Log Management and SIEM for NIS2 Compliance

The NIS2 Directive (The Network and Information Security Directive) is European legislation designed to strengthen the cybersecurity of information systems and networks across EU member states. Log management and SIEM solutions can significantly assist in meeting crucial parts of the directive.

Minimum cybersecurity risk management measures according to NIS2

NIS2 establishes a framework for cybersecurity risk management measures and reporting obligations through 10 minimum cybersecurity risk management measures listed in Article 21 of the Directive. 

• policies on risk analysis and information system security;
• incident handling;
• business continuity, such as backup management and disaster recovery, and crisis management;
• supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
• security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
• policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
• basic cyber hygiene practices and cybersecurity training;
• policies and procedures regarding the use of cryptography and, where appropriate, encryption;
• human resources security, access control policies and asset management;
• the use of multi-factor authentication or continuous authentication solutions.
• While the specific technical and organizational measures implemented will vary based on the national transposition of the Directive, they will be largely consistent across the EU.

Article 21 makes it clear that to comply with the NIS2 directive, organizations will need to implement several essential technical measures.

Expected technical measures required by NIS2 

Based on the wording of NIS2 and the drafts of national laws, regulated entities will need to develop competencies in the following areas:

• Physical security
• Network security
• Identity management and authentication
• Access rights management
• Detection of cybersecurity incidents
• Logging of security and relevant operational events
• Evaluation of cybersecurity incidents 
• Application security
• Cryptographic algorithms
• Ensuring the availability of regulated services
• Security of industrial, control, and other specialized technical assets

The role of log management and SIEM in the NIS2 Directive

Log management plays a crucial role in meeting the requirements of the NIS2 Directive and the cybersecurity acts of the member states. Let’s examine selected technical measures arising from NIS2 and how log management and SIEM help to meet them.

1. Detection of cybersecurity incidents

As the prevention mechanisms can’t keep pace with the ever changing cyber threats landscape, a key focus of the NIS2 Directive is on strengthening the detection and response capabilities of obligated entities.

A combination of log management and SIEM brings an important value as it allows: 

• Proactive detection of cyber threats 
• Alerting on malicious patterns and anomalies
• Centralized observability of the IT environment
• Incident investigation and response

When log management delivers visibility across the entire IT environment (endpoints, network, cloud workloads, operating systems, etc.), collects and stores relevant data, SIEM enables data/event correlations and incident analysis, enabling detection of anomalies and suspicious activities, alerting security teams and evaluating potential risks. 

Amongst others, log management tool can help to fulfill NIS2 requirements by:

• Verification and control of transmitted data within networks and between networks,
• Verification and control of transmitted data at the network perimeter of networks,
• Continuous and automatic protection against malicious code,
• Management and monitoring of communication among applications, their services, and processes,
• Detection of cybersecurity events,
• Behavior-based detection of unwanted activity of users, administrators or digital assets.

2. Logging of security and relevant operational events – NIS2 logging requirements

Obligated entities are subject to expanded incident reporting obligations, on-site inspections, regular and ad hoc security audits by competent authorities, and other supervisory and enforcement measures. Therefore, collecting data and context about security incidents or relevant operational events is crucial for meeting NIS2 compliance.

Log management delivers such data in an easily accessible way. It not only allows effective incident investigation and evaluation of their magnitude and impact but also ensures the storage of logs about activities across the IT environment, thus helping to cover the reporting and auditing obligations required by NIS2.

• Typically, centralized log management tools store logs, metrics, traces, and even events related to relevant security and operational records such as:
• Type of activity,
• Identification of the technical asset affected by the particular activity,
• Identification of the account under which the activity was performed,
• Success or failure of the activity,
• and many more.

This information will also play a key role in meeting tight reporting deadlines required by NIS2 for warning notifications (within 24 hours)

3. Evaluation of cybersecurity incidents

The new cybersecurity law will require essential entities to use a tool for continuous evaluation of detected cybersecurity events. This includes collecting, searching, and correlating information to detect and evaluate cybersecurity incidents.

This measure aims not only at proactive responses to emerging threats but also at the continuous optimization of the organization’s resilience by identifying and addressing security weaknesses.

Logmanager enables the collection of necessary information and, thanks to its SIEM functions, also correlates and evaluates these events, thereby fulfilling this obligation.

When did NIS2 come into effect?

The NIS2 Directive entered into force on January 16, 2023. EU member states were required to transpose it into national law by October 17, 2024, and NIS2 replaced the original NIS Directive from October 18, 2024.

In practice, the timing of implementation has varied across the EU. Some member states completed transposition on time, while others introduced their national legislation later. In May 2025, the European Commission was still pursuing 19 member states for failing to notify full transposition of the directive.

For organizations, this means that the exact compliance obligations, registration procedures, deadlines, and supervisory arrangements depend on the national legislation in the country where they operate. Organizations within the scope of NIS2 should therefore consult the national legislation of the relevant EU member state rather than relying solely on the EU-level directive (e.g., the Czech Cybersecurity Act or Poland’s national cybersecurity legislation).

Conclusion

Detection, analysis, and evaluation of cybersecurity events are crucial components of any effective defense against attacks and threats. It is therefore no surprise that these capabilities are also required under the NIS2 Directive.

Log management and SIEM tools can help organizations meet NIS2 requirements by supporting these capabilities, including the need to maintain information about security events, report incidents, and preserve relevant records for audits and regulatory oversight.

For many regulated businesses, NIS2 is also rarely the only framework they need to consider. Most must comply with additional IT compliance requirements such as ISO 27001, GDPR, DORA, and others, each with its own expectations around what should be logged and how long records should be retained.