Your own suppliers, and what to ask them

You are a supplier and you are a customer

The reference section covers the obligation arriving from above. This is the other end: what you have to require of the machine shop, the finishing house, the design contractor and the software vendor who touch the same information.

Suppliers concentrate almost entirely on the first and are surprised when a prime asks what they require of their own chain.

Six questions, not two hundred

• Do you receive or hold our controlled information, and which?
• Where does it sit, and who can reach it?
• What is your current status against the requirement?
• Who is your named contact for a security incident?
• Will you tell us within a stated time if something happens?
• Do you pass these requirements to anybody further down?

Six questions get answered. A two-hundred-question spreadsheet arrives at a small shop with no compliance function, gets filled in by somebody guessing, and produces a file rather than information.

Your eight-person machine shop cannot do this

They have no compliance owner, no budget and possibly no idea the requirement exists. Demanding certification from them by a date achieves one of two things: they stop working with you, or they tell you what you want to hear.

Neither improves your position, and losing a capable supplier over a form is a real commercial cost.

Three options that are not a demand

Reduce what they hold. If they can do the work without the controlled file, or with a redacted version, the requirement largely goes away. This is frequently possible and rarely considered.

Do the handling yourself. Keep the data in your environment and give them access under your controls rather than sending it.

Help them. Share what you learned, point at the free sources, introduce them to the assistance programmes that exist. It costs little and it keeps a supplier.

Four clauses, kept short

What they must protect and to what standard. Notification of incidents within a stated period, to a named person. The right to ask for evidence, proportionately. And an obligation to pass equivalent terms further down.

Long security schedules imposed on small suppliers are signed unread. Four clauses in plain language are more likely to be understood and therefore more likely to be followed.

Keep what you asked and what they said

An assessor may ask how you manage your supply chain, and the answer is the questionnaire responses, the contract terms and the review dates. Held somewhere findable, dated, and refreshed on a cycle.

Annual is adequate for most. Refresh sooner when a supplier's circumstances change or when the work they do for you changes.

Know which suppliers touch what

A list of suppliers, what controlled information each receives, and how it reaches them. This is the supply-chain version of the shop-floor inventory and it is missing about as often.

Building it usually finds two or three suppliers who receive things nobody realised they received, generally because a file was attached to an email in 2021 and the practice continued.

Match the demand to the exposure

A supplier who receives a full technical data package is a different proposition from one who receives a dimensioned sketch. Tiering your requirements by what each actually holds is defensible, cheaper, and more likely to be complied with than a uniform demand.

Elsewhere in the wider regime

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.