NIS2 and field work.

What is NIS2?

How it touches on-site IT work

• Suppliers are part of the customer's risk: a covered customer must address cybersecurity risk in its supply chain, which includes the firms that send engineers to its sites. Expect security clauses in contracts, supplier questionnaires and questions about subcontractors.
• Physical and logical access: covered customers are expected to control access to the rooms and equipment that hold their systems, including access by external suppliers. For field work this usually means named engineers, ID checks at the door, escorts where needed, time-limited access and a record of who entered which room.
• Asset handling: customers must manage their assets, so installs, moves, swaps and removals need accurate records, labels and a log of what left the site.
• Incident reporting: the customer's 24-hour and 72-hour clocks start when it becomes aware of a significant incident. A provider that notices tampered equipment, an unknown device in a rack, lost media or an unexplained outage needs to tell the customer quickly through an agreed route.
• Personnel: customers may ask how a provider screens, trains and assigns the people who attend their sites.
• Records: change records, work notes and photos that show what was done give the customer evidence for its own audits and incident reviews.

What you can agree in a written scope

• Security clauses that match the customer's supplier security policy, written into the contract or the scope.
• Named personnel or a named pool of engineers, with the customer's right to approve or refuse an individual.
• A rule on subcontractors: approval before use, and the same security terms passed down.
• Physical access rules: ID checks, escorts, time windows, badge handling and what happens at the end of a visit.
• An incident notification route and a target time that fits inside the customer's own 24-hour and 72-hour obligations.
• Evidence the provider will supply after each visit, such as work notes, asset records and photos, and how long they are kept.
• The customer's right to ask reasonable security questions and to review the answers.
• Return or secure disposal of customer assets, media and data when the work or the engagement ends.

Questions to ask any field services provider

• Do you consider yourself in scope of NIS2 in any country where you operate, and in which category?
• How do you screen and brief the people you send to our sites?
• Which parts of the work are done by subcontractors or independent engineers, and how are they bound by our terms?
• How and how fast will you tell us if you spot a security event on site?
• How do you control and record physical access to our rooms and equipment?
• What evidence do you give us after each visit, and how long do you keep it?
• Can you answer our supplier security questionnaire?

This page is general information and not legal advice. Deploris does not claim certification or compliance status here. Confirm what applies to you with your own counsel or compliance team.