Your suppliers passed at contract award. Would they pass today?
Check what your public body is assessed against for supplier security, from CAF and GovAssure to UK GDPR and PPN 014. Then see how ready you are and what to fix first.
Free · About two minutes · Nothing saved. Independent guidance from Risk Ledger, not an official assessment or legal advice.
Where supplier security sits in UK public sector cybersecurity compliance
Most supplier security expectations run through one framework, the NCSC's CAF. The rest depends on who you are, where you're governed and what your suppliers do.
Suppliers: principle A4 covers supply chain and secure software.
Suppliers: critical systems are assessed against CAF, including A4.
Suppliers: organisational and critical-system assessment, with supplier outcomes under A4.
Suppliers: supply chain controls within a risk-based, proportionate framework.
Suppliers: specific contract terms and sufficient guarantees from processors.
Suppliers: proportionate cyber controls in contracts, not Cyber Essentials everywhere.
NIS Regulations and the Cyber Security and Resilience Bill
NIS covers specified essential and digital services, not public bodies as such. The Bill would update and widen NIS, including for some managed service providers. It's still before Parliament.
Preparing for a CAF assessment: the supplier part
CAF is outcome-based. It describes what good looks like rather than prescribing controls, so you decide how to meet each outcome and show the evidence.
A register linking suppliers to the services they support
Tiering criteria, and the tier for each critical supplier
Standard security clauses, and which contracts include them
Review records and the remediation decisions that followed
Supplier incident contacts and notification terms
Assurance is strongest the day the contract is signed
Then suppliers change. They move hosting, take on subcontractors, let certificates lapse and have incidents of their own. A check at award shows none of it.
What a contract-award check doesn't show
Every supplier has suppliers of its own. Mapped across 25 UK councils on Risk Ledger, a thousand direct suppliers led to thousands more dependencies, and some of the most critical were missing basic controls.
Across 26 UK government bodies on Risk Ledger: 3,240 direct suppliers, 5,886 further dependencies and 224 critical concentration risks.
Source: Risk Ledger network data, Every Link Matters 2026. Dependencies analysed up to the eighth tier.
Guides for public sector security teams
Questions about the check
Does this complete a CAF assessment?
No. It covers the supplier part of CAF, mainly principle A4, and points you to the official route for your organisation. Your assessment still runs through that route, such as GovAssure or CAF for local government.
Is this official guidance?
No. It's independent guidance from Risk Ledger, built from NCSC, government, ICO and Parliament sources. Every result links to its source so you can check it.
Do all our suppliers need Cyber Essentials?
Not necessarily. PPN 014 asks for proportionate controls where a contract carries certain risks, and it accepts equivalent controls. Certification also doesn't assure the specific service you're buying.
We're an arm's-length body. Does GovAssure apply to us?
Your sponsoring department decides whether it applies in full, in part or not at all. The check gives you the questions to take to them.
What happens to my answers?
Nothing leaves your browser. We don't save your answers or ask for your details to see results.
How current is it?
We check every source against official guidance and update the check when it changes. Last checked October 2026.
See your suppliers, not just your answers
The check shows where to focus. Risk Ledger shows what's happening across your suppliers, and keeps that view current after award.
.svg)
