Home / Contractual practice
Contractual practice
Buyer security expectations
Supplier expectations combine contracts, procurement policies, sector, past incidents and risk appetite.
Effect of this requirement
This rule cannot be read in isolation.
- Transfers
- Bilateral relationship
- Country sources reviewed on
Assumptions, limitations and sources of this reading
Reading point
The contract is only part of the expectation
Questionnaires, procurement policies, incidents and sector complete the picture.
- Specific questionnaires and annexes
- Audit rights and evidence
- Continuity, reversibility and subcontracting
- Incident timeframes and cooperation
Principal's file
Reconstruct the actual expectation from the documents that govern the relationship.
Questionnaire
Precise statements reusable throughout the relationship.
Annex and contract
Obligations, deadlines, rights and responsibilities accepted.
Supplier policy
Procurement, security, sector and criticality expectations.
History of the relationship
Audits, incidents, exemptions, findings and renewals.
Decision path
Reconstruct an expectation scattered across the relationship
The client's position emerges across several documents and events that must be cross-checked before any new response is given.
01Sources of the expectation
Bring together the questionnaire, annex, supplier policy, tender, findings, incidents and renewal correspondence relevant to the same scope.
02Promises already made
Compare historical wording to detect contradictions, scope extensions and commitments that have lapsed.
03Risk to the relationship
Distinguish disqualifying criteria, negotiable requirements, expected evidence and preferences in order to focus effort in the right place.
04Authorised position
Have the response, reservation, remediation plan and timeline validated by the managers able to ensure their execution.
Reconstruct the client's expectation
The signals, documents and errors that genuinely influence the client's decision.
Questions to address
- MFA, privileged accounts and leaver management
- Backups, restoration and continuity tested
- Secure development and dependency management
- Declared subcontracting, notified incidents, accepted audits
Elements that support the response
- IAM exports and access review validations
- Dated restoration test reports
- SDLC evidence: reviews, scans, branch protections
- Subcontracting register and notification commitments
Confusions to avoid
- Giving two clients different answers on the same control
- Treating the questionnaire as a commercial formality
- Leaving responses to sales alone, without technical validation
- Ignore the fact that every response will be reviewed again at renewal
Assurance file, CF-024Demonstration example
Finding received“No review of subcontractor access”Finding
Verification of the basisA review exists, but has not been documented since MarchFinding
QualificationPartially substantiated findingFinding
Divergence observedThe work actually carried out never produced dated evidenceGap
ImpactResponse can only be contested with supporting evidenceGap
ActionChallenge the wording, document the review, date the closureDecision
Reading the coloursFactual observationGap or riskDecision or action
Demonstration
Reconstruct the client's position across several documents.
The case cross-references the questionnaire, annex, supplier policy and history to spot contradictions before a new response or a renewal.
Understanding how evidence is qualified →Apply this reading
Gather the documents that genuinely express the client's expectation.
Questionnaires, annexes, procurement policies and past exchanges help identify expectations that remain active and contradictions to resolve.