who in our company can view or modify the supply chain file

Roles and rights, not one account for everyone

Who can view or modify the supply chain file is determined by the organization itself: this is not a statutory role but a system setting. In practice, it works with roles: an administrator who may modify fields and link sources, and colleagues who may only read or supplement only a specific part — for example IT for questions about information security, and finance for revenue figures. This way, not everyone needs to have access to everything, and it remains clear who has entered or confirmed which answer.

That distinction is comparable to what Do the online services of the undertaking comply with accessibility requirements? and other technical components ask: not every employee has sufficient knowledge to assess an answer. The same logic applies to sensitive fields such as Does the undertaking use AI systems in its service delivery? — there you want the person confirming the answer to also understand what the question is asking. Who ultimately clicks "yes" or "no" on a questionnaire remains a choice of the organization itself; the system only records who did that and when.

Why role allocation is relevant at all

This division does not follow from any single specific statutory article, but from the nature of the underlying requirements themselves. The ten measures of Article 21(2) of the NIS2 Directive explicitly mention access control as a security measure, and Annex A of ISO/IEC 27001 elaborates on this with concrete controls for who may view or modify which data. A supply chain file containing answers to this type of questionnaire falls under the same logic: not because the law prescribes the platform, but because the questionnaires themselves often ask how access to business data is regulated. Role allocation in the file is therefore a practical reflection of what is already being asked in those requirements, not a separate obligation.