CAF Principle A4: Supply Chain
CAF principle A4 asks whether you understand and manage the risks your suppliers bring, including where your software comes from and how it is built. It sits close to the Cyber Security and Resilience Bill (CSRB), which allows regulators to designate some suppliers as critical suppliers.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What A4 asks
Principle A4 of the National Cyber Security Centre's Cyber Assessment Framework (CAF) has two contributing outcomes, both rated not, partially or fully achieved. It matters for the Cyber Security and Resilience Bill (CSRB) because the Bill puts more attention on the supply chain, though it does so through a separate legal route.
| Outcome | Focus |
|---|---|
| A4.a Supply Chain | Understanding and managing risks from suppliers |
| A4.b Secure Software Development and Support | Using secure, supported software, whether built or bought |
A4.a: how far your visibility goes
The partially achieved level is about knowing the extent of the supply chain, including subcontractors, and having appropriate security obligations in relevant contracts. You also need to know about all third-party connections and have assurance that they meet your requirements.
The achieved level goes further. It looks for a deep understanding of your supply chain and the wider risks it faces, considering factors such as supplier ownership, nationality and partnerships during procurement. It also considers supply chain subversion by capable, well-resourced attackers.
Incident handling is part of this. At the achieved level, your incident process and your suppliers' should support each other when appropriate, and customer and supplier responsibilities should be clear in contracts.
A4.b: software you can vouch for
The NCSC says CAF v4.0 adds a new section on the secure development and maintenance of software. A4.b asks about the following:
- Whether suppliers understand the composition and provenance of the software they provide
- Whether they use secure development practices or an established framework, such as NIST's SSDF
- How far development, test and production environments, source code and repositories are secured
- Whether updates and patches come through secure channels and can be authenticated
- Whether third-party components are monitored for new vulnerabilities at the achieved level
- What steps give you sufficient confidence in open-source software
What can show it
These are our suggestions, not NCSC requirements:
- A supplier register ranked by importance to essential functions, including known subcontractors
- Contract clauses covering security duties, incident notice and responsibilities
- A list of third-party connections, showing who owns each and what assurance you hold
- Software bills of materials or equivalent component information from key suppliers
- Records of supplier due diligence that affected purchasing decisions
- A joint incident exercise with a critical supplier
Where organisations fall short
- Unknown data: you do not know what of your data a supplier holds, or how it is managed.
- Unmonitored access: supplier access is unrestricted, unmonitored or bypasses your own controls.
- Contracts that say little: you are unsure which contracts matter, or they lack suitable security obligations.
- Weak patch quality: software updates undergo little testing, or often introduce new problems.
How A4 relates to the Bill
The Bill's text does not name the CAF, and the CAF is not itself legislation. The Bill does create a separate power: under regulation 14H, a regulator may designate a supplier as a critical supplier where disruption to it could have a significant impact on the economy or day-to-day functioning of society.
Full incident notifications must also include details where an incident was caused by a separate incident affecting another regulated person. Good supplier contacts and contract terms help you get that information quickly.
Next, read CAF 4.0 explained, the CAF self-assessment guide and our overview of the framework.
Sources
Frequently asked questions
A4.b is Secure Software Development and Support. It covers secure and supported software, whether built internally or bought in, including provenance, testing, patch arrangements and open-source confidence.
Yes. Having little or no visibility of subcontractors is a warning sign, and the partially achieved level expects you to know the extent of your supply chain, including sub-contractors.
A4 does not name a certificate. Suppliers need to be able to show appropriate and proportionate cyber security in context. Your contracts or regulator may set more specific expectations.
No. A critical supplier is designated by a regulator under the process in the Bill. A customer asking for evidence does not make you one.