Read with the right scope
Practical supplier-risk guidance. NCSC's detailed supply-chain assessment guidance is aimed principally at medium and large organisations. Contracts, sector rules and data-protection duties require separate applicability checks.
Status: Practical guidance · official sources checked 1 November 2026
Start with the dependency
A supplier assessment should explain what depends on the supplier and what could happen if it fails. Include access to systems, information handled, service interruption, concentration and the effort needed to switch. An office stationery supplier and a sole provider of case-management software usually call for different scrutiny.
NCSC's supply-chain principles organise the work around understanding risk, establishing control, checking arrangements and improvement. Its more detailed assessment guidance is aimed at medium and large organisations. Smaller businesses can adapt the questions proportionately rather than adopting an unnecessarily elaborate process.
Ask for evidence that answers a decision
Document the service, business owner, access permissions and critical dependencies. Decide which risks could make the relationship unacceptable and what approval is required. Request evidence that addresses those risks. A certificate may provide useful assurance within its stated scope and dates; it does not answer every question about the service you will actually receive.
- Check the legal entity, service scope, delivery locations and significant subcontracting dependencies.
- Ask how access is controlled, incidents are notified and critical services recovered.
- Confirm what relevant assurance reports cover, what they exclude and whether exceptions remain open.
- Record outstanding questions and the person authorised to accept them before commitment.
Connect due diligence to the contract
NCSC recommends considering cyber security throughout selection, contracting, operation and termination. Turn important assurances into agreed expectations where appropriate: incident cooperation, security responsibilities, service reporting, access removal and return of assets. Obtain suitable advice on contractual terms and any applicable processor arrangements; a generic questionnaire does not settle these questions.
Before signing, write a short dependency statement: 'If this supplier is unavailable for X, these services and people are affected, and this is our workable alternative.' Treat an untested alternative as an assumption to validate.
Monitor change and prepare an exit
Set review dates and event triggers, such as an incident, acquisition, material subcontractor change or repeated service failure. Compare performance with the original decision. Refresh evidence when it becomes stale or the exposure changes. Discuss concentrated dependence on one provider across several services, including any shared underlying infrastructure.
Plan the exit while the relationship is functioning. Identify the data and assets to recover, access to revoke, dependencies to replace and support needed for transition. The useful outcome is a documented decision and maintained relationship, rather than a questionnaire filed once and forgotten.
- Working record: supplier, service owner, criticality, risks, evidence references, conditions of approval, monitoring dates, incident contacts and exit dependencies.
Put the guide to work
Start with the evidence.
- The supplier entity, service owner, access and activities that depend on the service.
- Assurance evidence checked for the actual service, period, exclusions and unresolved findings.
- Agreed responsibilities and approval conditions tied to the identified risks.
- A review or exit exercise showing how access, information and service continuity would be handled.
Your first three steps
- Choose a supplier whose failure would disrupt an important service.
- Test one material assurance against its scope and record anything it does not answer.
- Write the conditions for approval and identify the evidence needed to validate the proposed alternative or exit.
Common gaps to look for
- A certificate covers a different entity, service or period.
- Questionnaire answers never become operating or contractual expectations.
- The exit plan assumes data or service access that has not been checked.
Review when: Review after material subcontractor changes, repeated service failures, stale assurance evidence or increased reliance on the same provider.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the risk guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- NCSC — Principles of supply-chain security ↗Source checked 1 November 2026 · Primary source
- NCSC — Assess and gain confidence in supply-chain cyber security ↗Source checked 1 November 2026 · Primary source
- NCSC — Embed cyber security controls throughout the contract's duration ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.