the questionnaire asks how long we retain our system logs and log files

No fixed retention period in NIS2 or ISO 27001

There is no figure in the regulation. Article 21(2) of the NIS2 Directive does not mention logging as a separate point, but log files fall in practice under two of the ten measures: point (b), the handling of security incidents, and point (d), security in the procurement, development and maintenance of systems. Both require that an organisation be able to reconstruct incidents, and that is only possible with logs that are retained long enough to trace back an attack. How long that is, the Directive leaves to the organisation itself.

What the customer actually wants to know, then, is not a figure but whether there is a deliberate choice behind it. An answer such as "90 days for application logs, 12 months for access logs" is stronger than "we retain logs" without a period, because it shows that the retention period is tailored to what is needed to investigate an incident. If that policy has not yet been set down, it is often part of the same procedure as the approach to security incidents: whoever uses logs to reconstruct an incident must also record how long those logs are retained to be able to do so.

Substantiation: Article 21(2) and Annex A

The link to Article 21(2), points (b) and (d), of Directive (EU) 2022/2555 is indirect: the Directive requires incident handling and secure system development, and log retention is a prerequisite for this, not an explicit requirement. ISO/IEC 27001 Annex A is more concrete with the measure on logging and monitoring, but there too no fixed period is specified; the standard requires the organisation itself to determine and justify a period. Companies that already periodically test whether their measures are still effective have usually already included the log retention period as a fixed part of that testing, and can transfer that period directly into the answer.