Access control means you define who may access which systems, with which account, and that access is revoked as soon as someone changes role or leaves. In the metal and manufacturing industry, this concerns not only laptops and email, but also machines, PLCs and production lines now connected to the same network as office IT. It is precisely this interface between IT and production where security questionnaires often dig deeper.
The question appears in almost every questionnaire because access control is one of the ten measures that the care obligations under the NIS2 Directive (Article 21) expect from obligated entities, and those obligated entities pass this requirement on to their suppliers through contracts. A machine manufacturer or supplier who is not themselves subject to NIS2 receives the question anyway, because a customer must be able to answer it.
The difference between office and production floor
In the office, access control is usually implemented: one account per employee, a password, perhaps already a second step at login. On the production floor, it is often different. Machines sometimes run for years with one shared account, a technical password that everyone knows, or a supplier setting that has never been changed. This is not unwillingness, it has grown out of the practice of maintenance and troubleshooting. Supervisors and customers do not look at the history, but at the current situation: is there an overview of who can access what, and is that overview current.
Who has access, and to what exactly
A useful overview answers three questions for each system: who has an account, what may that person do with it, and is that still necessary. For production systems, this means distinguishing between viewing (reading status), operating (starting or stopping a line) and programming (modifying settings or control software). Not everyone who operates a machine needs to be able to change the settings, and not everyone who once had access for a project still needs that access.
External engineers and remote suppliers
Many production systems are maintained remotely by the machine supplier. This is functional, but it is also an access path that should be documented: who from the supplier can log in, via which connection, and is that connection open only during maintenance or permanently. Customers often ask explicitly about this, because an open connection to a third party is one of the known ways an incident at one organization can cascade to another. Assessing those suppliers is, by the way, a separate step in the care obligations, apart from access control itself.
Passwords and shared accounts
Shared accounts are practical, but they make it impossible to see afterwards who did what. Where possible, one account per person is the starting point that questionnaires assume. Where this is technically impossible on older machines, the answer is often that there are other measures in place, such as a limited number of people with physical access to the control panel. A questionnaire rarely asks for perfection, but for a well-reasoned answer.
What you document, not just what you arrange
The difference between "it is arranged" and "it is demonstrable" lies in documentation: a current list of accounts and rights, a date when that list was reviewed, and a name responsible for maintaining it. That is precisely where a living dossier proves its value, because it shows per measure a status, evidence and an owner instead of a loose Word document that nobody updates anymore.
Where this fits in the bigger picture
Access control rarely stands alone in a questionnaire. It is usually combined with questions about backups, multi-factor authentication and what happens if an incident occurs. Organizations that do not yet know whether they will be affected by NIS2 through a customer typically start with the sector and role in the supply chain, not with individual measures.
With a few questions that show where your company stands you get an initial indication, and in the knowledge base by topic you will find the other measures that appear in the same questionnaires. How we maintain sources such as the directive and national legislation can be read at the page about our methodology. If you are uncertain which question applies to your situation, also check frequently asked questions.
The NIS2 check and knowledge base are free to consult, without an account. If you want to go further, for example to maintain an overview per measure with status and owner, that is part of the file behind a business subscription.