Acquisition, supplier assessment and agreement procedure

Document control
Organisation / system scope	[Organisation] / [System or programme]
Document ID / version / status	AC / [Version] / [Draft or approved]
Owner / approving authority	[Named owner] / [Named approving authority]
Effective date / next review	[Date] / [Date or linked schedule ID]
Adoption decision record	[AD-01 record location and version]

AC-01 — Acquisition initiation

The requesting owner records the capability to be acquired, its business purpose, intended use, system interfaces, information involved and expected life. The request identifies security, privacy, resilience and support needs before supplier selection. It states whether the supplier will process information, obtain administrative access, provide executable artefacts, deliver updates or influence security-relevant decisions.

The supplier owner determines the depth of assessment from criticality and exposure, using SC-02. Procurement records identify decision authority, funding, timing and the people needed to assess technical, privacy and contractual requirements. A purchasing deadline that limits assessment is recorded as a constraint for the decision authority; it is not treated as evidence that unanswered requirements have been met.

AC-02 — Supplier information request

The supplier owner issues the following request with the acquisition scope. Responses identify the product or service, version, operating locations and relevant contractual entity. Evidence supplied for a broader organisation identifies how it applies to the proposed service. The owner records response dates, evidence validity and limitations.

Supplier assessment request
Product/service and intended scope: [Description]
Please identify:
1. Your secure development, review, testing and release practices.
2. How customers receive vulnerability reports, fixes and support notices.
3. Your security contact and coordinated disclosure arrangements.
4. The provenance and integrity evidence available for delivered artefacts.
5. The component/dependency information supplied and its update process.
6. The information processed, purposes, locations and retention arrangements.
7. Administrative access, authentication and customer access controls.
8. Relevant subprocessors or material downstream dependencies.
9. Incident notification, investigation cooperation and evidence available.
10. Continuity, recovery, support duration and end-of-life arrangements.
11. Export, transition, access removal and deletion arrangements at exit.
12. Independent assessment scope, date, exclusions and customer obligations.
For each response, identify supporting evidence, known limitations and
requirements you cannot meet. Identify changes requiring customer action.

AC-03 — Evaluate evidence

The assessor compares responses with the actual acquisition requirements. Each requirement is recorded as supported, partly supported, unsupported or unresolved, with the evidence and rationale. The assessor checks whether a certificate, report or attestation covers the relevant service, geography, period and operating responsibilities. The assessor identifies customer actions required for the claimed protection to apply.

Where practical and authorised, the technical owner verifies relevant behaviour through inspection, trial, testing or demonstration. The assessment records restrictions on testing and the consequence for assurance. Supplier statements remain attributed statements when independent evidence is unavailable. Findings enter the risk record and the selection decision, including concentration risk, replacement difficulty and the consequence of support ending.

AC-04 — Security and privacy agreement schedule

The following schedule records the commitments agreed between [Organisation] and [Supplier] for [service]. The parties complete the parameters, identify conflicting terms and confirm the executed version. This schedule takes effect as part of the agreement only when accepted through the parties’ contracting process. The supplier owner retains the signed agreement and records any requirement not accepted.

Agreement schedule for completion and acceptance
Subject	Commitment	Agreed particulars
Scope and responsibilities	The parties identify the service boundary, each party’s controls and evidence responsibilities.	[Scope; responsibility schedule]
Information use	The supplier processes supplied information for the agreed purposes and under the agreed access, location and retention conditions.	[Purposes; information; locations; periods]
Material changes	The supplier communicates changes affecting agreed security, privacy, support or downstream dependencies through the agreed process.	[Notice; contact; decision rights]
Vulnerabilities and updates	The supplier provides the agreed reporting route, treatment information, update integrity and support notices.	[Response periods; channels; evidence]
Incidents	The supplier notifies the organisation of relevant incidents and cooperates with agreed investigation, containment and communication activities.	[Trigger; notification period; contacts]
Assurance	The supplier provides the agreed evidence and assessment access subject to the agreed handling conditions.	[Evidence; frequency; access; limitations]
Continuity and exit	The parties maintain the agreed recovery, transition, information return or deletion and access-removal arrangements.	[Targets; assistance; evidence; responsibilities]

AC-05 — Selection and acceptance

The decision authority receives the requirement comparison, assessment, proposed agreement, costs, alternatives and risk position. The decision records the selected supplier, reasons, conditions and unresolved requirements. Approval to purchase is distinguished from acceptance of a delivered system or permission to operate it where those decisions have different scope or authority.

On delivery, the technical owner checks identity, version, integrity, agreed documentation, component information and acceptance results. Deviations are recorded and referred to the decision authority. The acceptance record identifies what was accepted, on what evidence and with which conditions. Supplier commitments are transferred into the responsibility and schedule registers so that they continue to be monitored after procurement closes.

AC-06 — Ongoing agreement management

The supplier owner maintains named contacts, review dates, evidence requests, service issues and change notices. The owner reviews whether actual service use has expanded beyond the assessed scope. Renewal decisions consider current requirements, supplier performance, open findings, support status and exit arrangements. Where the agreement expires or is terminated, the retirement procedure governs the transfer and closure of continuing responsibilities.