Preparing to answer a customer's security questionnaire

Last updated: October 20, 2026

If a customer has sent you a questionnaire about how you secure remote access to the machines you service, this page explains what it's usually asking and how to prepare an honest answer. It does not name or recommend any specific product.

Why your customer is asking

If your customer is in scope for NIS2, it has its own obligation to assess the security practices of its direct suppliers and service providers, including a machine builder or integrator with remote access into its systems. Source: Directive (EU) 2022/2555, Art. 21(2)(d), checked 19 October 2026 That obligation is your customer's, not yours directly, unless you are separately in scope yourself. See NIS2 supply chain and remote access, explained for the fuller picture.

What it typically covers

Questionnaires vary, but most cover some version of the following topics:

• Access control. Who can connect remotely, how that access is requested and approved, and whether accounts are named to a specific person or shared between people.
• Authentication. Whether remote access requires more than a single password, such as multi-factor authentication.
• Session logging. Whether remote sessions are recorded or logged, and for how long those records are kept.
• Scope of access. Whether a connection reaches just the one machine being serviced, or more of the customer's network.
• Incident reporting. What happens, and who is told, if something goes wrong during or because of a remote session.
• Subcontractors. Whether anyone other than your own staff (a dealer, a subcontracted technician) also connects remotely, and under what arrangement.

How to prepare an honest answer

Describe what you actually do today, not what you think the customer wants to hear. If a practice isn't in place yet, say so plainly rather than guessing at an answer, and note it as something you're working on if that's true. A customer's questionnaire is asking what your practice is, not testing you against a specific product or checklist, and there is no single required answer that applies to every machine builder.

Gathering the answer usually means talking to whoever actually manages your remote access today (an internal engineer, or whoever set up the connection method you use) and writing down, in plain terms, who can connect, how, and what they can reach. The remote access situation check walks through the same topics, with no score and no verdict, if that's a faster way to get it written down.

Get the full pack

A downloadable spreadsheet with about 30 questions across these topics, why a customer typically asks each one, and the kind of evidence to prepare, with a blank column for your own answer and no suggested “compliant” answers. Get the questionnaire pack.

Related guides

NIS2 supply chain and remote access, explained and IEC 62443 and remote access for machine builders.

This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.