What a client expects from ICT service delivery after NIS2
A client who is themselves subject to the NIS2 due care obligation must demonstrate that they also manage the risks in their supply chain. If you provide remote management, hosting, application management, or a helpdesk to such a client, that will be reflected in the contract: requirements about who has access to systems, how that access is logged, and whether you engage subcontractors without notifying them in advance.
The requirements themselves differ by client and by sector, but a number of topics come up almost every time: access control, logging of management actions, notification timeframes in the event of an incident on your side, and visibility into who else is involved in the work. That last point — subcontractors — is the subject where the questionnaire tends to dwell longest for many ICT service providers.
Why this now appears in the contract
The NIS2 Directive requires regulated entities, in Article 21, to also assess the security of their suppliers and service providers. A client who is themselves audit-liable cannot demonstrate this with a verbal assurance; they need a written agreement that they can show to their own supervisory authority. For you as an ICT service provider, that means: the same question comes back, only now documented in an addendum or appendix to the contract rather than in a separate email.
That is a change in form, not necessarily in substance. Much of what is being asked is probably something you as a manager were already doing. What is new is that you need to be able to prove it, with a date and a name attached.
Access to client systems: what is being asked exactly
Clients increasingly ask for an overview of who has access to their systems, with what rights, and how that access is revoked once someone leaves the team. Multi-factor authentication for management access is now a common requirement, as is a log that records when and by whom a system was accessed. Some contracts additionally ask for a fixed point of contact on your side, so that the client is not dependent on who happens to be on shift that week.
The underlying question from the client is always the same: if something goes wrong, can they trace who had access where and when. This is also why generic answers such as "we work according to best practices" are rarely sufficient — they are asking for concrete evidence, not an intention.
Remote management: extra attention to authentication and logging
Remote management receives a separate section in many questionnaires, precisely because an attacker who gains entry there can reach multiple clients in one step. Questions then concern encryption of the connection, whether access to remote management is separate from your company's regular network, and how quickly you can terminate a session if you suspect misuse. Here too, the point is not to judge how good your security is, but whether you can demonstrate it.
Those encountering this type of question for the first time often experience it as a one-time action for one client. In practice, the evidence you gather for one client can, with minor adjustments, be used for the next. read through the topics by situation provides a picture of which questions come up for which type of service delivery.
Subcontractors: the risk that you do not have under your control alone
The most challenging part for many ICT service providers is not their own security, but that of the parties they engage: a hosting provider, a monitoring service, a freelance specialist. A client who is themselves subject to the duty of care wants to know whether you use subcontractors, who they are, and whether they meet comparable requirements. Some contracts require you to notify changes in that supply chain in advance, or to pass on the same security requirements contractually to your own suppliers.
This is not always straightforward for a small ICT company to arrange, especially if the subcontractor themselves has no idea why that question is suddenly being asked. A first step is a simple overview: who does what for you, and what agreement have you put in place about it. Without that overview, every new questionnaire means having to research all over again.
What you can and cannot commit to
It is wise to include in a contract only commitments that you can also substantiate. A client asking about response times in the event of an incident, a 24/7 service, or a guarantee that nothing will ever go wrong, is in fact asking for a promise that few ICT service providers can deliver on without setting up a separate, expensive service for that purpose. It is up to you and, where necessary, a lawyer to assess which clauses are reasonable and which go beyond what the duty of care of your client actually requires.
Whether your own organisation is additionally directly subject to the NIS2 duty of care — as an essential or important entity, or through supply chain obligations — can be reviewed with a few questions. That distinction determines whether you only prepare answers for your customers, or also need to maintain a file yourself.
Getting started
For your client, ultimately what matters is not your intention, but whether the answer to his question is ready at the moment he asks for it. Once you have recorded a status, supporting evidence and an owner for each measure, you won't need to search again at the next questionnaire. Check what the dossier and questionnaires cost if you want to tackle that preparation structurally, or read first the frequently asked questions about how the platform works.
Start with no obligation using the free NIS2 check to see whether your organization is itself subject to obligations, supply chain-affected, or neither — and read further in the knowledge base about the topics that are relevant to your sector.