A supplier policy for the installation industry is an overview of the parties you work with — subcontractors, freelancers, software suppliers for your scheduling or building management systems — with an assessment of the risk each party brings. For installation companies, the focus often extends beyond digital access to physical access: who receives a key, an access card or login credentials to your client's management system.
This makes the installation industry a special case. While a software company mainly considers who can access the source code, an installation company considers who enters the client's building, which cabling is being worked on and which data about that building — floor plans, alarm codes, access logs — is being shared with a subcontractor. A supplier policy brings these two worlds, physical and digital, together in one overview.
Why this is relevant even without your own compliance obligation
Installation companies usually do not themselves fall under the due diligence obligations of the Cybersecurity Act. However, the principal who is obligated — a hospital, an energy company, a municipality — must assess his own supply chain, which means he also looks at who you engage. A subcontractor with an unmanaged laptop logging into a hospital's building management system is a risk to that principal, even if the contract is formally with you. A supplier policy shows that you understand and manage that chain of responsibility, rather than failing to answer once the question arises. For more on what exactly that principal may ask, read the overview of topics by sector.
What should concretely be included in the policy
A workable supplier policy begins with a list: who works for you, with what access, and how stable is that relationship. For installation companies, these are typically three categories. Subcontractors and freelancers who work on-site and gain physical access to buildings, key storage areas or server rooms. Software suppliers of scheduling, billing or building management systems who monitor or collaborate remotely. And suppliers of materials or equipment who sometimes require their own login, for example for remote warranty registration.
For each party, the question is what reasonable oversight looks like: a statement that passwords are not shared between employees, an agreement about what happens to access codes after a job is completed, or simply a contact person you can reach if something goes wrong. Not every supplier requires the same level of detail — a screw supplier asks for something different than a subcontractor who logs into a hospital's system using your account.
Subcontractors and access: the point where things often go wrong
The installation industry works frequently with rotating subcontractors, sometimes for a single job, sometimes on an ongoing basis. This makes access management more difficult than in a company with a permanent team. A practical starting point is a simple question for each subcontractor: does this person get their own access card or key, or is a shared code used? Is that access revoked once the job is finished, or does it remain active until someone remembers to block it? And who within your own company is responsible for that revocation?
These questions seem organisational rather than technical, but they are precisely what a supplier policy addresses: not firewalls, but who gets in where and why. For the broader measures around access within your own company, there is separate guidance; this article focuses specifically on the external parties you engage.
How to start without turning it into a year-long project
A supplier policy does not need to be complete all at once. A workable sequence is: start with the parties that have access to the most sensitive environments — building management systems at clients in the vital sectors, or software that monitors remotely. For each party, establish what you know, what you still need to ask and who will handle that. Then expand that overview to the rest of the supply chain.
Whether and to what extent this is relevant for your business depends on the sectors in which your customers are active and on the nature of your own service provision. A brief check shows where your business stands in the supply chain, and the knowledge base on secria.eu shows for each topic which reference point in the official text applies to it. How we maintain those sources is explained at the page about our methodology.
What this article does not replace
A supplier policy is an organisational document, not legal advice on your specific contracts or liability towards subcontractors. For questions on this matter, a lawyer or the industry association is the appropriate contact. Frequently asked questions about the scope of the law and the role of suppliers are compiled at the frequently asked questions page.
Do you want to know where your own business stands, and which suppliers in your chain deserve attention first? The quick scan is free and gives a first indication in a few minutes, without requiring an account.