Security requirements on suppliers and subcontractors: what to do in the first review cycle comes down to three steps, reading the clause as it is worded, mapping it against what the supplier can evidence today, and treating any shortfall as a risk the client owns until it closes. That is the working position under Swedish law as it currently stands.
Who this concerns
This falls on both sides of a contract chain: the buyer imposing a security schedule and the supplier or subcontractor asked to sign up to it. On the buyer side it usually sits with procurement, IT security or a compliance function inside the wider compliance, sanctions and cyber practice, because the clause is rarely drafted in isolation from sanctions screening and data protection obligations already running through the same contract. On the supplier side, the question lands with whoever has to sign the schedule and then actually operate it, which is frequently a smaller team than the clause assumes.
The position changes once the supplier chain crosses a border. A Swedish buyer contracting with a supplier based outside Sweden, or a Swedish supplier subcontracting work to a foreign entity, cannot simply flow the same clause down unchanged: local data residency rules, a foreign parent's own security policy, and a subcontractor's inability to be audited on the same terms as a domestic one all narrow what can actually be enforced. Where the ultimate subcontractor sits outside the EU, the security schedule and the underlying data transfer basis have to be checked together, not separately, before either party signs anything.
This also concerns anyone inheriting a supplier relationship through an acquisition or a renewed framework agreement, where the security schedule was negotiated years before the current operational reality and nobody has gone back to check whether it still matches what either side actually does today.
What the law says
Under Swedish law as it currently stands, a business that outsources part of its operations does not outsource the underlying regulatory responsibility for the outcome. Where personal data, critical infrastructure, or a regulated financial process is involved, the buyer remains answerable to its own regulator or counterparty for what happens inside the supplier's systems, regardless of how the contract allocates blame internally between the parties. This is why security schedules exist in the first place: they are the mechanism by which a buyer tries to push its own compliance burden down the chain, not a courtesy clause added for reassurance.
The obligation does not stop at the first-tier supplier. Where a contract requires the supplier to flow the same security terms down to its own subcontractors, that flow-down has to be evidenced, not assumed. A supplier that has signed a strict schedule but never actually imposed equivalent terms on the subcontractor doing the real work has created a gap that sits with whoever signed first, until the contract says otherwise in clear terms.
Regulated sectors, such as financial services, energy and other critical infrastructure, carry layered obligations on top of this general position, which is why a security schedule in those sectors is rarely treated as a standalone data protection annex. No case-specific figure or named provision changes the analysis on the facts available here; the position above is the general rule and applies unless a specific sector scheme displaces it.
How it works in practice
Reading the clause as it is actually worded
The first step is not a security audit, it is a close read of the schedule itself. Security clauses are drafted at different levels of specificity: some name a certification standard outright, others describe an outcome, such as appropriate technical and organisational measures, and leave the supplier to work out what that means. The two require different first moves. A named-standard clause is checked against a certificate; an outcome clause requires a written position on what "appropriate" means for this specific contract, because there is no external document to point to.
Mapping the clause against what the supplier can evidence today
Once the clause is understood, the next step is comparing it, line by line, against what the supplier can actually produce on request: a current certificate, a penetration test report, an access control policy, a subcontractor register. The gap between what the clause requires and what exists in writing is the real risk position, not the gap between the clause and what the supplier believes it does informally.
Treating the gap as an interim risk, not a compliance failure
A gap identified during a review is not automatically a breach. Most schedules contemplate a remediation period. The practical position is to document the gap, propose a closure date, and get the buyer's acknowledgement of that date in writing before the next audit point arrives. An undocumented gap looks identical to an ignored one from the outside, and is treated that way if an incident happens first.
Extending the requirement down the subcontractor chain
Where the contract requires flow-down, the supplier has to be able to show that the same or equivalent terms sit in its own subcontractor agreements. This is frequently the weakest point in the whole chain: the head contract is carefully negotiated, the subcontract underneath it is a template that was never updated to match.
Where the foreign element changes the sequence
A subcontractor operating outside Sweden or the EU changes both what can be checked and how. On-site audit rights that are standard for a domestic subcontractor may be commercially or practically unavailable abroad; the fallback is usually a combination of a written attestation, a right to request evidence on demand, and a data transfer mechanism that stands independently of the security clause itself. None of these substitutes is equivalent to a domestic on-site audit, and a buyer that treats them as such has not closed the gap, only documented around it.
