Policy paper

Vendor risk management

Updated 3 November 2026

What are we going to do?

We will seek to introduce a new vendor risk management framework which will focus specifically on the national security risks posed by vendors deployed in connection with the network and information systems of essential service providers.

The framework will be composed of three essential parts:

1. Non-statutory guidance for operators to help to identify and manage vendor-related risks, including at the point of procurement;
   
2. A voluntary referral route, where the government can assist operators with vendor-related risks, including existing contracts and before entering into new, or renewing, procurement contracts;
   
3. A new power for the government to issue directions in relation to goods, services or facilities, within statutory timelines to be set by secondary legislation.

Entities will be brought into scope of the framework via secondary legislation and, to begin with, only Operators of Essential Services (as defined in the Network and Information Systems Regulations 2018 (the NIS Regulations) as amended by the Cyber Security and Resilience Bill (CSRB)) will be brought into scope. This means that the framework will apply to organisations in the following sectors: energy, drinking water, transport, health, digital infrastructure, and data infrastructure (data centres). The delegated power to bring entities in scope can be used to apply the framework to more entities in the future.

Why are we going to do it?

The use of vendor-supplied goods, services and facilities in our critical infrastructure can pose a serious national threat to the UK, particularly where the vendor has links to a third country.

Through such vendors, a third country could gain access to or control of critical systems, enabling disruption to UK national infrastructure, surveillance through access to data at scale, or espionage through access to sensitive information.

The risk landscape is evolving quickly, and the government and operators must be able to collaborate proactively to manage risks before critical systems become dependent on those goods, services or facilities. Where risks are identified after goods, services or facilities are already in use, the government must also be able to intervene reactively. Protecting the UK’s national security is paramount, and that is why we must introduce the powers now.

What has changed since introduction of the Bill?

Since introduction, the evidence on vendor specific risks has evolved and we now recognise the need to create a framework for managing vendor-related national security risk, including a dedicated vendor power.

How are we going to do it?

The guidance and referral route are intended to help operators identify and manage vendor-related national security risks as early as at the point of procurement, reducing the likelihood that more intrusive measures are needed later, before risks crystallise and the cost of action escalates.

Guidance

We intend to publish guidance setting out vendor security considerations that indicate when a procurement is more likely to present heightened national security risk. The purpose of the guidance is to help operators distinguish between routine procurements and a smaller subset where it may be appropriate to seek a view from government, via the voluntary referral route, before entering into, or renewing, a contract.

Voluntary-Referral Route

We intend to create a voluntary referral route into government where operators have identified risks associated with procurements. We intend for operators of essential services to refer prospective procurement decisions contract renewals and existing arrangements where vendor-related risks subsequently emerge; based on guidance the government will publish. We do not intend for vendors to use the voluntary reporting process themselves.

Statutory timelines will apply where an operator has referred a procurement decision to government and a decision needs to be taken about whether a direction should be issued to provide operators with confidence and certainty as much as possible. The statutory timelines will be set by secondary legislation, following consultation.

By using the procurement guidance and voluntary referral route, operators can reduce the risk of embedding goods, services or facilities within their systems that could create national security risks.

Vendor-Related Directions

The Bill would grant the government the power to issue vendor-related directions to operators. A direction could instruct operators not to procure a good, service or facility, stop using, remove or put certain mitigations in place in relation to the use of goods, services or facilities provided by a vendor.

As with the powers of direction already included in the CSRB, a vendor-related direction could only be issued where it is necessary and proportionate in the interests of national security. The government would undertake an assessment of proportionality including an analysis of the expected costs of complying with a direction.

Consultation

Before issuing a vendor-related direction, the Secretary of State will need to consult with the operator to whom they are considering issuing a direction, as well as the vendor whose goods, services or facilities are considered to pose a risk, so far as it is reasonably practicable to do so and unless such consultation would be contrary to national security.

The government may make use of the existing power in Part 4 of the Bill to request information for the purposes of assessing whether a direction should be issued or assessing compliance.

Enforcement

The Bill will give the government powers to enforce compliance with vendor-related directions. Where an operator does not comply with a vendor-related direction, the maximum penalty amount will be 10% of turnover for an undertaking, or £17 million for any regulated entity that is not an undertaking. In the case of a continuing contravention the maximum penalty will not exceed £100,000 per day. This is consistent with the enforcement regime for the existing power to direct regulated entities.

Oversight

The government will publish notices when the power is used, as well as laying an annual report before Parliament which will provide the number of vendor directions issued within that period, unless the government considers that it would be contrary to the interests of national security to do so.
Operators or vendors will be able to challenge requirements in vendor-related directions and/or enforcement decisions via judicial review at the High Court.

Delegated Powers

To ensure that this vendor risk management framework remains effective in mitigating national security risks into the future, the framework includes several delegated powers.

These include powers to:

• bring NIS-regulated and non-NIS-regulated entities into scope of the CSR Bill’s national security powers where those entities meet the relevant criteria
• establish statutory timelines in secondary legislation for deciding whether to issue a vendor-related direction to ensure organisations receive decisions from government in good time
• enable the government to establish a mandatory screening regime in the future, if the government determines that it is necessary or expedient in the interests of national security

There are also consultation requirements in respect of exercising the delegated powers.

The government has submitted a supplementary delegated powers memorandum to the Delegated Powers and Regulatory Reform Committee to clarify these powers.

Implementation

The measures will be brought into force through secondary legislation following Royal Assent. We will consult on the key elements of the framework following Royal Assent and in anticipation of secondary legislation.

Interaction with powers of direction

The Bill already contains important national security powers under Part 4, which enable the Secretary of State to direct regulated entities or regulators to take action where a specific threat to network and information systems gives rise to a national security risk. The vendor risk management power is distinct but complementary.

The Bill’s existing powers of direction would be used where the systems of a regulated entity have been compromised, or could be compromised, and this presents a national security threat. For example, if government has evidence of hostile actors pre-positioning themselves on an entity’s system to launch future attacks.

By contrast, the vendor risk management framework has been designed to address risks that could arise from the procurement choices made by operators of essential services. This is a different axis of risk that requires a different test and a different power. The intention is that vendor risks should be managed before they crystallise and before costs escalate.

Interaction with critical suppliers

Under clause 12 of the Bill, regulators will be able to designate critical suppliers to ensure the most important suppliers to essential, managed and digital services are subject to mandatory cyber requirements. This will ensure that the most systemically important suppliers to the UK’s essential services are resilient against cyber-attacks and outages, reducing the risk of onward disruption to the UK’s essential services.

The vendor risk management framework is targeted at the use of goods, services or facilities that pose national security risks. Initially, only operators of essential services will be brought into scope of the vendor-related direction power.

Therefore, at the outset, a designated critical supplier will not be in scope of this measure in respect of the critical supply for which it is designated.

However, the Secretary of State may issue a direction to an operator of essential services, in relation to goods, services or facilities provided by a designated critical supplier.

Interaction with other relevant digital service providers (RDSPs) and relevant managed service providers (RMSPs)

To begin with, only operators of essential services will be brought into scope of the vendor-related direction power. Therefore, other regulated entities such as RDSPs and RMSPs will not be in scope of this measure for the relevant digital or managed service they provide. Where an RDSP or RMSP is also an operator of essential services, it may receive a vendor-related direction in respect of the essential service it provides.