Compliance · Supply chain
Supply-chain security: what larger customers now expect
Regulated and larger organisations have to manage the security risks of their suppliers, and they pass requirements down. We help you understand what is being asked, close the gaps and answer with evidence.
Why the questions are arriving
Your customers’ risk is now your requirement
Attackers often reach large organisations through smaller suppliers with weaker security. Regulators have responded by making larger organisations responsible for the security of their supply chains, and those organisations in turn write security requirements into supplier contracts and onboarding.
For a small supplier, this usually shows up as a security questionnaire, a request for a Cyber Essentials certificate, or new clauses about incident notification and audits.
- Supplier security questionnaires at onboarding and renewal
- Requests for Cyber Essentials, CE Plus or ISO 27001
- Contract clauses on incident notification and right to audit
The regulations
NIS2 and the UK picture, in brief
What NIS2 is
NIS2 is an EU directive (Directive (EU) 2022/2555) that replaced the original NIS Directive. EU member states were required to bring it into national law, and it applies to many medium-sized and large organisations in sectors such as energy, transport, banking, health, digital infrastructure, ICT service management and some manufacturing. It requires them to manage cyber security risks, including risks in their supply chains, and to report significant incidents.
Does it apply to UK businesses?
NIS2 is EU law, not UK law. Most UK SMEs are not directly in scope. A UK business that provides certain services within the EU may be, and should take legal advice to confirm its position.
The more common effect is indirect: if you supply an EU organisation that is in scope, it has to assess and manage the security of its suppliers. Expect its requirements to reach you through contracts and questionnaires.
The UK position
In the UK, the Network and Information Systems Regulations 2018 continue to apply to operators of essential services and certain digital service providers. The UK Government has proposed a Cyber Security and Resilience Bill to update that regime, including proposals to bring some managed service providers and critical suppliers into scope. It is proposed legislation, and its details may change before it becomes law. We will update this page as it progresses.
What customers ask for
The requirements that come up most
Whatever the framework behind them, supplier requirements tend to cover the same ground.
A recognised baseline
Cyber Essentials or Cyber Essentials Plus as a minimum, sometimes ISO 27001 for larger contracts.
Cyber EssentialsStrong sign-in
Multi-factor authentication on email, remote access and any system that holds the customer’s data.
Patching and vulnerabilities
Evidence that devices and servers are kept up to date and that known vulnerabilities are fixed promptly.
Backup and recovery
Backups that are protected from ransomware and a tested way to recover the services the customer relies on.
Incident notification
A named contact and a commitment to tell the customer promptly if an incident could affect them.
Your own suppliers
Knowing which cloud services and providers handle the customer’s data, and how you check them.
How we help
From questionnaire to evidence
We do the technical work and draft the technical answers; you stay in control of what is sent to your customer.
Step 1: Read the requirements
We go through the contract schedule or questionnaire with you and pick out what applies.
Step 2: Gap check
We compare the requirements with your current setup and list what needs to change.
Step 3: Fix and evidence
Our engineers close the gaps and gather the evidence, from MFA reports to backup test records.
Step 4: Answer
We draft accurate technical answers for you to review, so nothing is overstated.
Step 5: Keep it current
Ongoing support keeps controls and evidence up to date for the next review.
FAQ
Supply-chain questions
This page is general information, not legal advice. Requirements change, so we always work from the current published version of a scheme or regulation, and alongside your legal adviser or data protection lead where the law is involved.
Free IT & security review
Find out where your IT is exposed — in 30 minutes
A senior engineer reviews your setup, security and backups, then gives you a plain-English action list. No obligation, no hard sell.