Who may access what: the core of access control
Access control answers one question: who has access to which system, and why precisely that person and not someone else. Within the NIS2 duty of care, this is one of the measures an organisation must be able to demonstrate, and in practice it is also the measure on which security questionnaires most frequently and most sharply focus. This is no accident: an attacker who has once gained entry will look for accounts with excessive rights, and access control is precisely the measure that limits this.
For an ICT service provider this comes back in three forms: remote management of its own and customer systems, direct access to systems of the customer, and the role of subcontractors who sometimes need access themselves. Each form raises a slightly different question, and a client sending the questionnaire wants an answer to all three.
Remote management: the first place a questionnaire lands
In remote management it is not only about whether a password is needed, but about who exactly may log in, with which account, and whether that can be traced back to one person. A shared management account used by the entire team is difficult for a regulator or a client to assess: if something goes wrong, it cannot be established who was inside at that moment. Multifactor authentication on management access is by now the minimum that is asked for, and many questionnaires also want to know whether sessions are logged and whether access automatically expires after a period of inactivity.
The underlying principle in the regulations is called the principle of least privilege: someone receives only the rights needed for their task, no more. For an installation company or an IT manager this sounds abstract, but in practice it comes down to a simple check: can a technician who only maintains printers also access the financial administration? If not, that is already an indication that access control is in order.
Access to customer systems: why this is asked about separately
When an ICT service provider logs directly into systems of a customer, an extra layer is created. The customer then not only wants to know how the service provider secures its own access, but also how it is prevented that an account of the service provider becomes an entry point into the rest of the customer network. Questionnaires therefore often ask separately about segmentation: is access limited to the system for which it is intended, or can a technician from that one account also reach other parts.
This is precisely why clients treat this subject as a priority over more general questions. An organisation with a duty of care must assess its suppliers, and access to its own systems is the most concrete risk it can identify. A supplier who here already has a clear answer — who may log in, with which right, and how is that reviewed periodically — saves itself a number of follow-up questions. set out for each subject what a measure precisely means provides a starting point for this.
Subcontractors: the same question, one link further down the chain
As soon as a subcontractor works on a task, the question does not shift away but one link further down the chain. A customer assessing access control of the service provider also wants to know whether that service provider in turn has a grip on the access of its own subcontractors. Is an account for a subcontractor created separately and withdrawn as soon as the task is complete, or does that access remain silently in place? The latter is one of the most common findings when access control is examined closely: accounts that were once needed, but have never been cleaned up.
A practical arrangement, then, is to tie access to the duration of the assignment, with a single named owner responsible for revoking it. Anyone who can point to a specific person — a name, not a job title in general terms — gives a questionnaire a more concrete answer than a policy description alone.
What this means for your own file
Access control is not a measure you set once and then leave; it is a register that must be maintained whenever roles, customers, or subcontractors change. For those who still need to determine whether this is relevant as a sector or supply-chain obligation, the check in a few questions gives an initial indication of where an organization stands. Those who already know that questionnaires will keep coming can use the most frequently asked questions about what exactly is being asked to further refine their own situation.
The core remains simple to remember, even without legal background: can you say at any moment who has access to which system, why, and since when? Anyone who has that answer ready is already well on the way for most questionnaires. Anyone who still needs to work this out can use the free quick-scan at secria.eu to get an initial picture of where to start.