Article 21(2)

There is no separate item "logging" in Article 21(2) of the NIS2 Directive. The question about recording and storing events in systems primarily concerns point b, on incident handling, and point d, on business continuity and crisis management. Logging is the evidence with which you can reconstruct an incident: who did what, when, from which system. Without logs, the incident handling procedure is in practice difficult to demonstrate, even if that procedure exists on paper.

What the customer asks exactly varies per questionnaire. Some portals only ask whether logging takes place, others ask about the retention period, about which systems are logged, or about who has access to the logs. The latter again touches on access policy: if logs can be modified by the same people who should control them, it is access control and management of business assets relevant to mention. If you have no central logging or no documented retention period, answer with no or "partially" — a separate Excel file with error messages does not automatically count as evidence, and a made-up "yes" is no less one.

Article 21(2), in particular under b and d

Article 21(2) of the NIS2 Directive lists ten categories of measures that an entity must take, based on an "all-hazards" approach. Logging is not explicitly named as its own category, but is in practice placed under item b (incident handling) and item d (business continuity, such as backup management and crisis management), because recorded events are necessary to detect, investigate and account for an incident after the fact. What exact requirement a customer attaches to this — retention period, coverage, access control to the logs themselves — is not elaborated in the Directive itself but is often further specified in national implementation or in the customer's portal.