Proposed powers to restrict high-risk technology suppliers would make national security exposure, supplier concentration and exit planning part of buying decisions across critical sectors
The UK government wants the power to stop organisations responsible for essential services from buying technology from suppliers judged to pose a risk to national security.
Government amendments to the Cyber Security and Resilience Bill would allow ministers to restrict the use of a supplier’s products or services, prevent new installations and require existing technology to be removed, disabled or modified. The Financial Times reported that the proposals could affect organisations across energy, healthcare, telecommunications and other critical sectors.
The measures remain subject to parliamentary approval. If passed, they would give the government a direct role in technology procurement where supplier risk could affect national security.
The amendments to the bill tabled in the House of Lords would also allow ministers to create a mandatory referral scheme. Certain planned purchases could then require government clearance, depending on factors such as the value of the transaction, its importance to an essential service or the identity of the supplier.
These powers build on the wider Cyber Security and Resilience Bill, which is intended to strengthen the security of essential services and bring managed service providers, data centres and designated critical suppliers under greater regulatory oversight.
The government’s policy statement on the bill found that fewer than one in ten operators of essential services felt confident managing risks across their wider supply chains. It proposed stronger contractual requirements, security checks and continuity plans for suppliers whose failure could disrupt critical services.
Supplier risk before contract signature
The proposed veto would add a national security dimension to procurement decisions that have traditionally focused on price, performance, technical security and regulatory compliance.
Technology buyers may need to consider a supplier’s ownership, legal jurisdiction, subcontractors, remote access arrangements and exposure to foreign government influence. The ability to replace the supplier could carry as much weight as the initial security assessment.
A vendor may meet an organisation’s technical requirements and still become subject to restrictions if intelligence later reveals a wider threat. Procurement teams will therefore need to understand where products are installed, which services depend on them and how quickly an alternative could be introduced.
The referral process could also affect purchasing timelines. Organisations planning significant technology projects may need to allow time for government scrutiny before contracts are signed or systems are deployed. Discovering a problem after implementation would leave fewer options and increase the cost of changing course.
Contracts need an exit route
Some technology can be replaced with limited disruption. Core network equipment, operational technology and specialist systems may take months or years to remove safely.
Contracts for critical systems should explain how the supplier will support a transition, provide access to data and technical documentation, and assist with the secure removal of its products. They should also address changes in company ownership, the use of important subcontractors and any development that could alter the supplier’s risk profile.
Organisations also need an accurate record of where a supplier’s technology is used. Without this, responding to a government direction could become a lengthy search across business units, sites and contractors.
Supplier concentration creates another difficulty. Moving away from one vendor offers little protection if every realistic alternative depends on the same components, infrastructure or jurisdiction. Procurement decisions should account for these shared dependencies and the availability of credible substitutes
The commercial consequences could be substantial. A direction to phase out a supplier may result in abandoned equipment, delayed projects and unplanned migration costs. Building replacement options into the original design can reduce that exposure.
Procurement becomes part of national resilience
The proposed powers include safeguards. Ministers would have to consider a necessary and proportionate direction, consult affected organisations where practical and provide a reasonable period for compliance.
Some decisions may remain confidential. The amendments would allow the government to withhold reasons, limit consultation or prevent an organisation from disclosing a direction where national security requires it. Companies may therefore have to change suppliers without being able to give customers, employees or investors a full public explanation.
Managing that situation will require close co-ordination between procurement, legal, security and operational teams. Boards will need evidence showing which services depend on each strategic supplier, the consequences of removal and the available alternatives.
The supplier veto moves cyber-security assessment towards the beginning of the purchasing process. For organisations supporting essential services, the choice of vendor is becoming a decision about operational and national resilience.
