Free tools Windows power users keep installed
One-click scans. No signup required.
Small suppliers should not start with a generic “critical-infrastructure” checklist. Start with the customer’s contract and security schedule, identify the systems and people that deliver your service, assess the resulting risks proportionately, document evidence of the safeguards you already operate, and agree who does what when requirements or services change.
Your exact duties depend on the customer, sector, jurisdiction, contract, data handled, network access, and operational consequences of a failure. NIST and the UK National Cyber Security Centre (NCSC) provide useful frameworks, but neither document automatically creates a legal duty for every supplier.
As an Amazon Associate I earn from qualifying purchases.
What cybersecurity requirements actually apply?
The phrase “critical-infrastructure supplier” describes context, not a complete control list. A software developer, facilities contractor, cloud administrator and maintenance firm may all support a critical service while having very different risks and obligations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Read the contract before choosing controls
Ask the customer for the documents that define your obligations:
- the security schedule or supplier security standard;
- the security questionnaire and instructions for completing it;
- incident-notification deadlines, contacts and escalation rules;
- requirements for privileged, remote or physical access;
- subcontractor approval and flow-down clauses;
- required assessments, certifications, attestations or audit rights; and
- rules for handling, storing, returning or destroying customer data.
Keep the source, owner, effective date and review date for every requirement. A label such as “critical supplier” does not tell you which safeguards, evidence or reporting periods the customer expects. NIST’s supply-chain guidance says controls should be selected in relation to the procurement’s mission criticality, data sensitivity and operating environment.
Separate binding terms from guidance
| Source or request | What it means | How a supplier should use it |
|---|---|---|
| Customer contract or security schedule | Binding for the services and scope described in the agreement. | Build your primary obligations and evidence plan from these clauses. |
| Applicable statute or sector regulation | Binding within its stated jurisdiction, sector and threshold. | Confirm with the customer or qualified legal adviser which provisions apply to your role. |
| NIST Cybersecurity Supply Chain Risk Management guidance | Risk-management guidance, not a universal law for suppliers. | Use its lifecycle and procurement concepts to organize your process. |
| NIST SP 1326, final July 2026 | Due-diligence assessment guidance for information and communications technology suppliers. | Use its assessment dimensions to structure questions about a supplier or product. |
| NCSC supplier-management guidance | UK guidance emphasizing proportionate supplier profiles, responsibilities and supply-chain visibility. | Use it as practical guidance; do not treat it as a statement of United States law. |
| GSA Acquisition Regulation Subpart 504.70 | A rule for GSA-funded contracts and orders, regardless of estimated value. | Apply it only when your procurement is within that GSA scope, not to every private or public contract. |
NIST’s software supply-chain guidance associated with Executive Order 14028 is directed to federal agencies and software procurement. It should not be presented as a universal obligation for every small software supplier.
Six steps for a defensible supplier-security program
1. Create a requirement register from the customer’s documents
Turn each contract clause or questionnaire item into a row in a simple register. Record the exact requirement, the service or asset it covers, the evidence requested, the person responsible, the source document and the due date. Mark whether the item is a one-time onboarding requirement, an ongoing control, an incident obligation or a change-notification obligation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →When a question is ambiguous, ask the customer whether it applies to your whole company or only to the contracted service. Clarify whether “systems” includes personal devices, development environments, backup platforms, subcontractor systems or cloud services. Written clarification prevents an informal interpretation from becoming an accidental promise.
2. Map the service and its dependencies
Draw a service-level map that a non-specialist customer contact can understand. Include:
- the applications, endpoints, networks and facilities used to deliver the service;
- employees, contractors and administrators who can reach those systems;
- customer, personal, operational and authentication data handled at each stage;
- cloud, hosting, managed-service, telecommunications and software providers;
- subcontractors and other supply-chain tiers; and
- connections into the customer’s environment, including remote-access paths.
For every dependency, note what would happen if it became unavailable, compromised or inaccessible. Mark whether it can affect the customer’s critical operation, expose sensitive information or provide a route into the customer network. The NCSC’s mapping guidance and Cyber Assessment Framework Principle A4 emphasize visibility into critical suppliers, subcontractors, supplier-held information, connections and data sharing.
