A security questionnaire for an installation company almost always revolves around one core question: who has access to the client's building and systems, and how is that access managed. Installation companies work on-site, often have keys or badges, and connect equipment to building management systems, climate control systems or alarm systems that are sometimes also managed remotely. It is precisely there that the questions that recur again and again in this sector arise.
The questionnaire usually does not come because the installation company itself falls under the NIS2 Directive, but because the client does. That client — a hospital, an energy company, a water board, a large property manager — has a duty of care that obliges them to assess their suppliers. An installation company that has access to buildings or systems of such an organization is therefore affected through the supply chain, even without itself falling into the target group of the law.
Why this sector more often receives a questionnaire
Installation companies often maintain precisely the infrastructure that is critical for a client: heating, ventilation, electricity, fire detection systems, access control. These systems are increasingly networked, and sometimes the installation company is the only party that can log in remotely to fix faults. For the client, this is a reason to want to know how that access is protected. Whether a specific company falls under the law or is only affected through the supply chain is something that a few questions.
Access to the building: what is being asked
On the physical side, it is usually about how keys, badges and alarm codes are issued and withdrawn. Questions that come back: which staff members within the company have access to customer locations, how quickly a badge is blocked if a technician leaves the company, and whether there is an overview of who has access to what and where. It is also regularly asked whether subcontractors independently gain access or always work under supervision.
Access to systems on site: what is being asked
On the digital side, the questions focus on how equipment and connections on site are secured. Conceivable questions are whether staff log in with a personal account or a shared password, whether multi-factor authentication is used when managing a building management system remotely, and how access is revoked when a project is completed or an employee leaves. Company equipment that is connected on site — a technician's laptop or tablet — is also a regular subject of inquiry: is that equipment managed by the company, and is security software installed on it.
Subcontractors and temporary staff
Installation work is often partly carried out by subcontractors or hired personnel. Clients therefore sometimes ask further questions about how the installation company itself manages its own supply chain: does a subcontractor receive the same access means as their own staff, and is there visibility into who was actually on site on a given day. This aligns with the broader principle that a duty of care looks not only at the direct supplier, but also at the parties that the supplier engages.
What you can do with these questions
The questions themselves are often not complicated, but the answer requires something that has been documented: an overview of who has access, how that access is revoked, and who is responsible for it. Companies that do not yet have this in writing notice that most time goes into documenting what already happens in practice. An overview of the topics that appear in these types of questionnaires, worked out per situation, can be found on the page with topics by sector. Anyone who wants to know how the information on secria.eu is developed and which sources are used in the process will find that on the page on our methodology.
It is important to understand that a security questionnaire is not a legal obligation in itself, but an instrument that a client uses to fulfill their own duty of care. What a client may precisely ask and what they may not ask varies per situation and per contract; for the specific situation, this is something to discuss with the client or, where necessary, a legal advisor. Frequently asked questions about these types of questionnaires, including how often a company can expect them, are compiled on the frequently asked questions page.
Anyone who wants to see which measures regarding access control and physical security are frequently requested and how they relate to their own business operations can view this free of charge and without an account via the NIS2 check and the knowledge base of secria.eu.