> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/agile-delivery-playbook/operating-controls/supplier-and-subcontractor-alignment.md).

# Supplier and Subcontractor Alignment

### Overview

Suppliers and subcontractors can support delivery, but they must operate inside the same agile, commercial, IP and security controls as the core team.

### Supplier Engagement Principles

* Use suppliers only where there is a clear need.
* Define supplier scope clearly.
* Flow down relevant customer obligations.
* Protect customer and company information.
* Confirm IP ownership and licensing.
* Confirm security and access requirements.
* Track supplier work in the delivery governance model.
* Do not allow supplier work to become invisible.

### Supplier Onboarding

Before a supplier starts work, confirm:

* signed agreement or work order
* scope and deliverables
* acceptance criteria
* reporting cadence
* security obligations
* confidentiality obligations
* IP position
* access approvals
* tools and repositories
* escalation route
* customer restrictions

### Supplier Backlog Integration

Supplier work should be visible in the backlog or dependency log.

For each supplier item, record:

* owner
* deliverable
* due date
* dependency
* acceptance criteria
* status
* risks
* evidence required

### Supplier Governance

Supplier governance should include:

* regular status review
* risk and issue review
* deliverable review
* evidence review
* security review where relevant
* change review

### Flow-Down Requirements

Supplier obligations may need to include:

* confidentiality
* data protection
* security controls
* audit support
* IP assignment or licence
* open-source restrictions
* customer policy compliance
* incident notification
* personnel requirements
* insurance requirements
* acceptance and remediation obligations

### Supplier Risks

Common supplier risks include:

* late delivery
* unclear acceptance criteria
* poor quality
* weak documentation
* access delays
* security non-compliance
* IP uncertainty
* dependency on a single specialist
* lack of customer environment knowledge

### Supplier Exit

When supplier involvement ends, confirm:

* deliverables accepted
* documentation received
* access removed
* customer data returned or deleted
* IP position recorded
* open defects assigned
* final invoice evidence complete
* lessons learned captured