3. Perform a proportionate due-diligence assessment
Assign a named owner, even if that person is an operations or IT lead rather than a dedicated security manager. For ICT suppliers, NIST SP 1326 identifies five useful due-diligence dimensions:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems| Dimension | Questions to answer |
|---|---|
| Foreign ownership, control or influence | Who owns or controls the supplier, and could external influence affect service, data or decision-making? |
| Provenance | Where did the product, software, components and important services originate, and can their history be established? |
| Resilience | Can the supplier continue, restore and communicate its service after disruption or loss of a dependency? |
| Foundational cyber practices | How are accounts, devices, vulnerabilities, updates, backups, monitoring and incidents managed? |
| Supply-chain tiers | Which subcontractors and upstream providers support the service, and what visibility or flow-down terms exist? |
NIST defines due diligence in SP 1326 as “the investigative process of researching all available, pertinent information about a given supplier or product so that informed decisions can be made on new acquisitions or existing systems.” Use the dimensions as a way to organize evidence, then tailor depth to the customer’s risk, your access and the consequences of disruption. A supplier with no customer-network access and limited business data should not automatically receive the same assessment as a remote administrator of an operational system.
4. Close and document the most relevant gaps
Maintain an action list with the gap, affected service, risk, owner, target date, interim measure and evidence of completion. Prioritize safeguards that match the access and service you mapped, such as:
- unique accounts, strong authentication and prompt removal of leavers;
- managed, patched devices and a process for vulnerability and update decisions;
- restricted, approved and monitored remote or privileged access;
- protected backups of important information, with restoration checks;
- logging and alerting appropriate to the service’s risk;
- an incident plan with customer contacts, decision authority and reporting steps; and
- tested recovery arrangements for the service and its critical dependencies.
These are practical examples, not a universal mandated baseline. The contract, applicable regulation and customer risk assessment determine which controls and evidence are required.
5. Put responsibilities into contracts and daily operations
Security fails when two parties each assume the other is responsible. Write down:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- which party secures each system, account, connection and data set;
- who approves and reviews remote or privileged access;
- what information may be shared with subcontractors and how it is protected;
- how quickly each party must notify and update the other during an incident;
- who leads investigation, containment, recovery and customer communications;
- how material changes to personnel, locations, technology or suppliers are reported; and
- how evidence, audit requests and contract termination or transition are handled.
NCSC guidance calls for relevant security obligations in contracts, clear customer-supplier responsibility, effective management of connections and data sharing, and mutual incident support when appropriate.
6. Revisit the assessment when the service changes
Set review triggers rather than relying on an annual reminder alone. Reassess after a new contract, a material service or access change, a new subcontractor, a significant incident, a major technology migration or an update to customer requirements. NIST treats cybersecurity supply-chain risk management as a lifecycle activity integrated with procurement and contract management, not a questionnaire completed once and forgotten.
What evidence should a small supplier show?
Customers usually need confidence that stated practices operate in reality. Assemble an evidence folder or controlled portal with only the documents relevant to the contracted service. Typical evidence includes:
- the current service and dependency map;
- the requirement register and approved customer clarifications;
- access-control and joiner, mover and leaver procedures;
- device-management, vulnerability and patch records;
- backup schedules and restoration-test results;
- incident-response plan, contact list and exercise notes;
- subcontractor list, risk reviews and applicable flow-down clauses;
- network or remote-access diagrams and approval records;
- security-awareness or role-specific training records; and
- open-gap register showing owners, dates and compensating measures.
Do not send more sensitive information than the customer needs. Agree how evidence will be transferred, who may view it, how long it will be retained and whether redacted records are acceptable. A concise explanation of scope is often more useful than an undated policy copied from another environment.
How to complete a customer security questionnaire
- Identify the scope. Write the exact service, environment, data and access covered by your answers.
- Match each question to evidence. Link the answer to a policy, ticket, configuration record, test result or responsible person.
- Answer capability and operation separately. If a procedure exists but is not yet operating consistently, say so and provide the remediation date.
- Explain inherited controls. Identify what a cloud or managed provider supplies, what you configure and what you monitor.
- Disclose material limitations. State excluded systems, subcontractor visibility limits, unsupported legacy components or planned changes.
- Obtain internal approval. The service owner should confirm technical scope and a manager should approve commitments, deadlines and representations.
- Track follow-up questions. Store customer answers with the questionnaire version so future renewals do not restart the same uncertainty.
A truthful “partially implemented” answer with an owner and date is safer than an unqualified “yes” that cannot be defended after an incident.