Setting a review cadence that survives staff turnover
A security schedule that depends on one person remembering to ask for updated evidence each year does not survive that person changing job. The practical fix is tying the review date to a calendar event that exists independently of any individual, such as contract renewal or annual audit, and recording the review outcome in the contract file itself rather than in an inbox.
What to check before responding to a client audit letter
- Whether the clause names a specific standard or only an outcome
- Whether the supplier's current certificate, if any, actually covers the systems used for this contract, not just the supplier generally
- Whether flow-down language exists in the contract and whether it has actually been implemented in the subcontract
- Whether any incident notification deadline in the schedule is shorter than the supplier's internal escalation process can meet
- Whether the data involved crosses a border at any point in the processing chain
- Whether a remediation period, where a gap exists, has been agreed in writing or only discussed informally
What delays a background check on a new supplier or subcontractor before onboarding?
Registration checks against the companies register are usually the fastest part; delay tends to come from incomplete beneficial ownership disclosure or from a subcontractor operating through a holding structure that has not been fully mapped. The practical fix is to request the ownership chart before, not after, the security schedule is signed. A fuller walk-through of registration timing sits in what delays registration at the companies office.
Who decides whether a payment or benefit to a subcontractor's staff counts as an improper benefit?
The classification is not made by either party's internal policy; it depends on the purpose and proportionality of the benefit against the specific decision it is connected to, assessed after the fact by whoever is investigating. This distinction matters directly in supplier relationships where hospitality or facilitation payments are common. It is covered in more detail in who decides what counts as an improper benefit.
What does due diligence actually mean when vetting a supplier under a security schedule?
It means a documented, repeatable check against defined criteria, not a one-off conversation with the supplier's account manager. The term is used loosely enough in commercial practice that it is worth pinning down before it appears in a contract; the working definition is set out in the due diligence glossary entry.
The numbers
No figure in this material is asserted as a fixed benchmark, because none is available from the current registry for this position. What does scale predictably is the number of tiers the requirement has to pass through: a two-tier supply chain requires one flow-down check, a four-tier chain requires three, and each additional tier roughly doubles the time needed to get written confirmation back from everyone in the chain, because each tier is waiting on the one below it.
The same logic applies to cost. It is not driven by a fixed fee for a security review; it is driven by how many gaps exist between the clause and the evidence, how many subcontractor tiers have to be individually checked, and whether a foreign element requires a separate assessment of the data transfer basis on top of the security review itself. A single-tier domestic supplier with a current certificate costs materially less to review than a four-tier chain with an offshore final subcontractor and no flow-down documentation on file.
Where it usually goes wrong
The most common failure is treating the security schedule as satisfied once a certificate exists, without checking that the certificate's scope actually covers the systems processing this particular contract's data. A certificate scoped to a different business unit or a different data centre than the one doing the work is not evidence of compliance with this contract, whatever it says about the supplier generally.
The second failure sits at the subcontractor layer: a buyer that never asked whether flow-down happened, and a supplier that never checked either, until an incident forces the question. By the time an incident happens, there is no time left to negotiate flow-down terms; the only question left is who bears the loss.
The rule also runs the other way in a narrow set of cases. Where the supplier is small enough, and the contract value low enough, that a full certification requirement is disproportionate to the risk, insisting on the same standard used for a critical infrastructure supplier is not a stronger position, it is a negotiating error that either kills a viable relationship or produces paperwork nobody actually checks. Proportionality is not a defence a buyer gets to invoke after the fact; it has to be built into the clause at drafting stage.
A further exception applies to incidents that originate genuinely outside the contracted scope, for instance a subcontractor's staff member acting entirely outside their authorised access. Where the security schedule was properly implemented and the incident happened despite it, liability analysis shifts toward causation and foreseeability rather than toward whether the schedule existed on paper. This is also where a data protection regulator's own inspection process becomes relevant if personal data was involved; how that inspection actually runs, and where its powers stop, is set out separately in how a data protection inspection runs and where it stops.
What to do next
The work described above, reading the clause, mapping it against evidence, checking flow-down, is something a procurement or compliance team can do without outside help, provided nobody has yet raised a formal non-conformance notice. Where the self-service work stops is the point where the clause has to be tested against a specific supplier's actual technical and contractual record, and a defensible position has to be written down before a client or regulator asks for one. That comparison, and the report it produces, is what the compliance, sanctions and cyber team delivers as a fixed-scope engagement.
If an audit letter or a notice of non-conformance has already landed, the sequencing above changes: book an assessment call before drafting a response, not after.