Zenarmor reporting as audit evidence for NIS2 and ISO 27001

Under NIS2 and ISO 27001:2022 you must be able to show that you record, protect, analyse and act on network activity. That is the essence of A.8.15 (Logging) and A.8.16 (Monitoring activities), and the foundation for reporting a significant incident within 24 hours, 72 hours and one month. Zenarmor provides the building blocks: more than 60 reports, alert rules, scheduled PDF reports, an audit trail in Zenconsole, local storage in Elasticsearch or SQLite, and streaming to your SIEM, a syslog server or a remote Elasticsearch. It only becomes evidence once you define, per requirement, which log or report proves it, how long you keep it, how often someone reviews it and who owns it.

This article covers what auditors and supervisors want to see, what Zenarmor logs, how to choose retention periods that satisfy both NIS2 and the GDPR, and what a complete evidence pack looks like. Secrotec writes this as an independent ISO 27001 Lead Auditor and official Zenarmor partner in the Netherlands: we see every day the difference between "logging is switched on" and "logging is demonstrably effective".

What NIS2 and ISO 27001 actually require

NIS2: Articles 21 and 23

Article 21 of the NIS2 Directive requires essential and important entities to take appropriate risk-management measures, including incident handling (Art. 21(2)(b)) and policies to assess the effectiveness of those measures (Art. 21(2)(f)). The word "logging" does not appear as such, but without logs you can neither handle incidents nor measure effectiveness. Article 23 sets the reporting deadlines: an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after the notification.

More specific is Commission Implementing Regulation (EU) 2024/2690. Annex point 3.2, "Monitoring and logging", requires procedures and tools to monitor and log activity on network and information systems, with logs covering inbound and outbound traffic, authentication, privileged access, configuration changes and security tools such as firewalls. Logs must be kept and backed up for a predefined period, protected against unauthorised access or change, and systems must use synchronised time sources. The regulation applies directly to digital providers such as cloud, data centre and managed (security) service providers, but it is a useful benchmark for every organisation. ENISA's NIS2 Technical Implementation Guidance (June 2025) adds examples of evidence.

National notes: the Netherlands and Germany

In the Netherlands, NIS2 is transposed by the Cyberbeveiligingswet (Cbw), in force since 15 August 2026 according to the Dutch government announcement, with the same 24-hour, 72-hour and one-month reporting sequence. In Germany, the obligations sit in the revised BSI Act (BSIG); according to the BSI's reporting page, they apply from 6 December 2025, with reporting under Section 32 BSIG. Our NIS2 compliance page explains the wider obligations.

ISO 27001:2022

ISO 27001 is more explicit. The relevant Annex A controls in brief:

Control	Essence	What the auditor asks for
A.8.15 Logging	Produce, store, protect and analyse logs of activities, exceptions, faults and relevant events	Logging policy, scope, retention, tamper protection, documented reviews
A.8.16 Monitoring activities	Monitor networks and systems for anomalous behaviour and respond appropriately	Alert rules, follow-up, link to incidents
A.8.17 Clock synchronisation	A single reliable time source for all systems	NTP configuration, consistent timestamps
A.5.25 Assessment of events	Decide whether an event is an incident	Triage criteria, recorded decisions
A.5.26 Response to incidents	Handle incidents according to procedure	Incident records with timeline and actions
A.5.28 Collection of evidence	Identify, collect and preserve evidence	Exports with integrity and a recorded chain of custody

What an auditor or supervisor wants to see

An auditor tests three layers: design (is there a logging policy that fits the risk assessment?), implementation (are logging and alerts actually enabled on the right systems?) and operating effectiveness (is there demonstrable review and response over a longer period?). Most organisations stumble on the last layer. Showing a dashboard is not enough; the auditor wants a sample of alerts that led to a ticket, and reviews recorded with a date and a name.

Typical questions we ask as auditors:

• Which systems log, and why those? Where is that in your risk assessment?
• How long do you keep which logs, and how do you justify that period?
• Who can view, change or delete logs, and is that itself logged?
• How often are reports reviewed, and where is the proof?
• Which alert led to which incident, and how quickly was it followed up?
• Can you reconstruct an incident from six weeks ago?

What Zenarmor logs and reports

Zenarmor records per session which device or user talked to which destination, which application and category were involved and which policy acted. According to the documentation on streaming reporting data, there are five data streams: Connections, Web, DNS, TLS and Alerts. On top of those, Zenarmor provides more than 60 reports and dashboards, plus Live Sessions for real-time insight.

• Alert rules: Threat & Activity Alert Rules notify you of, for example, blocked threats or unusual activity; since version 2.7 also with a daily frequency.
• Scheduled reports: according to the scheduled reports documentation, reports are e-mailed as PDF through your own SMTP server or Zenconsole's mail service, on the days you choose. Unified Secure includes 20 scheduled reports; the enterprise plans an unlimited number.
• Audit trail in Zenconsole: since version 2.6 (June 2026) every action by a Zenconsole user is logged, including policy updates, configuration changes and adding or removing Zenarmor instances. Version 2.7 added audit logs for endpoint agents and OPNsense gateways, covering logins and logouts, engine status changes and updates (release notes).

That audit trail is gold in audits: it answers in one screen who changed which firewall rule and when, which also touches change management (A.8.32) and privileged access rights (A.8.2) in ISO 27001.

