NIS2 gives you 24 hours, 72 hours and a month. It never says how long to keep the logs that would answer any of them.

Twenty-four hours, seventy-two hours, one month. Article 23 of the NIS2 directive sets three clocks running from the moment an entity becomes aware of a significant incident: an early warning within a day, a fuller notification within three, a final report within one month. The early warning is a low bar. Say whether you suspect an unlawful or malicious act and whether there may be cross-border impact, which on day one is mostly an admission that you do not yet know.

The seventy-two-hour notification is the one that costs. It asks for an assessment of severity and impact, and for indicators of compromise where you have them. An indicator of compromise is a fact recovered from a log. So the second clock is not really a reporting obligation. It is a retention obligation wearing a reporting obligation over it.

The number the directive never writes down

Article 21(2) lists ten families of measure that an entity has to take, and incident handling is the second of them. Neither that article nor Article 23 states a retention period for logs. Not a number of days, not a number of months, not a floor. The obligation to answer a question in seventy-two hours arrives without the obligation that would make it answerable.

One place in the NIS2 family does write something resembling a logging specification: Commission Implementing Regulation (EU) 2024/2690, which sets technical requirements for the digital infrastructure and digital provider categories — DNS, cloud, data centres, managed service providers, marketplaces. A water utility is not on that list. So the only written specification in the system binds few of the entities in scope, and a supervisor with no yardstick will reach for the nearest one anyway.

None of this is new, and it is worth saying so. Article 32 of the GDPR has required appropriate technical measures since 2018, and a logging duty has been readable in it for eight years by anyone who wanted to read one. What is new is that a different regulator will now ask, on a deadline, in writing.

Retention also pulls in two directions at once. Logs are personal data, Article 5(1)(e) says no longer than necessary, and a security team that wants twenty-four months is asking a DPO to write down why in a document someone may later read back to them.

The utility this page is written for

Nine hundred staff, four hundred thousand connections, drinking water and waste water. Eleven treatment and pumping sites with control systems, the oldest commissioned in 2004, reachable from the corporate network through a firewall rule last reviewed in 2019. Around fourteen hundred corporate endpoints and two line-of-business systems still on premises. Three people in information security, one of whom is also the network. The plant runs an out-of-hours rota; it is a rota for water, not for logs.

Water sits in Annex I, which makes an entity of this size essential rather than important, and essential entities are supervised before something happens rather than after. That classification is worth more to this procurement than any feature on any datasheet, because it changes who turns up and when.

It is a composite, assembled from three utilities that would not want to be named. A named one would let you match the answer to the logo instead of to the constraint, and the constraint is the argument.

The binding constraint is not detection. It is that at two in the morning on a Sunday there is nobody for a detection to reach.

The method, and the disclosure that goes with it

This page is the method. It is not the verdict.

Nothing has been put through this brief yet, so nothing is ranked. Ranking products against criteria they have not been measured against is a comparison of marketing material, and a comparison of marketing material is marketing. No product is named below, which costs this page the reader who came for four names to put on a slide.

On the wall: sponsorship is sold on this site. A live campaign from any vendor assessed here would be declared here, in this voice, and again at the point the vendor is discussed. The campaigns file was empty when this was filed.

Two criteria decide it and four decide the margin

The weights are the argument. Criteria are free.

Answering the seventy-two hours, 25. Given a compromise discovered on day nine, can the utility reconstruct first access, scope and lateral movement from what was kept — and can it state, in the notification, what it could not reconstruct. The second half is the part nobody procures for and every supervisor reads.

Coverage of the eleven sites, 20. Most log platforms cover whatever accepts an agent, and the control systems do not accept an agent. A platform scoring well here is one that gets something usable off the plant network without a project.

Then the four that move the margin rather than the outcome. Somebody awake, 15, because the gap between detection and response at 02:40 is where this brief actually fails. Retention that survives both arguments, 15: long enough to reconstruct, short enough to defend, and priced so the answer is not decided by the invoice. Five-year cost including the ingest curve, 15, since consumption pricing is quoted against a volume nobody has measured yet. Exit, 10: the detections, the parsers and the history, and what format they leave in.

A platform nobody watches at three in the morning is an archive with a licence fee attached.

Coverage outranks cost because a gap in coverage is invisible until it is quoted back at you.Cost failures arrive as a renewal conversation, which is unpleasant and survivable. Coverage failures arrive as a sentence in a final report saying the entity was unable to determine.

Six ways to answer, one of which is to keep the logs you already keep

Carry on, with a map. Write down what each system already retains and for how long, appoint a named person, rehearse the notification. Exit cost zero, coverage unchanged, and it scores badly on somebody awake. Leaving it off a shortlist is how an organisation buys a platform to fix a rota.

The incumbent's monitoring add-on. The managed service provider already running the estate sells security monitoring on top. Cheapest to buy and to staff, and it sees precisely as far as the contract that preceded it, which at this utility stops at the firewall in front of the plant.

Cloud-native SIEM on the hyperscaler already in use. Good coverage of the corporate estate, consumption pricing, and a retention decision that turns into a monthly number. The number is the product.

A licensed log platform run in-house. Predictable cost, full control of retention, and it consumes the scarcest thing this utility has, which is three people.

An open-source stack, self-hosted. The same trade with the licence removed and the staffing cost raised. Best exit score in the field, by construction.

Managed detection and response. They bring the platform and, more to the point, they bring the night, which is the binding constraint. Their coverage of the eleven sites is the question, and their answer to it is usually a sentence rather than a method.

What fell out before testing: endpoint detection presented as a SIEM; anything demonstrated on a dataset the vendor generated; anything quoting year one only; and one proposition that could not say which country the retained logs sit in, which is a disqualification rather than a low score.

What the testing has to measure

An anonymised real incident from 2024, replayed against each option, with the clock running from the day of discovery rather than the day of compromise. A filled seventy-two-hour notification, timed, written by the utility's own three people. A retention cost curve at ninety, one hundred and eighty and three hundred and sixty-five days, at measured volume and again at three times that, because the measurement will be wrong. A coverage count: of eleven sites, how many produce anything at all, and what. One unannounced drill at 02:40 on a Sunday. And an export, handed to a second platform, to see what survives the journey.

Two things will not be tested. Protocol-level detection inside the control systems, because a Modbus or DNP3 parser cannot be judged without a plant to break, and if that is your primary use case this comparison is not for you. And no member state's reporting portal, because the form differs by country and a pre-filled template is worth nothing until you have seen the one your own authority publishes.

Who should ignore this page

Digital infrastructure, cloud and managed service providers, who are covered by the implementing regulation and so have a specification the rest of the field does not. A different brief, and an easier one. Anyone already inside a supervisory process with a date in a letter, where the question stops being what to buy and becomes what can be evidenced by that date. And anyone told they are in scope by a customer's procurement questionnaire who sits under the size thresholds: read Article 2 first, and spend nothing until you have.

What would make us rewrite it

A competent authority naming a retention period. That turns a judgement into a floor, moves weight off cost and onto retention, and probably reorders the middle of the ranking. An extension of the implementing regulation's technical requirements beyond digital infrastructure would do the same thing harder, and to everyone. And if the eleven sites are given their own segmented network with its own collection, coverage stops being a criterion worth 20 and becomes an assumption, at which point three of the six answers converge.

Until someone writes the number down, every retention period quoted in this market is a guess with an invoice attached. The testing starts in January.