customer asks which suppliers have access to our systems

This question combines supply chain security and access control

The customer actually wants to know two things at once here: which suppliers have technical access to systems, and whether that access policy is under control. That is directly relevant. the access policy including the management of assets — that is where it specifies who is allowed to do what, and with what rights. A supplier who logs in remotely to a system, provides remote support, or processes data in their own application, falls under this answer.

It is not only about IT suppliers in the classical sense. An accounting firm with access to the financial system, a hosting party, a SaaS tool containing customer data: these are all external parties with access. Whether the question also covers the requirements that the company itself imposes on those suppliers — contractually, technically, in terms of audit rights — depends on the wording in the questionnaire. Often that is a separate question, which aligns with the security requirements that the company imposes on its own suppliers. Without a current overview of external access — a supplier list with the type of access per party — there is no source document to base this answer on, and then the answer cannot yet be filled in.

Where that appears in the ten measures

Access policy and supply chain security are two separate measures within the ten of Article 21(2) of the NIS2 Directive: supply chain security appears in point d, access control and asset management in point i. ISO/IEC 27001 splits this comparably in Annex A, with separate control measures for supplier relationships and for access control. Anyone receiving this question from the Cybersecurity Act, the Dutch transposition of NIS2, can expect that both approaches — who has access, and is that controlled — will come up separately in the list.