The UK's Cyber Security and Resilience Bill (CSRB) presents a challenge many compliance teams haven't anticipated: Section 43 empowers ministers to order organizations in critical sectors to stop using certain products or services if they pose a national security risk. The Bill doesn't specify a minimum transition period for removing technology, nor does it require the government to publicly identify the supplier or allow them to respond.
If you received such a directive tomorrow, could you comply without disrupting essential services? This checklist will help your team build the supplier governance foundation the CSRB demands.
Prerequisites
Before using this checklist, ensure you have:
- Executive sponsorship for supplier governance work. Section 43 directives require cross-functional coordination, not just procurement.
- A defined scope of essential services. Identify which business functions are essential under the Bill to assess supplier criticality.
- Access to contract repositories and system documentation. You'll need legal agreements and technical architecture records.
Supplier Governance Readiness Checklist
1. Complete Supplier Inventory with Criticality Classification
Done when: You maintain a current list of all suppliers supporting essential services, with each supplier assigned a criticality tier based on their impact on operations.
Include suppliers of hardware, software licenses, managed services, and cloud infrastructure. Don't limit this to direct vendors; include subcontractors and technology components embedded in third-party solutions.
What "good" looks like: Your inventory includes supplier name, services provided, systems affected, contract renewal dates, and a criticality rating (critical/high/medium/low). You can filter this list to show all critical suppliers within 15 minutes.
2. Map Supplier Dependencies to Essential Business Services
Done when: For each essential service, you've documented which suppliers it depends on and what happens if that supplier becomes unavailable.
This is an operational resilience question. If a directive required you to stop using a specific cloud provider, which essential services would be affected? How long could those services continue operating?
What "good" looks like: You have a dependency matrix showing essential services in rows and critical suppliers in columns. Each intersection describes the dependency type (infrastructure, application, data processing) and estimated time-to-failure if the supplier is removed.
3. Document Contractual Exit Provisions for Critical Suppliers
Done when: You've reviewed contracts with critical suppliers and identified exit rights, notice periods, data retrieval provisions, and any termination penalties.
Section 43 directives won't override your contractual obligations; you still need to manage the legal relationship even as you execute a forced migration.
What "good" looks like: For each critical supplier, you know: minimum notice period required, whether you can terminate for convenience, data export format and timeline, and whether intellectual property or custom configurations transfer or remain with the supplier.
4. Establish Tested Contingency Arrangements for High-Risk Dependencies
Done when: You've identified alternative suppliers or workarounds for your highest-risk dependencies and validated that these alternatives can be activated.
"High-risk" means suppliers with links to jurisdictions of concern, single points of failure in essential services, or embedded systems that are difficult to replace. The NCSC's Cyber Assessment Framework (CAF) provides a structure for this risk assessment.
What "good" looks like: You have documented alternatives for at least your top five critical suppliers. You've tested failover to these alternatives in a non-production environment or validated through tabletop exercises that the transition is feasible.
5. Implement Continuous Supplier Risk Monitoring
Done when: You have a process that alerts you to changes in supplier risk posture, ownership, or geopolitical status before you receive a government directive.
This includes monitoring for ownership changes, security incidents affecting the supplier, shifts in supplier location or data processing jurisdictions, and adverse regulatory findings.
What "good" looks like: You receive quarterly supplier risk reports that flag material changes. Your process caught at least one significant supplier change in the past year before it affected your operations.
6. Document Supply Chain Security Controls
Done when: You can demonstrate how you assess and manage cybersecurity risk in your supply chain, aligned to a recognized framework.
The CAF explicitly addresses supply chain security. ISO/IEC 27036 provides detailed guidance on information security for supplier relationships. You need to show not just that you've asked suppliers about their security posture, but that you've verified it and taken action on gaps.
What "good" looks like: Your supplier security assessment process includes: initial security questionnaires, evidence review for critical suppliers, contractual security requirements, and annual reassessment. You can produce evidence of this process for your three most critical suppliers within one business day.
7. Create Supplier Exit Playbooks for Critical Dependencies
Done when: For each critical supplier, you have a documented procedure for removing or replacing them, including technical steps, stakeholder communication, and service continuity measures.
This playbook should assume you have limited time and may not have the supplier's cooperation. It needs to cover data migration, system reconfiguration, user communication, and validation that essential services remain operational.
What "good" looks like: Each playbook includes: responsible parties for each phase, estimated timeline, technical migration steps, rollback procedures, and success criteria. You've walked through at least one playbook in a tabletop exercise.
8. Establish Evidence Collection for Supplier Governance Decisions
Done when: You maintain records showing how supplier risk decisions were made, what evidence was considered, and what action was taken.
If you receive a Section 43 directive, you may need to demonstrate to regulators that you had appropriate controls in place and that the directive required action beyond your existing risk management.
What "good" looks like: For each supplier risk assessment, you retain: assessment date, findings, risk rating, decision rationale, and follow-up actions. This documentation is centralized and retrievable by supplier name or service category.
Common Mistakes
Treating this as a procurement compliance exercise. Supplier governance under the CSRB is about operational resilience and national security risk, not vendor management efficiency. Your procurement team needs to be involved, but this isn't their checklist to own.
Assuming you have time to negotiate. Section 43 directives can set aside normal consultation requirements on national security grounds. The Bill doesn't guarantee you'll know why a supplier is being prohibited or be given time to contest the decision.
Ignoring the flow-down effect. If you're a supplier to organizations in critical sectors, you'll inherit their compliance requirements. Smaller suppliers often lack the security teams and budgets to meet these expectations, but the requirements will flow down regardless.
Focusing only on software vendors. Embedded systems, hardware components, and managed service providers all fall within scope. A directive could target physical infrastructure, not just applications.
Next Steps
Start with your supplier inventory. If you can't produce a complete list of critical suppliers in under an hour, that's your first gap. The CSRB's direction is clear: supplier governance isn't about assessing risk at contract signature; it's about managing dependencies throughout the relationship and being prepared to exit when required.
For organizations delivering essential services, Section 43 makes supplier exit planning a compliance requirement, not a business continuity nice-to-have. The question isn't whether you'll eventually face a forced supplier transition; it's whether you'll be ready when it happens.
