Essential NCSC-Aligned Cyber Due Diligence for UK Founders Procuring Third-Party Software and Automation

The Unseen Vulnerabilities in Your Software Stack

The contemporary UK business landscape heavily relies on third-party software and automation to enhance efficiency and innovation. While this adoption offers significant benefits, it also introduces substantial supply chain cyber risks that are often overlooked in the urgency to integrate new technologies. Such vulnerabilities can expose organisations to severe damage and disruption, making proactive vendor vetting an absolute necessity.

Cyber attacks exploiting supply chain weaknesses represent a growing and significant threat. Alarmingly, only 13% of UK businesses currently assess the cyber risks posed by their immediate suppliers, leaving a vast majority vulnerable. Ransomware incidents, in particular, are increasingly leveraging compromises within supply chain partners, underscoring the urgent need for comprehensive cyber due diligence beyond traditional contractual agreements alone.¹²

NCSC's Foundational Principles for Secure Procurement

The National Cyber Security Centre (NCSC) serves as the UK's authoritative body for cyber security guidance, offering a robust framework for securing supply chains. Their 12 principles for supply chain security provide a structured approach for UK founders to navigate the complexities of third-party software procurement. These principles are categorised into four critical stages, guiding businesses from initial risk identification to continuous improvement.

The first stage, 'Understand the Risks', involves identifying what needs protection, who your suppliers are, and the potential vulnerabilities within the supply chain. This is followed by 'Establish Control', where security profiles are defined, minimum security requirements are set, and these are embedded into contracts. The third stage, 'Check Your Arrangements', focuses on gaining confidence in suppliers' adherence to these standards, often through certifications. Finally, 'Continuous Improvement' mandates regular reviews and adaptation of security practices as the threat landscape evolves.

Practical Cyber Due Diligence Steps for UK Founders

Implementing practical cyber due diligence begins with a risk-based tiering of suppliers. Not all suppliers pose the same level of risk; assessments should be prioritised based on factors such as data access, the criticality of their service, and potential impact on your business. The NCSC guidance, updated recently, suggests combining its 12 principles with a supplier-assurance question set as an authoritative and proportionate starting framework for buyers.

A fundamental baseline for technical controls is the Cyber Essentials (CE) certification. The NCSC strongly recommends embedding CE adoption into procurement processes and Request for Proposals (RFPs) to assure suppliers have implemented essential protections against common cyber attacks. UK businesses with a turnover under £20 million can also benefit from free cyber-liability insurance upon achieving CE certification. Buyers can use the NCSC's Supplier Check tool to verify certification levels, moving beyond simple self-attestation.¹

Beyond certifications, it is crucial to probe specific vendor practices thoroughly. Advise against solely relying on vendor-provided documentation; instead, seek objective evidence. Key areas to investigate include incident response plans, breach disclosure policies, network security protocols, device encryption, and crucially, how data is handled and securely deleted at contract termination. This ensures a comprehensive understanding of a vendor's security posture.

Integrating UK GDPR Requirements and Ongoing Security

UK GDPR compliance is paramount when procuring third-party software, especially when personal data is involved. The Information Commissioner's Office (ICO) mandates that organisations choose data processors providing 'sufficient guarantees' regarding their security measures. Written contracts must explicitly stipulate that processors adhere to Article 32 UK GDPR security measures, encompassing confidentiality, integrity, availability, and timely recovery of data.

Contracts should also include clauses allowing for the demonstration of compliance, potentially through audits or inspections, as the primary organisation remains responsible for the data processed even when using third-party services. This legal framework ensures that robust security is not just an operational consideration but a contractual obligation.

Ultimately, robust cyber due diligence is a strategic investment that extends far beyond the initial procurement phase. It requires continuous monitoring of supplier security performance, not just a one-off check, to adapt to evolving threats. Empowering UK founders with NCSC and ICO guidance enables informed decisions, fostering a more resilient and secure digital ecosystem for their businesses.