A lightweight operating model for limited capacity
You do not need a large compliance office to make the process repeatable. A small supplier can operate with five basic artifacts:
- one accountable owner and a backup contact;
- a living inventory of critical services, data, systems, access paths and subcontractors;
- a requirement-and-evidence register;
- a prioritized action list; and
- a calendar of contract, incident, supplier and technology review triggers.
Use free official resources before buying a tool. CISA’s small and medium-sized business handbook points organizations toward supply-chain risk resources and vendor-assessment questions. NIST provides quick-start material and recognizes that smaller organizations may use a risk function or shared support instead of creating a dedicated supply-chain risk-management office. NCSC says supplier requirements should be proportionate to risk and that customers should support suppliers with guidance, tools and processes.
If you need specialist help, an independent small-business cybersecurity adviser or managed security provider can help interpret a questionnaire, assess gaps or improve documentation. This is optional assistance, not a compliance guarantee. Check experience in your sector and with the customer’s specific requirements.
How to compare different customer requirements
When two customers use different frameworks or assurance requests, compare the requirements on the dimensions that change your workload and risk:
- Status: Is it a contract term, regulation, procurement rule or voluntary guidance?
- Scope: Which service, system, data set, facility and access path are included?
- Consequence: What disruption, safety, financial or privacy impact is being addressed?
- Evidence depth: Is a self-attestation enough, or is an independent assessment, test or audit required?
- Supply-chain reach: Must you identify and flow requirements to subcontractors and upstream tiers?
- Timing: How often must you report, renew evidence, notify incidents or disclose changes?
This comparison prevents a voluntary framework from being mistaken for a legal mandate and helps you reuse evidence without claiming that two customers have identical requirements.
Common mistakes that create avoidable risk
- Assuming one standard applies everywhere. US federal, UK and private-sector requirements have different authorities and scopes.
- Buying technology before understanding the service. Official guidance emphasizes risk assessment and lifecycle practices; it does not require every supplier to buy a particular firewall, security key, backup appliance or software package.
- Ignoring subcontractors. A supplier can remain exposed through a hosting, support, software or facilities provider. Check flow-down language and relevant tiers.
- Answering for the whole company when only one service is in scope. Define the boundary and disclose shared systems that could cross it.
- Keeping policies without operating records. Customers may ask for access reviews, restore tests, patch records or incident exercises, not just policy text.
- Letting the questionnaire become the program. A completed form does not replace dependency mapping, incident coordination or change review.
- Failing to update after a change. New access, a new subcontractor or a cloud migration can alter the risk even when the contract title stays the same.
US, UK and procurement boundaries
NIST and CISA materials are United States sources, while NCSC materials are from the United Kingdom. NCSC’s supplier-management practices can help a US supplier design proportionate controls, but they are not a statement of US law. Conversely, a UK supplier should confirm which UK regulatory or contractual provisions govern its service rather than assuming a US framework is sufficient.
The GSA rule cited in this guidance applies to GSA-funded contracts and orders regardless of estimated value. That specific procurement scope does not extend automatically to private contracts, non-GSA government work or every small supplier. Confirm the buying organization, funding route and contract clauses before relying on it.
A practical first month
Use this sequence to turn an incoming request into a manageable work plan:
- Week one: obtain the contract, security schedule, questionnaire, incident terms and subcontractor clauses; appoint the owner.
- Week two: map the service, data, access, facilities, systems and dependencies; mark the paths that could affect customer operations.
- Week three: assess the relevant NIST SP 1326 dimensions, compare the map with the customer’s questions and record evidence gaps.
- Week four: agree remediation owners and dates, document shared responsibilities, submit a scoped evidence package and schedule the next review trigger.
After that first cycle, the objective is maintenance: keep the map, register, evidence and action list synchronized with the service and contract.
What should a critical-infrastructure customer be able to learn from you?
A credible supplier response lets the customer answer five questions quickly:
- What exactly does this supplier provide?
- Which systems, data, people and subcontractors are involved?
- What access could affect the customer’s service?
- Which safeguards operate today, and what gaps have owners and dates?
- How will both parties detect, report, contain, recover from and learn from an incident or material change?
If your documentation answers those questions within the contract’s scope, uses evidence that matches your actual operations and is reviewed when circumstances change, you have a defensible foundation for meeting proportionate critical-infrastructure cybersecurity requirements without pretending that one checklist fits every supplier.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
