The Enforceable Firewall: Contracting for Cyber Resilience in Public Services

Public bodies rarely procure cyber security as a standalone product. They procure case management systems, cloud platforms, payment services, contact centres and hosted applications. Each arrangement imports supplier systems into the delivery of public functions. The practical consequence is that the security posture of a council, NHS body or central department is increasingly the security posture of its supply chain. Yet cyber resilience is often recorded in tender responses, policy statements or service descriptions rather than in enforceable obligations. When an incident occurs, the authority may discover that it has bought assurances, not duties.

As of November 2026, that gap is difficult to defend. Regulators, auditors and service users expect public bodies to evidence control over their delivery chain. The contract is the instrument that converts expectation into obligation.

From assurance to obligation

A security schedule should be a binding part of the contract, not an appendix of aspirations. It should define the required security outcomes, the standards to be met and the evidence the supplier must provide. References to frameworks such as ISO/IEC 27001:2022, Cyber Essentials Plus or NCSC guidance should be precise, version-controlled and accompanied by a change mechanism. A clause that requires the supplier to maintain accreditation at a stated level is stronger than one that requires it to have regard to good practice. Where the authority needs a specific control, it should say so: encryption at rest and in transit, multi-factor authentication, privileged access management, logging and retention, secure development and patching timescales.

Avoid relying solely on best or reasonable endeavours. Those formulations have their place, but they are poor substitutes for measurable requirements. Pair outcome obligations with process obligations: the supplier must comply with the security schedule, report against it and remedy deficiencies within agreed timescales.

Minimum standards that can be measured

The schedule should set a baseline for every supplier and enhanced requirements for higher-risk services. A baseline might include Cyber Essentials Plus certification, annual penetration testing, vulnerability remediation targets, security awareness training and a named security contact. Enhanced requirements might include ISO/IEC 27001 certification, independent assurance reports, data localisation or access controls, and supplier participation in the authority’s incident exercises.

Subcontracting needs explicit treatment. Security duties should flow down to subprocessors and subcontractors, with the supplier remaining accountable to the authority. The authority should know which material subcontractors are used, where data is held and who can access it. Changes to those arrangements should require notice or approval, particularly for critical services.

Incident notification: speed, content and control

Incident notification clauses are often too vague to operate under pressure. The contract should define a security incident, distinguish it from a personal data breach under UK GDPR, and set out notification routes and timescales. For high-risk services, require notification without undue delay and in any event within 24 hours of the supplier becoming aware. For lower-risk services, a longer period may be proportionate, but it should still be defined.

Notification should trigger an initial report covering what is known, affected services and data, containment steps and the supplier’s point of contact. The supplier should provide regular updates, a root cause analysis and a remediation plan. The authority will also need cooperation with its own regulators, affected service users and communications team. A clause that allows the supplier to notify a regulator or affected individuals without the authority’s involvement is unlikely to be acceptable where the authority is the controller or the public-facing body.

Audit, testing and evidence

Audit rights should be proportionate but real. For critical services, the authority should be able to inspect relevant records, systems and facilities, or commission an independent audit, particularly after an incident or a failed assurance report. For lower-risk services, annual assurance reports and summaries of penetration test results may suffice. The contract should require remediation plans and evidence of completion, not merely a right to ask questions.

Confidentiality and security of audit activity must be addressed. The supplier may need to protect other customers’ information, but that should not become a reason to withhold evidence of the authority’s own risks.

Liability, insurance and termination

Cyber liability is frequently the point at which security promises become theoretical. A general cap may be exhausted by service credits or other claims. Consider a separate cyber liability sub-limit, clear carve-outs for confidentiality and data protection breaches, and insurance requirements that match the risk. Indemnities should be drafted with care and tested against the authority’s statutory position and the supplier’s insurance arrangements. Costs of forensic investigation, notification and remediation should be allocated expressly.

Termination triggers should be calibrated to the seriousness of the failure. A material breach with a cure period may be appropriate for remediable control failures. Persistent failure to meet security requirements, a serious incident caused by supplier negligence, or loss of a required certification may justify suspension or termination. Exit assistance, data return and deletion, and continued cooperation during transition should be built in from the outset.

Calibrating to the risk profile

No single security clause fits every contract. Authorities should classify services by data sensitivity, service criticality and supplier access. A low-risk advisory service may need baseline certification and annual assurance. A critical platform holding special category data may need enhanced standards, 24-hour notification, audit rights, higher liability limits and step-in rights. Record the rationale for the classification and review it when the service, data or supply chain changes.

The contract is not a substitute for good security practice. It is the mechanism by which the authority can require, evidence and enforce it. In an environment where public services depend on supplier systems, that mechanism deserves the same attention as price, performance and payment terms.