Security-Classified Procurements and Supplier Security
Security throughout the procurement life cycle
Security must be planned before the tender competition and followed up until the delivery has been completed. We map which assets suppliers and subcontractors may gain access to, how that access takes place, and which requirements must be set for personnel, systems, premises and governance.
Our advisers combine procurement, contract and security expertise. We assist with security agreements, assessment of facility security clearance and practical follow-up of changes, non-conformities and supply chains. In this way, the security requirements are clear, proportionate and verifiable throughout the delivery.
The advice may include
- mapping of the procurement's purpose, phases, deliverables, parties, locations, systems, data flows and subcontractor chain
- asset assessment and specification of the security classification and classification level for the procurement and its individual parts
- assessment of whether the procurement is covered by the rules on security-classified procurements, and which requirements apply
- security risk assessment based on assets, threats, vulnerabilities, forms of access, dependencies and possible harmful consequences
- drafting of security requirements for tender documents, qualification, tenders, contract, changes, service, warranty and termination
- preparation, quality assurance and administration of a security agreement with or without facility security clearance
- assessment and justification of the need for facility security clearance, and support with the contracting authority's request and the supplier's self-declaration
- preparation for verification of the supplier's security management, ownership, organisation, personnel, premises, information systems and protective measures
- clarification of requirements for security clearance, access clearance, authorisation, duty of confidentiality and an overview of personnel with access
- requirements for approved information systems, premises, means of communication, storage, transport, return and destruction of security-classified information
- mapping, risk classification and contractual regulation of subcontractors, including requirements for prior consent and separate security agreements
- establishment of a supplier register, control plan, reporting, audit rights, non-conformity handling, notification procedures and follow-up of corrective measures
- handling of changes in ownership, management, finances, organisation, locations, systems, personnel or supply chain that may affect security
- controlled termination with closure of access, return or approved destruction, cessation of the right of disposal and documented closure of security obligations
What does the organisation receive?
The organisation receives a verifiable basis for carrying out the procurement with the right level of security. The deliverable may include an asset assessment, a requirements matrix, a security agreement, supporting material for facility security clearance and a plan for the control of suppliers and subcontractors. We support both the contracting authority and the supplier from early clarification to controlled termination.
← Back to Security Act and Risk Analysis