How do I give a new employee access to the file

Access management controls who can read, complete, and submit

You grant access through the access management of the chain file, not by sharing a password. Each user receives their own account with their own role: read, complete, or also submit to your customer's portal. This way, it always remains visible who has confirmed which answer — this is especially relevant for questionnaires where multiple colleagues are involved, for example one person for the number of employees and someone else for the questions on information security.

You add a new colleague with their name and work email address. You choose a role that suits their task: someone who only needs to provide the answer on liability insurance does not need rights to submit lists. Limit access to what is necessary — this is not a choice we prescribe, but it does align with the ten measures of Article 21(2) of the NIS2 Directive, in which access management is named as a separate measure. Do you want a colleague to be unable to see certain answers, for example because they are commercially sensitive? Then use the confidentiality button on that answer; you determine what you shield with it yourself.

Why access management is a recurring control point

Access management is explicitly listed in the ten measures of Article 21(2) of the NIS2 Directive, and also appears in the control measures of Annex A to ISO/IEC 27001, under the category access control. Customers who send questionnaires on the basis of these standards therefore often want to know whether you can demonstrate changes in user rights — not just whether you have a password policy. Therefore, keep track of when a colleague is added or removed; that overview is exactly what such a question answers.