Access control means you can demonstrate who is permitted to access which systems, spaces, or data, and that access is revoked as soon as someone no longer needs it. For an installation company, this extends far beyond a password policy in the office: it also covers keys to customer premises, badges for technical rooms, and remote access to building management systems that your technicians maintain.
The reason this topic keeps coming up in security questionnaires is straightforward: a technician who can log into a heating control system without a password, or a former employee who can still enter a server room with an old key, is exactly the kind of risk a client's duty of care must watch for. Whoever answers this question with a shrug loses a contract faster than someone who can give a short, honest answer.
Two types of access, one register
At an installation company, two worlds overlap. On one side is access to your own systems: accounts, scheduling software, email. On the other side is physical and digital access at the customer: keys, alarm codes, VPN connections to a building management system, login accounts for a remotely managed climate control system.
Both fall under the same question: who is permitted access, and why. A living register listing who has access to each system or set of keys, since when, and who approved it, is usually sufficient for most installation companies to answer this question. It does not need to be a complex system; an accurate overview you can present carries more weight than an elaborate policy nobody follows.
Keys and badges: the forgotten part of access control
Many installation companies think of access control only in terms of login credentials and overlook the physical side. Sets of keys to customer locations, badges for technical rooms, and alarm system codes are just as much access as a password, and deserve the same discipline: document who has which key, when it was issued, and establish a regular schedule for requesting its return or revoking access.
This often only becomes visible when something goes wrong: a technician who leaves the company but still has a set of keys for three customers in the car, or a subcontractor who can still log into an administrator account after a project ends. When a customer asks you this question through a security questionnaire, they mainly want to know whether you systematically prevent this kind of situation, not whether it has ever happened.
Remote access to systems at the customer site
Installation companies that remotely observe or intervene in systems at customer premises—for example, for fault diagnosis on a climate control installation or an energy management system—often need their own access path: a VPN, a remote desktop connection, or a vendor-specific platform. That access path is exactly the kind of connection a client with a duty of care asks about, because a weak point at your end can directly translate into a risk at theirs.
Questions that often come up here concern multi-factor authentication on that remote access, who manages the accounts, and what happens if a laptop with that access is stolen. You do not need to have an elaborate technical answer to every question; you do need to know who in your organization grants and revokes this kind of access, and have that documented somewhere.
Where this fits in the bigger picture
Access control is one of the measures that falls under the duty of care, and that duty of care typically does not apply to installation companies themselves because they fall under the law, but because a client that does fall under it asks them about it. Anyone who is not yet sure whether this applies to their own situation can find out in just a few questions. For those who have already received the question and want to know how access control relates to the other nine measures, there is a complete overview detailed by topic.
It is not for a platform provider such as secria.eu to determine what is sufficient in your specific case; that remains an assessment that lies with you or, in case of doubt, with a lawyer or the competent supervisory authority. What can be done is: maintain an honest and current overview of who has access to what, so that a security questionnaire is no longer a surprise but a form you can fill in within a few minutes. More on how such an overview is built in practice is described on the page that shows where the information in your file comes from.
Would you like to first see whether this topic is relevant for your organisation, and what a file would contain for it? Do the free quick-scan or browse through the topics; both can be consulted without an account and provide a direct, concrete answer.