Prove It or Lose the Contract: What Buyers Expect on Supplier Cybersecurity

Has a customer asked you to prove your cyber security in the last year?

𝐓𝐡𝐞 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐚𝐧𝐝 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐁𝐢𝐥𝐥 won’t regulate every business directly, but its impact will reach far beyond the organisations it names. If you work with larger organisations or rely on an IT provider to run your systems, it’s already heading your way through contracts, supplier questionnaires and requests for evidence.

With the Bill’s final stages in the House of Lords under way, the question has moved on from “what is it?” to “what do we actually do?” In this session, we’ll talk plainly about what has changed, what it means for your business, and what you can safely wait for.

𝐓𝐡𝐞 𝐂𝐥𝐨𝐮𝐝𝐆𝐮𝐚𝐫𝐝 𝐏𝐎𝐕

The bar is moving from “we have security controls” to “prove you’re resilient.” Larger organisations are under pressure to show their suppliers won’t be the weak link, so they’ll ask for proof: a tested incident response plan, regular security testing and, in some cases, independent assurance. Cyber Essentials is a starting point, not the finish line.

Waiting for the final detail isn’t a strategy, because the no-regret moves are the same whatever it says.

𝐈𝐧 𝐭𝐡𝐢𝐬 𝐬𝐞𝐬𝐬𝐢𝐨𝐧, 𝐲𝐨𝐮𝐫 𝐬𝐩𝐞𝐚𝐤𝐞𝐫𝐬 𝐛𝐫𝐞𝐚𝐤 𝐝𝐨𝐰𝐧:

What’s changed after the Lords, and what to act on now versus what can wait.

What happened when the PHP2Shell vulnerability hit in October, and what separated the businesses that could answer their customers straight away from those left scrambling.

What big brands now ask their suppliers for, and what’s an instant red flag, straight from someone who assesses suppliers every day.

The risks behind it, from AI-speed attacks to forgotten legacy technology.

𝐖𝐡𝐲 𝐬𝐡𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐜𝐚𝐫𝐞?

Because your customers will care first. For most businesses, the Bill won’t arrive as a letter from a regulator. It’ll arrive as a questionnaire, a contract renewal or a tender requirement. The 2025 attacks on Jaguar Land Rover and M&S showed how one breach can ripple through an 𝐞𝐧𝐭𝐢𝐫𝐞 𝐬𝐮𝐩𝐩𝐥𝐲 𝐜𝐡𝐚𝐢𝐧. Businesses that can prove their resilience early will keep and win contracts. Those that can’t risk losing their place on approved supplier lists.

𝐌𝐞𝐞𝐭 𝐲𝐨𝐮𝐫 𝐬𝐩𝐞𝐚𝐤𝐞𝐫𝐬

We’re joined by Cara Walker, Global Chief Technology Officer at adm Indicia. With more than 2,000 suppliers of her own, and global brands as clients, Cara sees supply chain security from both sides: the questions she asks suppliers, and the questions she now gets asked. She’s joined by Matt Lovell, CEO at CloudGuard, who will share what our security operations team sees when a major threat hits.

Click attend, no details needed