Multiple authentication, also known as two-factor authentication or MFA, is logging in with something you know (a password) and something you have (a code on your phone, a key, or an app). For installation companies that fall under NIS2 due diligence obligations or that receive a security questionnaire as a supplier, this is one of the most frequently asked questions: must it be everywhere, or only in certain places?
The short answer: due diligence requirements do not prescribe a specific technology, but call for measures that match the risk. For systems that are remotely accessible, such as email, your ERP system, the VPN connection, or the management panel of your planning and invoicing software, multiple authentication is generally considered a baseline measure. For access to a building, a key cabinet, or a system at a customer location, the situation is more nuanced, and this is where many installation companies face the practical question.
Where multiple authentication is usually expected
The reasoning is straightforward: the further a system is from your own office, and the more sensitive the data behind it, the heavier the protection that should match it. A technician logging into the company network from his phone, an office employee accessing administration from home, or a manager who can access planning remotely: these are all points where a password alone is vulnerable to phishing or reuse of leaked credentials. Multiple authentication ensures that a stolen password alone is not sufficient to gain access.
The same applies to accounts with elevated rights: the network administrator, the owner of the cloud environment, or the person who can approve invoices. These accounts are precisely the most valuable to an attacker, and it is often these accounts that are asked about first in a security questionnaire from a client. Those who want to know more about what is specifically included in that can find it on the page about the subjects worked out per sector.
Where it is more nuanced: systems at customer locations
Installation companies often work on-site: at a customer's home, in a business premises, or on a construction site. Situations arise that cannot be compared one-to-one with office work. A technician who needs to log into a customer's building management system often uses credentials managed by the customer themselves, not those of their own company. The question of who arranges multiple authentication there and who oversees it lies primarily with the owner of that system, not with the installation company that has temporary access to it.
Shared equipment in a company van, such as a tablet used by multiple technicians, is also a practical case where a strict MFA requirement can conflict with workability in the field. This does not mean that security lapses there, but rather that the implementation can be different: for example, a short session duration, a separate account per technician instead of a shared account, or access that automatically expires after work. Supervisors and clients look primarily at whether a deliberate choice has been made, not at whether exactly the same technical solution has been applied everywhere.
The distinction between physical keys and building access on the one hand, and digital access to systems on the other, is also something installation companies often ask about. Those who want to explore that subject more broadly can find an explanation of who can access what on the page about access control in the sector.
What this means for your conversation with a client
A security questionnaire often poses a simple yes/no question about MFA, while practice is more nuanced. It helps to be able to show per system where multi-factor authentication is in place, why that choice was made there, and how exceptions are handled. That is precisely where a living dossier adds value: not just a checkmark next to a measure, but evidence and an owner per system, so that the answer to the questionnaire is correct and substantiated.
Whether your company falls under the duty of care, is affected through the supply chain, or neither, can be seen with a few questions via the free check that maps out your situation. For those who want to know exactly how secria.eu obtains its information and which sources are used, that is explained on the page about how the platform works. And for concrete questions about what does and does not fall under the duty of care, there is an overview with answers to questions that installation companies often ask.
Multi-factor authentication is not an end in itself, but one of the building blocks in a dossier that shows that access to systems has been thoughtfully regulated. For your own company's situation, with its own systems and working methods on site, your own assessment remains necessary; the knowledge base and the quick scan help you to make that assessment with the right information.