Illustrative stock imagery from Pexels. Images do not identify the people, premises or events discussed and do not imply endorsement.
Reviewed 26 October 2026. Original publication date retained: 2025-04-23.
A supplier working with sensitive contractual information needs to understand the assurance its customer requires. ISO certification should not be assumed to replace a specific defence, contractual or regulatory assurance scheme.
Questions to follow in an audit
- What security requirements are stated in the actual contract?
- Which subcontractors can access the information in scope?
- How are changes to access or customer requirements controlled?
Connect the records with practice
Sample a customer requirement and trace it through supplier responsibilities, access approvals, operating records and review.
These are illustrative audit trails, not findings about a named organisation, technical instructions or a guarantee of a particular result. The appropriate evidence depends on the activities, risks and agreed scope. The organisation remains responsible for its operations and legal obligations.
AAA provides independent certification audits. Confirm the applicable standard edition, scope and customer requirements before agreeing a programme. Request an indicative price or discuss your proposed audit.
Further reading: ISO information security.