What changes in your contract with your principal
A principal who is themselves subject to the NIS2 duty of care — a hospital, an energy company, a large logistics hub — must demonstrably show that risks in their own supply chain are understood. Installation companies often sit right in the middle of that chain, not because they are themselves subject to the obligation, but because they have physical and digital access to the principal's building and systems. That is precisely why the contractual requirements you will encounter in the coming period focus on access: who may enter, by what means, and what can that person achieve from there.
The core is simple to understand without reading the legal text itself: a principal may ask you how you prevent a key, a badge or a maintenance connection from becoming an entry point for someone else. The precise wording differs per principal, but the underlying question is essentially the same for almost everyone.
What a subject principal exactly asks
The NIS2 Directive requires essential and important entities to assess risks with suppliers — that is the core of the duty of care in Article 21. That obligation is translated in practice into three types of requirements that come back at installation companies: requirements for persons (who may come to the site on your behalf), requirements for means (how are keys, badges and work orders managed) and requirements for connections (how is remote access to building systems logged in). None of these requirements appear literally as such in the Directive; they are practical implementations that principals themselves choose to comply with their own duty of care.
If you are not sure whether your principal is themselves subject to this obligation, this can be checked via a brief check showing which parties in the supply chain are affected. That helps to better frame the conversation with the client: is this an obligation coming from them, or a deliberate choice by their procurement department.
Access to buildings: keys, badges and building management systems
With physical access, three questions often recur in contracts: is a key or badge registry maintained per employee, is that access revoked as soon as someone leaves the project or the company, and is there a fixed procedure for registering subcontractors who come on site on your behalf. For installation companies working with varying technicians and subcontractors, this is often the area where most adjustment is needed — not because it is technically complicated, but because it simply has not been documented yet.
Building management systems — the systems that control heating, lighting, lifts or access control — form a separate category. A client often wants to know whether the password of such a system has been changed after handover, who manages the login credentials, and whether an old password from a previous project has been reused. That is not excessive caution: building management systems are precisely the type of system where a failure does not remain in an IT department, but becomes visible in the building itself.
Access to systems: remote management and maintenance connections
Where installation companies monitor remotely or perform maintenance — via a VPN connection, a teamviewer-like tool or a fixed IP address that is granted access — the client typically wants to know how that connection is secured, whether it is closed after use, and who within your company has internal access to that connection. This directly concerns access control within your own organization: a connection that can be used by anyone in the team without logging or time limits is precisely the kind of answer where a security questionnaire gets stuck.
The topics involved — from password policy to access revocation when staff leave — are clearly described in the overview of topics per situation, so you don't have to search through the entire directive for the section that applies to you.
What you can prepare now
Even without a concrete contract in place, it is useful to know which keys, badges and connections are currently active in ongoing projects, and whether that inventory is up to date. This is not legal work but administrative work, and it is precisely the type of evidence that a client may ask for later. If you are uncertain whether a specific requirement in a draft contract is reasonable or goes beyond what the duty of care justifies, that is a question for a lawyer or, if you have doubts about the client's own obligation, for the supervisory authority — secria.eu prepares the underlying documentation, but does not assess individual contracts.
Would you like to see how secria.eu supports this type of question, from the first check to the templates for a questionnaire? On the page that explains where the information comes from , the structure of the platform is laid out step by step, and the most frequently asked questions about role and obligation provides answers to similar concerns raised by other installation companies.
If you are curious whether your own situation falls within the supply chain and what that concretely means for the contracts you sign, the free NIS2 check is a logical first stop, as is the knowledge base that is accessible without an account.