Czy zdarzenia w systemach są rejestrowane i przechowywane?

Rejestrowanie falls under multiple measures of article 21(2)

There is no separate point "logging" in article 21(2) of the NIS2 Directive. The question about recording and retaining events in systems primarily concerns point b, on incident handling, and point d, on business continuity and crisis management. Logging is the evidence with which you can reconstruct an incident: who did what, when, from which system. Without logs, the procedure for incident handling is in practice difficult to demonstrate, even if that procedure exists on paper. the procedure for incident handling in practice difficult to demonstrate, even if that procedure exists on paper.

What the customer asks for exactly differs per questionnaire. Some portals only ask whether logging takes place, others ask about the retention period, which systems are logged, or who has access to the logs. The latter again relates to access policy: if logs can be modified by the same people who should control them, it polityką dostępu i zarządzaniem zasobami firmy is relevant to mention. If you have no central logging or no documented retention period, answer with no or "partially" — a loose Excel file with error messages does not automatically count as evidence, and a made-up "yes" is no less so.

Article 21(2), in particular under b and d

Article 21(2) of the NIS2 Directive lists ten categories of measures that an entity must take, based on an "all-hazards" approach. Logging is not explicitly named as a separate category, but is in practice placed under section b (incident handling) and section d (business continuity, such as backup management and crisis management), because recorded events are necessary to detect, investigate and account for an incident. What exact requirement a customer attaches to this — retention period, scope, access control to the logs themselves — is not elaborated in the Directive itself but is often further detailed in national transposition or in the customer's portal.