Supplier and Subcontractor Alignment

Overview

Suppliers and subcontractors can support delivery, but they must operate inside the same agile, commercial, IP and security controls as the core team.

Supplier Engagement Principles

• Use suppliers only where there is a clear need.

• Define supplier scope clearly.

• Flow down relevant customer obligations.

• Protect customer and company information.

• Confirm IP ownership and licensing.

• Confirm security and access requirements.

• Track supplier work in the delivery governance model.

• Do not allow supplier work to become invisible.

Supplier Onboarding

Before a supplier starts work, confirm:

• signed agreement or work order

• scope and deliverables

• acceptance criteria

• reporting cadence

• security obligations

• confidentiality obligations

• IP position

• access approvals

• tools and repositories

• escalation route

• customer restrictions

Supplier Backlog Integration

Supplier work should be visible in the backlog or dependency log.

For each supplier item, record:

• owner

• deliverable

• due date

• dependency

• acceptance criteria

• status

• risks

• evidence required

Supplier Governance

Supplier governance should include:

• regular status review

• risk and issue review

• deliverable review

• evidence review

• security review where relevant

• change review

Flow-Down Requirements

Supplier obligations may need to include:

• confidentiality

• data protection

• security controls

• audit support

• IP assignment or licence

• open-source restrictions

• customer policy compliance

• incident notification

• personnel requirements

• insurance requirements

• acceptance and remediation obligations

Supplier Risks

Common supplier risks include:

• late delivery

• unclear acceptance criteria

• poor quality

• weak documentation

• access delays

• security non-compliance

• IP uncertainty

• dependency on a single specialist

• lack of customer environment knowledge

Supplier Exit

When supplier involvement ends, confirm:

• deliverables accepted

• documentation received

• access removed

• customer data returned or deleted

• IP position recorded

• open defects assigned

• final invoice evidence complete

• lessons learned captured