they ask who has access to their data

Access policy, not a list of names

The customer usually does not want to know which individual person logs in, but whether there is a system that controls who has access to what. That falls under access control: who has access to which systems and data, based on which role, and how is that granted and revoked. The answer thus consists of two parts: the policy (how access is granted, reviewed, revoked upon termination) and the practice (whether role-based rights are used, least privilege, periodic review of who still has access).

If there is no separate access policy document but the practice is in order — for example roles in a system, a fixed process for hiring and termination — that is often sufficient to answer with "yes", provided that is also genuinely demonstrable. If both are missing, then "no" is the honest answer; a question about this is not presented as "yes" without a source in the chain file. Related questions on the same list often concern multi-factor authentication for business systems and about the policy for risk analysis and information systems security — those two belong together substantively, because access is usually one of the control measures that follow from the risk analysis.

Traceable to article 21(2) and Annex A

Access control is one of the ten measures under Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555): it explicitly names policy for access control and the management of business assets as a mandatory part of risk management. In ISO/IEC 27001 this is reflected in the control measures of Annex A, under the access control category. Customers who will themselves fall under the Cybersecurity Act — the Dutch transposition of NIS2, which enters into force on 15 August 2026 — therefore increasingly present this question as standard to their suppliers, even if they themselves have not yet been designated as an entity under the directive.