Supplier cyber assurance before contract renewal

Before renewing a critical supplier, check whether the evidence covers the service you actually buy, then record who can accept the remaining risk. A completed questionnaire or a certificate can inform that decision, but neither explains every dependency, access route or exception in the contract.

This guide is for UK procurement and governance teams and for Irish suppliers responding to UK customer assurance requests. It proposes an operating method, not a legal assessment of UK or Irish obligations. Sector rules, personal-data arrangements and contractual commitments require their own applicability review.

The UK National Cyber Security Centre groups supply-chain security principles around understanding risks, establishing control, checking arrangements and continuous improvement. Its guidance is not designed for national-security high-assurance requirements. Use that limitation when deciding whether a more specialist assessment is needed. 1 2

Assess the specific service and access before sending a questionnaire. Record what each item of evidence actually establishes. Make exceptions explicit, assign an authorised decision-maker and revisit the assessment when the service changes.

Start with a one-page description of the supplier’s work. Name the contracting entity, service owner, locations involved, systems accessed, information handled and material subcontractors. Distinguish the organisation selling the service from the entity operating it. Ask the business owner what would stop if the service became unavailable tomorrow.

Use the answers to choose proportionate evidence. An office-goods supplier with no system access does not present the same exposure as a provider administering your identity platform. Spend is useful context, but low contract value does not imply low operational dependence. Record the reason for the review depth so the next reviewer can challenge it.

For each important assertion, capture the claim, document or demonstration supporting it, coverage, date, reviewer and unresolved question. If a supplier supplies a certificate, check the named entity, scope, validity and issuing information. Ask whether the purchased service and relevant locations sit within that scope. Do not describe this check as a full technical audit.

For a managed service, request a safe explanation of how access is authorised, reviewed and removed, how the supplier notifies you of an incident and which recovery responsibilities belong to each party. Where justified, ask a competent specialist to inspect a controlled demonstration or redacted record. Avoid collecting passwords, detailed vulnerabilities or customer information merely to fill an assurance folder.

Separate evidence observed from statements accepted on trust. A policy describes intended behaviour; a dated operational record may help show that the behaviour occurred. Neither should be stretched beyond its coverage. Keep confidentiality restrictions with the evidence and limit access to people making or reviewing the decision.

Use three working outcomes: proceed within approved conditions, proceed with a time-limited exception, or hold the renewal decision pending specified evidence. These are suggested internal categories, not regulator-prescribed ratings. Record the service owner’s recommendation and the authority that approves it.

An exception should identify the unmet condition, potential consequence, interim control, accountable owner, expiry date and evidence needed to remove it. Confirm that the person accepting the exposure has the necessary mandate. A procurement deadline is not, by itself, evidence that the risk is acceptable.

Check the contract with the appropriate commercial and legal advisers. The evidence review should inform relevant service, incident, subcontracting and exit provisions, but a generic checklist cannot establish suitable legal terms. Connect unresolved conditions to the action and escalation process described in our risk-register guide. Turn your risk register into owned actions and escalation

Assume a UK distributor plans to renew an Irish service provider that supports its customer portal. The invented scenario includes twelve supplier support accounts, an annual contract and a certificate covering the supplier’s corporate office. No actual company or review result is represented.

The procurement lead cannot tell whether the hosted portal service falls within the certificate’s scope. The technical owner also finds that the list of authorised support users has not been reconciled to the supplier’s current team. The useful next step is to request the scope clarification and a controlled account review, not to record the certificate as a universal pass.

If the business proposes a short extension while questions are resolved, it should document the actual interim conditions and obtain authorised acceptance. This example does not recommend any extension length or establish that continuation is safe. The decision depends on the exposure, contract and competent assessment.

Fictional continuation of the portal example. The supplier's access list contains twelve support identities. Ten match the current support roster. Two are absent from that roster, and the provider has not explained whether they are former staff, emergency identities or service accounts.

The unexplained identities are 2 ÷ 12 = 16.7% of the listed identities, rounded to one decimal place. That proportion is an exception count, not a supplier security score. One unexplained privileged identity could matter more than several low-access mismatches.

The technical owner establishes each identity's purpose, effective access and continuing need, then uses the controlled access process for any change. Do not delete an unknown service identity blindly or treat the supplier's assurance email as proof of removal. Record the evidence actually obtained.

The final renewal decision must separately address the scope gap and the access findings. Resolving one does not clear the other. These are invented records and proposed verification steps, not a review QSE Advisory performed on a real provider.

Keep a small trigger list with the contract: a new subcontractor, hosting move, expanded access, changed service purpose, significant incident or expired assurance evidence. Ask the service owner to route those changes for review rather than waiting until the next annual questionnaire.

At renewal closeout, retain the decision and its supporting evidence references. Record the limitations clearly enough that a colleague can understand why the decision was made without reconstructing a long email chain.

Does a valid certificate automatically approve a supplier? No. Establish what it covers and assess the actual service, dependencies and contractual conditions. This is a procurement decision supported by evidence.

Should every supplier receive the same long questionnaire? A common baseline can help, but additional questions should reflect access, information and business impact. Explain why each material evidence request is needed.

Does an Irish supplier become subject to every UK rule because it has a UK customer? That cannot be inferred from the customer relationship alone. Identify the activity, jurisdiction and contractual requirement before making a legal claim.

1 NCSC supply chain security guidance — Version 1.0; page reviewed 22 October 2025; guidance, not a general statutory duty.

2 NCSC 12 principles of supply chain security — Version 1.0; page published and reviewed 12 October 2023.

Explore the Governance & ISO topic page for related guidance.

Prepared with AI-assisted research and drafting. The implementation method and hypothetical example are editorial guidance, not reported client results. QSE Advisory is part of the QSE Advisory brand family.

General information and suggested management controls. Obtain competent technical and jurisdiction-specific review before consequential use.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.