Supplier management for technology companies

Technology companies sit in the middle of a supply chain. Your customers check you, and to answer them honestly you need to know your own suppliers: the cloud platform you run on, the software your team uses with customer data, the contractors with access to your code, and the AI services in your product. This page covers what's specific about supplier management for software and technology businesses, and how SupplierVault helps.

What's different for technology companies

Customers ask about your suppliers. Security questionnaires and contract terms ask who your sub-processors are, where data is held, and how you check your own suppliers. "We'll get back to you" slows sales down.
Your sub-processors are part of your product. If you process personal data for customers, they usually have to approve your sub-processors, and you have to tell them about changes.
A few suppliers are critical. A hosting, identity or payments provider failing can take your whole service down. Concentration risk is real.
The software stack grows fast. Teams sign up for tools with a card, and some of those tools end up holding customer data.
AI suppliers raise new questions: whether your data trains their models, where it's processed and how outputs are checked.

The standards and rules that apply

ISO 27001

ISO/IEC 27001:2022 has five Annex A controls about suppliers:

Control	What it covers
A.5.19 Information security in supplier relationships	Processes to manage the security risks of using suppliers' products and services
A.5.20 Addressing information security within supplier agreements	Security requirements agreed with each supplier, in the contract
A.5.21 Managing information security in the ICT supply chain	Security requirements passed down to your suppliers' own suppliers
A.5.22 Monitoring, review and change management of supplier services	Regularly checking suppliers' security and service, and managing changes
A.5.23 Information security for use of cloud services	How cloud services are chosen, used, managed and exited

Certification auditors look for evidence that these happen in practice: a supplier list with risk ratings, contracts with security terms, and reviews on a schedule.

SOC 2

SOC 2 reports, common with US customers, are based on the AICPA's Trust Services Criteria, which include assessing and managing risks from vendors and business partners. Auditors test that you do this over the report period, so records with dates matter.

Cyber Essentials

Cyber Essentials is the UK government-backed scheme for basic cyber security controls. Many public-sector buyers, and the government's G-Cloud framework, expect suppliers to hold it, and larger customers increasingly ask for it from their suppliers too.

UK GDPR

If you process personal data for customers, you're their processor. UK GDPR Article 28 says you can't engage another processor without the customer's prior written authorisation, must tell them of changes where they've given general authorisation, and must pass the same data protection obligations down to your sub-processors. If data leaves the UK, you need a valid transfer mechanism. Our DPA checklist covers the contract terms.

Selling to financial services

If your customers are banks, insurers or investment firms, their outsourcing rules flow down to you: audit and access rights, notice of sub-outsourcing, business continuity and exit support. See our page for FCA-regulated firms to understand what they're asked for. Customers in the EU financial sector are also subject to the EU's Digital Operational Resilience Act (DORA), which has applied since 17 January 2025 and sets rules for their ICT third-party providers.

What to check with your suppliers

Supplier	Typical checks
Cloud hosting and infrastructure	ISO 27001 certificate or SOC 2 report and its scope, data location, incident notification terms, exit and data export
Software with customer data	Data processing agreement, sub-processors, MFA and single sign-on, data location
Contract developers and agencies	Confidentiality, intellectual property assignment, access removed when they leave, off-payroll working (IR35) status for individuals
AI and machine learning services	Whether your data is used for training, data retention, where processing happens, human checking of outputs
Payment and identity providers	Regulatory status, service levels, concentration risk and a fallback plan

Where to start in SupplierVault

Choose the Technology companies starter set-up, or tick the ISO 27001 and Cyber Essentials options in Settings at any time. Then:

Each supplier with data or system access gets an information security checklist mapped to ISO 27001 controls A.5.19 to A.5.23, and the ISO 27001 supplier controls report shows checks met and gaps for your auditor.
The Technology compliance pack records Cyber Essentials level, certificate number and expiry, ISO 27001 and SOC 2 expiry, incident reporting times and sub-processors (Professional plan and above).
The AI governance register shows which suppliers use AI with your data, and whether that's approved (Professional plan and above).
Tier suppliers from T1 to T4 so your critical providers get the closest reviews, and test exit plans for the ones you can't do without.
On the Enterprise plan, pull supplier data into your own tools through the API, and sign in with SAML single sign-on, set up with you.

Every setting can be changed afterwards. SupplierVault records the evidence; your own auditors and advisers decide what's enough.

Useful guides and tools

Sources

ISO/IEC 27001:2022 (ISO)
Cyber Essentials (National Cyber Security Centre)
Contracts and liabilities between controllers and processors (ICO)
Digital Operational Resilience Act, Regulation (EU) 2022/2554 (EUR-Lex)

GuideThird-party risk managementA proportionate approach that a small team can keep running, not a framework that sits on a shelf.TemplateData processing agreement checklistWhat your contract with a supplier that processes personal data for you must include under UK GDPR Article 28.Who it's forSupplier management for FCA-regulated firmsOutsourcing records, notifications, audit rights and tested exit plans, kept the way the FCA and your auditors expect.