1. Overview
Organisational supply chains represent a significant and growing attack surface. Threat actors increasingly target suppliers and contractors as a route to compromise networks, data and services. A single compromised supplier can provide adversaries with privileged access to multiple organisations simultaneously.
This guidance sets out recommended minimum cyber security standards that organisations should require of their suppliers, and that suppliers should demonstrate in order to be eligible for contracts involving the processing, storage or transmission of sensitive data or connectivity to organisational networks.
2. Cyber Essentials Plus requirement
2.1 Recommended certification
All suppliers handling sensitive organisational data or connecting to organisational networks should hold a current Cyber Essentials Plus certification. SUVAT continues to encounter suppliers operating without valid certification.
- Certification should be current at point of contract award and maintained throughout the contract period.
- Organisations should verify certification status during procurement and at annual contract reviews.
- Where a supplier's certification lapses, the organisation should issue a remediation notice with a reasonable deadline for recertification.
2.2 Beyond Cyber Essentials
For contracts involving sensitive data, critical infrastructure or high-value targets, organisations should consider requiring suppliers to demonstrate compliance with additional standards:
- ISO 27001 certification with a scope covering the services delivered to the organisation.
- SOC 2 Type II reports for cloud service providers.
- Compliance with the NCSC Cloud Security Principles for cloud-hosted services.
- Sector-specific standards where applicable (e.g. PCI DSS for payment processing, NHS Data Security and Protection Toolkit for health data).
3. Supply chain risk assessment
3.1 Due diligence recommendations
Organisations should conduct a proportionate supply chain risk assessment before awarding contracts that involve access to sensitive data or systems. The assessment should consider:
- Data sensitivity. What type of data will the supplier handle? What volume of personal data is involved?
- Access requirements. Will the supplier require direct access to organisational networks, cloud environments or physical premises?
- Subcontracting. Will the supplier subcontract any element of the work? If so, to whom and in which jurisdictions?
- Geographic risk. Where will data be processed and stored? Are any elements of the supply chain located in jurisdictions of concern?
- Supplier maturity. What is the supplier's track record of managing cyber security? Have they experienced previous breaches?
3.2 Ongoing assurance
Risk assessment is not a one-time exercise. Organisations should:
- Include the right to audit supplier security arrangements in all contracts.
- Conduct periodic security reviews, the frequency of which should be proportionate to the risk level of the contract.
- Require suppliers to notify the organisation of material changes to their security posture, infrastructure or subcontracting arrangements.
4. Third-party access controls
Where suppliers require access to organisational networks, data or systems, the following controls are recommended:
| Control | Requirement |
|---|---|
| Identity management | All supplier personnel should have individual, named accounts. Shared or generic accounts are not recommended. |
| Multi-factor authentication | MFA should be enforced for all supplier access to organisational systems without exception. |
| Least privilege | Supplier access should be restricted to the minimum permissions necessary to fulfil the contracted services. |
| Access review | Supplier access rights should be reviewed quarterly and promptly revoked when individuals leave the supplier's employment or the contract ends. |
| Network segmentation | Supplier access should be mediated through dedicated network segments or jump servers. Direct access to production environments should be avoided where possible. |
| Session monitoring | All supplier sessions on organisational systems should be logged and subject to monitoring. Privileged sessions should be recorded. |
5. Incident notification requirements
Contracts should include explicit incident notification obligations requiring suppliers to:
- Notify the organisation of any confirmed or suspected cyber security incident affecting its data or services within 24 hours of detection.
- Provide a preliminary incident report within 72 hours, including the nature of the incident, data potentially affected, containment actions taken and initial assessment of impact.
- Cooperate fully with the organisation's incident response processes, including providing access to logs, systems and personnel as required for investigation.
- Provide a full root cause analysis within 30 days of incident closure.
6. Contractual obligations
6.1 Recommended clauses
SUVAT has developed a set of model contract clauses for cyber security requirements. These clauses cover:
- Minimum security standards and certification requirements.
- Data handling and classification obligations.
- Incident notification and cooperation requirements.
- Right to audit and security testing provisions.
- Subcontracting controls and flow-down requirements.
- Termination provisions for security non-compliance.
- Data return and secure disposal obligations at contract end.
6.2 Flow-down to subcontractors
Prime contractors should flow down all security requirements to their subcontractors. The prime contractor remains responsible for ensuring that all subcontractors meet the minimum standards set out in this guidance. Organisations should require visibility of the full supply chain and reserve the right to approve or reject subcontractors on security grounds.
7. Implementation timeline
Existing contracts should be reviewed at the next scheduled renewal or extension point to incorporate these recommendations. All new contracts issued after 1 September 2025 should include these minimum standards from the outset.