Storage and retention: local, cloud or SIEM

Where your logs live determines how far back you can look and how well they are protected. Zenarmor supports several options that you can combine:

Option	Location	Retention	Best for
SQLite (local)	On the gateway	Configurable, limited by disk space	Small environments up to around 100 devices
Elasticsearch (local)	On the gateway, at least 8 GB RAM	Configurable, limited by disk space	Larger networks needing longer local history
Elasticsearch (remote)	Your own server or cluster	Your own policy	Central storage outside the gateway
Streaming to syslog/SIEM	Syslog server, SIEM (e.g. Wazuh), external Elasticsearch	Your own policy, months to years	Long-term evidence, correlation, SOC
Zenconsole cloud reporting	Zenarmor cloud, selectable region (including the Netherlands and Germany)	15 days (Unified Secure), 30 (Plus), 90 (SSE/ZTNA/SASE)	Central view across sites

The choice between SQLite and Elasticsearch is described in the reporting database documentation; retention per plan is on the plans page (status October 2026). Note that, according to Zenarmor's documentation, the local store duration defaults to 7 days and can be adjusted with a slider. Streaming to external systems is not available in the Free and Home editions.

Why 15 days is often too short

According to Mandiant's M-Trends 2025, the global median dwell time was 11 days, and 26 days when an external party notified the organisation. If you discover a problem after three weeks, 15 days of retention means the start of the attack is already gone. On top of that, the NIS2 final report requires a complete timeline. Our rule of thumb: use cloud or local reporting for daily operations, and stream security-relevant logs to a SIEM or syslog server with a retention period derived from your risk assessment, in practice often 6 to 12 months.

On data location: since Zenarmor 2.7 you can choose the region of the central reporting database, including the Netherlands and Germany. The plans page lists "customizable data residency" for the enterprise plans on request; have the region for your plan confirmed in the quote.

Retention periods and the GDPR

Firewall logs contain personal data: IP addresses, usernames, visited domains. The GDPR sets no fixed period, but requires purpose limitation and storage limitation (Article 5) and appropriate security (Article 32). The tension with NIS2 is therefore less about the period itself than about its justification. In practice:

• Differentiate by log type. Alerts and blocked threats have longer evidential value than detailed per-user web and DNS logs.
• Record the periods in your logging policy and records of processing, with a reason for each.
• Restrict access to logs to those who need it, and log that access too.
• Do not use logs for performance assessment. If you do, the purpose changes and employee representation rules apply, such as Article 27 of the Dutch WOR or Section 87 of the German BetrVG. Our article on TLS inspection and the GDPR explains how to draw that line.

For more on combining privacy and security, see GDPR and ISO 27001 together.

The evidence pack: from requirement to report

An evidence pack links every requirement to a concrete piece of evidence, a frequency and an owner. The table below is the starting point we use with clients; adapt it to your risk assessment and Statement of Applicability.

Requirement	Zenarmor report or log	Frequency	Owner
ISO A.8.15, Impl. Reg. 2024/2690 § 3.2	Logging policy plus export of retention and streaming settings	Annually and on change	CISO / ISMS owner
ISO A.8.16, NIS2 Art. 21(2)(b)	Threat & Activity Alert Rules and alert overview	Alerts daily, weekly review	IT operations / SOC
ISO A.8.7, A.8.23	Scheduled PDF report of blocked threats and web categories	Weekly or monthly	IT operations
ISO A.8.20, A.8.22	Traffic report per interface/VLAN and policy per segment	Monthly	Network team
ISO A.8.32, A.8.9	Zenconsole audit trail: policy and configuration changes	Monthly review	CISO
ISO A.8.2	Gateway audit logs: administrator logins	Monthly	CISO
ISO A.5.25, A.5.26, A.5.28	Incident file with linked alerts and log exports	Per incident	Incident manager
NIS2 Art. 23	Timeline from logs: detection, scope, measures	Per significant incident: 24 h, 72 h, 1 month	Incident manager and management board
ISO A.8.17	NTP settings of gateway and SIEM	Annually	IT operations
NIS2 Art. 21(2)(f), ISO 9.1 and 9.3	KPI overview: blocks, alerts, response time, trends	Quarterly	CISO, to management

Keep the pack in one place with version control. An auditor who can browse a year of reviews in ten minutes asks fewer follow-up questions.

Incident workflow: from alert to notification

Configuration checklist

• Time synchronisation (NTP) configured and verified on gateway, SIEM and servers.
• Personal administrator accounts with MFA and least privilege in Zenconsole.
• Local and cloud retention set deliberately, not left at the default.
• Streaming to SIEM or syslog configured and tested, with tamper protection.
• Scheduled reports sent to a shared mailbox with its own retention.
• Periodic reviews scheduled and recorded with date, name and findings.
• Alert rules tuned to your risks so important signals do not drown in noise.

Zenarmor supports these requirements; compliance comes from the combination of policy, process and demonstrable operation. Logging that covers your network segments also strengthens your network segmentation for NIS2 and ISO 27001.

How Secrotec helps

Secrotec is an independent ISO 27001 Lead Auditor and official Zenarmor partner in the Netherlands, listed on Zenarmor's partner page. We deliver Zenarmor licences and projects throughout Europe and configure Zenarmor to produce exactly the evidence an auditor or supervisor asks for.

• We draft your logging policy and retention periods with you, justified by risk and the GDPR.
• We configure reporting, alert rules, scheduled reports and streaming to your SIEM or syslog.
• We build the evidence pack, mapped to ISO 27001 Annex A and NIS2 Articles 21 and 23.
• With Zenconsole central management you monitor multiple sites from one audit trail.
• You receive a partner discount on licences; the price is always negotiable in Zenarmor projects.

Visit our Zenarmor partner page, read how ISO 27001 and NIS2 fit together, or go to the Firewall & Networks overview.