Supply chain security
Supply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in. Many customers ask suppliers for Cyber Essentials, and A1.10 asks whether a contract is a reason for certifying. Within the scheme, accounts used by MSPs and controls run by cloud providers stay your responsibility.
- Term
- Supply chain security
- Also known as
- Supplier assurance, Third-party risk
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term supply chain security mean in Cyber Essentials?
Supply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.
How does supply chain security apply to Cyber Essentials?
In plain terms
Your organisation is only as secure as the people you let in. A cleaning company with a key, an IT firm with remote access, an accounting app holding your figures: each is a door into your business. A smaller supplier can be an easier way in than attacking its customer directly. Supply chain security means checking those doors, in both directions.
What Cyber Essentials asks
From the outside, Cyber Essentials is a common way for customers to check suppliers. A1.10 asks for the two main reasons you are applying, and the options include "required for a commercial contract" and "required for government contract". A1.10.1 and A1.10.2 then ask who the contracting organisation is.
From the inside, the requirements make you answer for your own suppliers:
- Cloud services "cannot be excluded from scope". Where a provider implements a control for you, it must have "committed to implementing this via contractual clauses or documents referenced by contract".
- Accounts used by "a supplier, contractor or Managed Service Provider (MSP)" are in scope. If you use externally managed services, "you must be able to confirm that the Cyber Essentials technical controls are being met".
- For software development, v3.3 introduces a reference to the Software Security Code of Practice.
Common mistakes
- Assuming a supplier's certificate covers you. It covers that supplier's own scope, and your MSP's certificate does not certify your systems.
- Leaving a supplier's access out of your answers because they manage it. Their accounts on your systems are yours to control.
See third-party accounts and MSPs and how to verify a supplier's certificate. Related: managed service provider, PPN 014.
Related terms
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- Vulnerability scanA vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- Application controlApplication control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.
Frequently asked questions
Supply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.
In the 2026 Danzell question set, supply chain security comes up at A1.10, A1.10.1, A1.10.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.