If your company works in ICT service provision — managing servers and networks, running a helpdesk with remote access, or maintaining software at customer sites — the security questionnaire you receive is often more extensive than those sent to other suppliers. This is not because your customer distrusts you, but because your service by definition grants access to systems that are not yours. An organization with compliance obligations that assesses its supply chain looks more closely at an ICT service provider than at a supplier of office furniture.
The questions that recur in this sector typically fall into three groups: how you manage systems remotely, how you control access to customer systems, and how you handle subcontractors. Below, for each group, is what is usually asked and why.
Why ICT service providers form a separate category
Under the NIS2 Directive, an organization with compliance obligations must also assess risks that enter through its suppliers. An accounting firm that only processes invoices poses a different risk than a party that can log into the company server at night to run an update. Supervisory authorities and the Directive itself explicitly name this dependency on ICT services as a point of concern within the supply chain. For you, this means the questionnaire often does not focus on your office, but on the path your staff and systems take to reach the customer's network.
Questions about remote management
If you manage customer systems remotely, using remote monitoring and management (RMM) tools or via a VPN connection, the questionnaire typically asks about the security of that connection itself. Typical topics are: whether remote access requires multi-factor authentication only, whether sessions are logged and how long those logs are kept, whether there is a fixed time window during which maintenance takes place, and what happens if a technician's laptop is stolen or lost. The question also regularly comes up whether the RMM software itself is kept up to date — a vulnerability in that management tool affects all customers managed with it at once, making it a sensitive point for those who depend on it.
Questions about access to customer systems
The second group of questions concerns who exactly has access to which systems. Think of: do you work on the principle that someone only gets access to what is needed for the task (least privilege), is access immediately revoked when an employee leaves or changes roles, and are passwords and access keys kept separate per customer or shared across assignments. Some questionnaires also ask for an overview of who has had access during a given period — something that can only be answered if that overview is already being maintained. Those who do not have this kind of information at hand often fail not because security is lacking, but simply because the answer cannot be provided quickly enough.
Questions about subcontractors and your own supply chain
The third group of questions is often overlooked until it comes up: do you yourself engage subcontractors for parts of the service, such as an external party for helpdesk support outside business hours or for specialized network management? A customer who needs to map out their own supply chain wants to know whether that chain ends with you or continues further. Questions about this usually concern whether subcontractors are subject to the same security requirements you apply, and whether the customer is informed in advance if a new subcontractor is brought in. This is also the point at which the questionnaire can overshoot into information that is not reasonably necessary to assess the risk; where that boundary lies is not the same in every situation and deserves its own consideration.
What this means for the answer you give
The questions above are not a loose checklist but a recurring pattern, and that pattern changes little from one customer to another within this sector. This makes it worthwhile to know beforehand where you stand — which of these subjects are already assigned to an owner and supported by evidence, and which are still unresolved. in a few questions see whether and how you are affected provides a first direction there, and the detailed subjects per situation goes deeper into specific measures such as access control and supplier assessment. If you are unsure whether a question asked still falls within reasonable limits, that is something to discuss with the customer themselves or, if the matter remains unclear, with a lawyer; the most frequently asked questions on this subject provides a number of starting points.
If you want to see without obligation where your company stands in relation to this type of questionnaire, take the free quick-scan or browse through the knowledge base on secria.eu — both are accessible without an account.