customer asks how we manage access of external suppliers

Access for external suppliers is part of Article 21(2)

This question is about how you manage access by third parties to your systems and data, and it touches on two of the ten measures in Article 21(2) of NIS2 at once: point (i), the access control policy, and point (d), supply chain security in relation to suppliers. So the customer wants to know not only whether external parties have access, but also how that access is limited, who grants and revokes it, and whether that process is documented. An answer like "suppliers get access only after approval" is too vague without explaining how that approval works and how often it is reviewed.

What you concretely need: a description of the authorisation process for external accounts, preferably including a reference to least privilege (access limited to what is necessary) and the timeframe in which access is reviewed or revoked at the end of the assignment. If that process is missing, then "no" is the honest answer here — a suggestive "yes" without an underlying document causes more damage in a sample check by the customer than a "no" with an explanation that the policy is under development. This topic overlaps with access control and management of business assets, where the broader authorisation structure is addressed, and with the question of whether the undertaking sets requirements for its own suppliers, because managing external access is often part of the same supply chain policy in practice.

Where this appears: Article 21(2), points (d) and (i)

Article 21(2) of Directive (EU) 2022/2555 lists under (i) "access control policy" as one of the ten mandatory measures, and under (d) the security of the supply chain including the relationship with suppliers — external access falls under both. In ISO/IEC 27001 Annex A, the corresponding control measures for access management and for supplier relationships are detailed at control level, which explains why a customer often asks for a specific Annex A control number instead of the directive text itself. For undertakings falling under the Dutch implementation, this obligation also appears in the Cybersecurity Act, which enters into force on 15 August 2026.