A one-person contracting business is almost never directly bound by NIS2. The German BSI Act covers medium-sized and larger organisations with 50 or more employees, or those with more than EUR 10 million in turnover and balance sheet, along with specific entity types regardless of size. However, the client is bound. According to §30(2) No. 4 BSIG, the client must manage the security of the supply chain, including security-related aspects of relationships with direct suppliers. A contractor with admin access to firewalls is exactly the supplier this clause addresses. NIS2 reaches the freelancer through the contract, the agency chain, and security questionnaires, not through a direct BSI mandate.
I work as an independent firewall and network-security contractor inside German enterprises usually through an agency, which is exactly where these annexes arrive. This is a field guide from that side of the table, not legal advice.
Why the clause lands on you anyway
The client's management carries the legal duty to secure the supply chain, and the easiest way to show an auditor that it did is a signed annex from every supplier with system access. Because most contractors work via an agency chain, the agency typically copies the client's security annex into your contract without changes. In the supplier classification used by advisors like SECJUR, a firewall administrator is Tier A. This tier includes suppliers with direct access to IT systems or confidential data. Tier A suppliers get the deepest risk assessment, and in that model a review every year.
While the client handles its own compliance, such as NIS2 registration with the BSI, they shift the operational burden of proof onto the contractor. If you have production access, you are a critical supplier by default.
One practical step before you sign: ask the agency for the client's original annex, not the agency's summary of it. Agencies sometimes tighten the wording on the way through, and the version you sign is the one that binds you.
The five clauses you will see
- Security standard reference: Requirements to follow recognised standards like ISO 27001 or BSI IT-Grundschutz. For a freelancer, this means documenting that your working method aligns with these controls.
- Staff reliability check: Clauses regarding the qualification and reliability of the supplier's staff. As a sole trader, this means your own CV, certificates and often a Führungszeugnis (certificate of good conduct).
- Audit right and evidence: The right for the client to verify security via questionnaires, third-party reports, or on-site audits.
- 24-hour incident notification: A requirement to report security incidents within 24 hours. This is a tight window that requires a predefined reporting path. On your side, an incident is a lost or stolen laptop, a phished account, malware on a machine you use for the client, or client credentials exposed anywhere. Write that list into your own notes so you do not have to decide at 2 a.m. whether the clock is running.
- Subcontractor flow-down: A demand that all security requirements be passed down to any subcontractors. This is usually a formality for freelancers who work alone.
What to sign, what to push back on
| Clause | Sign as is | Push back when |
|---|---|---|
| 24-hour notification | Clock starts when you become aware of the event. | Requirement to report "any suspected event" without a clear definition. |
| Audit right | Scope is limited to the engagement and requires prior notice. | Audits of your entire business or unlimited frequency. |
| ISO 27001 reference | Requirement is "aligned with" or "follows the principles of". | Certification is a hard requirement; offer a self-declaration instead. |
| Flow-down | You have no subcontractors and state this in writing. | Requirement to manage a complex chain of third parties you do not employ. |
| Liability | Liability is capped at a level covered by your professional insurance. | Requirement to indemnify the client for its own NIS2 regulatory fines. |
Shrink your scope before you answer the questionnaire
The most efficient way to reduce risk is to avoid holding it. Before answering a security questionnaire, request a client-issued laptop or a client VDI. Work from client accounts with MFA. If client data and administrative tools never sit on your own hardware, you can answer most questionnaire points by stating the risk is handled by the client's own controls.
Keep a one-page security self-declaration ready
Avoid writing a new document for every agency. Maintain a single page that lists your baseline controls:
- MFA enabled on every account.
- Full-disk encryption on all devices.
- Supported and patched operating systems.
- Use of a password manager.
- Strict separation of devices or VDI per client.
- Defined incident reporting process (who you notify and how).
- Confirmation that no subcontractors are used.
Answer once, then attach the same page to every client and agency questionnaire. It turns a two-hour form into a ten-minute cross-reference.
Ask for named admin accounts
The clause that protects you most is one you may have to ask for: a personal, named admin account on every firewall and management system, with MFA, and no shared admin logins. Under a supply-chain annex, every change you make can end up in an incident review. A named account with a change ticket behind each commit is your evidence that you did what was approved and nothing else. A login shared with three other engineers is evidence of nothing.
The paperwork is billable time
Completing detailed security questionnaires and participating in reviews takes several hours of work. Agree upfront whether this administrative effort is billable. A contractor who absorbs these costs silently sets a precedent that increases the burden on all other freelancers in the chain.
NIS2 did not make freelancers regulated entities. It made them the part of the client's supply chain that is easiest to put in writing. Read the annex, push back where it overreaches, and keep the evidence that you did your part.
Related field notes: