If you supply Aberdeen’s energy sector, you may be asked during a tender or contract renewal details on how you protect client information, control access and recover from a cyber incident.
Clients need to understand whether a disruption in your business could delay theirs.
Why smaller suppliers face detailed questions
A small business can perform a critical role in a large project. If an inspection company cannot retrieve the records needed to approve equipment for use, work could stop while those records are recovered.
Procurement teams use security checks to assess the risk of working with a supplier before awarding or renewing a contract. They want to understand whether client information could be exposed or altered, whether supplier access could put their systems at risk and whether a disruption could delay work.
Start by identifying the information and services you provide to each client. Then consider the consequences if they became unavailable or unreliable. This gives you a practical basis for deciding which protections and recovery arrangements need the most attention.
Be clear about access to client systems
If your staff connect to a client’s systems to monitor equipment, investigate faults or carry out maintenance, you need to understand how that access is controlled.
Be ready to explain who can connect, which systems they can reach and how their identity is checked. Establish whether access stays active between visits, how activity is recorded and who removes access when someone leaves or a contract ends.
These arrangements need particular care where connections reach operational technology: the systems used to monitor or control physical equipment and processes. Changes can affect operations and safety, so agree them with the client’s responsible technical team.
Include subcontractors in your review. An account created for a short maintenance job can remain a risk if nobody takes responsibility for closing it.
Check whether recovery would meet the client’s needs
A successful backup report does not tell you how quickly your business could resume work.
Suppose your email and shared files become unavailable on the morning a client needs project documentation.
Discuss a realistic disruption with the people responsible for operations, management and IT. Establish:
- Which client commitments would be affected first.
- How long the business could manage without the relevant systems.
- What the latest recovery test demonstrated.
- Who would make decisions and communicate with affected clients.
Record any gaps and assign responsibility for addressing them. Your IT provider can explain recovery options and limitations; someone within your business must decide whether those arrangements meet your operational commitments.
Check your own dependencies too. If a cloud service or specialist subcontractor became unavailable, could you still retrieve essential records and deliver your work?
Support your answers with current evidence
A questionnaire is easier to complete when you can refer to records of what happens in practice. For example, a policy may say that access is removed when staff leave. A recent access review helps show whether that process is working.
Review these areas with your IT provider:
| Area | What to establish |
| Account security | Which email, cloud and remote-access services enforce multi-factor authentication, and where exceptions remain. |
| Staff access | Whether people use individual accounts, have appropriate permissions and lose access promptly when required, eg when a member of staff leaves. |
| Staff awareness | Whether staff receive practical training on phishing, suspicious payment requests and reporting incidents. |
| Backups | What is covered, how backups are protected and when recovery was last tested. |
| Incident response | Who takes responsibility, where contact details are held and how affected clients would be informed. |
Keep evidence dated and relevant to the work being assessed. If a question asks whether a control covers every device, check for exceptions before answering.
Where you find a gap, describe it accurately and set out the proposed action and timescale. Avoid claiming that a planned improvement is already in place.
Where Cyber Essentials fits
Cyber Essentials covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus includes independent technical testing of those controls.
Certification can support supplier assurance, and some clients require it. Check the requested level and whether the certificate’s scope covers the systems and activities relevant to the contract.
Clients may also ask about recovery, subcontractors, staff awareness or incident communication. Those questions address matters outside the scheme’s five technical controls, so keep the supporting records available alongside your certificate.
Prepare before a tender becomes urgent
Ask for supplier security requirements early enough to investigate gaps and complete any necessary work.
If you have received a supplier security questionnaire, Secure360 provides cyber security support to Aberdeen's energy sector and SMEs to help you understand the technical questions, review your existing protections and identify the records needed to support your answers.
