2026
Practitioner Reference
Cloud Controls Matrix and CAIQ v4.1
CCM v4.1 contains 207 controls across 17 domains.
Cloud Security Alliance, 4.1
- Enterprise Assurance
- Security & Supply Chain
Evidence note
Supplier Assurance Questions
Government Guidance2026UK National Cyber Security Centre
What does it cover?
UK government guidance describing areas organisations may examine when assessing suppliers and their technical/security posture.
Key points
- 1Supplier assurance can include governance, incident recovery, cloud configuration, privileged access, bespoke software security, data handling, testing and certification.
- 2Buyers are encouraged to consider whether certification scope actually covers the service they use.
- 3Supplier risk may need to be reconsidered as technology, data and operating conditions change.
Why it matters. Lornets interpretation.
Enterprise scrutiny is fundamentally about whether technical claims relevant to the customer can be substantiated by evidence that is current and in scope.
This is the Lornets reading of the source, not a finding of the source itself.
What it does not establish
- 1The questions are guidance rather than one mandatory universal procurement checklist.
- 2Different buyers and sectors may require materially different evidence.
- 3NCSC guidance does not mean every enterprise customer will request every listed assurance area.
Source
- Organisation
- UK National Cyber Security Centre
- Evidence type
- Government Guidance
- Published
- 2026
- Status
- Current
Relevant Lornets framework areas
Framework domains
- Security & Access Control
- Reliability & Recoverability
- Data & Privacy Engineering
- Observability & Operations
- Delivery & Change Control
Where this applies
Related evidence
Last verified 2026-08-11
2022
Technical Standard
ISO/IEC 27001:2022
ISO/IEC 27001 addresses organisational information-security management.
ISO / IEC, 2022 edition, with Amendment 1:2024 applicable
- Enterprise Assurance
- Security & Supply Chain
2026
Government Guidance
Software Security Code of Practice: Assurance Principles and Claims
The guidance uses assurance claims rather than treating high-level principles as self-evident.
UK National Cyber Security Centre
- Security & Supply Chain
- Enterprise Assurance