The entry into force of the NIS2 Directive across the European Union, together with its national transpositions such as Portugal’s Decree-Law 125/2025, is reshaping the way digital service providers must approach information security and, in particular, the retention and management of logs.
This legislation goes far beyond general cybersecurity principles; it introduces clear, structured and mandatory obligations for hosting companies, cloud operators, DNS and email service providers, managed service providers and organisations running any form of digital infrastructure.
As a result, environments that have traditionally relied on short-term operational logging now face the need to rethink their entire approach to the collection, storage and traceability of evidence.
Portugal’s implementation of NIS2 affects me directly as a service provider and affects every Enhance user operating from Portugal. However, these obligations are not confined to Portuguese providers.
Because NIS2 is an EU-wide directive, the same requirements apply to all Enhance users operating within the European Union, regardless of the size or maturity of their hosting setup.
Moreover, based on conversations with government contacts in several African countries, it is already clear that many of these nations intend to follow the same path and adopt legislation aligned with the European framework.
In practical terms, this means that expectations around long-term log retention, forensic traceability and greater operational accountability will soon extend beyond Europe and become a broader international standard.
This requirement also needs to be understood in light of the broader European timeline. In many EU Member States, the national transposition of NIS2 is already underway, and several countries are preparing to enforce long-term log retention as a mandatory requirement within the next few months.
As each national law comes into force, these obligations will no longer be theoretical: providers will be expected to retain logs for extended periods, maintain their integrity and ensure they can be delivered promptly for audits or security investigations.
The expectation is that long-term, structured and tamper-resistant logging will rapidly become a baseline standard across the European Union, further reinforcing the need for hosting platforms and service providers to adopt logging architectures capable of meeting these demands.
Under NIS2, every covered entity must be able to detect security incidents, understand how they occurred, reconstruct the sequence of events and provide the relevant authorities with the necessary records for investigation and mitigation.
None of this is possible without complete, reliable and long-term log data. Logs are no longer simple technical artefacts used for troubleshooting; they become legal evidence and a fundamental part of organisational accountability.
The directive requires that entities maintain logging capabilities that support forensic analysis, clear attribution of actions and proof that suitable security measures were in place before, during and after an incident.
In practice, this means logs must exist, must be preserved for extended periods, and must be protected against alteration or premature deletion.
This requirement highlights a practical challenge: many hosting control panels, including Enhance, are not yet prepared to meet these new standards. By default, most system logs, web server logs, email logs and DNS logs are retained only for short periods—ranging from a few days to a few weeks.
Operating system rotation policies remove logs long before the retention periods implied by NIS2, which typically range from six to twenty-four months.
Furthermore, Enhance currently lacks built-in tools for centralising logs across nodes, ensuring log integrity or retrieving historical logs in a format suitable for audits. Without such capabilities, providers operating within the EU will struggle to meet their legal obligations under NIS2, regardless of their internal security practices.
One of the most important steps toward compliance, and a measure that any provider subject to the NIS2 framework should seriously consider, is the creation of a dedicated logging infrastructure that is physically and logically separated from all production systems.
Setting up a standalone logging server—used exclusively to receive and store logs over the long term—ensures that every record is collected through secure channels and preserved independently from the servers that generate them.
This reduces the risk of accidental loss, corruption or deletion and provides a safer environment for retaining information with legal significance.
To meet the expectations set by the directive, this logging server should also be capable of organising logs in a structured, audit-ready manner, particularly sorted by date and by customer account.
This level of organisation allows service providers to quickly retrieve the exact records needed for an investigation, an internal review or a formal request from national cybersecurity authorities.
It also reflects well-established forensic best practices, where logs must remain intact and trustworthy even if a production server is compromised.
This architectural change may be one of the most decisive steps toward achieving full legal compliance, because it delivers the level of traceability, continuity and operational accountability that the NIS2 framework explicitly requires.
By adopting a dedicated logging server and ensuring that logs are centralised, securely transmitted, properly indexed and retained for the necessary period, service providers place themselves in a position where they can demonstrate — not merely claim — their commitment to transparency, resilience and responsible operational governance.
The urgency of adopting these changes is becoming increasingly clear. As NIS2-derived national laws take effect, authorities will expect complete traceability, and organisations will be required to justify their actions with verifiable evidence.
Security incidents must be reported within twenty-four hours and followed by detailed reports within thirty days. None of this can be achieved effectively without structured, tamper-resistant log data.
Providers unable to meet these requirements risk not only operational difficulties but also serious legal and financial consequences.
NIS2 is neither optional nor advisory. It is a binding regulatory framework designed to raise the level of cybersecurity and resilience throughout the European digital ecosystem.
For hosting providers, cloud operators and any organisation delivering digital services, adapting to this new reality is not simply advisable — it is mandatory.
By investing in long-term log retention, integrity mechanisms, centralised storage and dedicated logging infrastructure, providers not only comply with the law but also significantly strengthen their ability to protect clients and maintain long-term operational trust.
