“Please describe how subcontractor access to project information is controlled.”
It is a reasonable customer question. Answering it may involve the project manager, IT and an outside provider, while the person completing the assurance return has to bring their responses together.
A current policy helps explain the intended process. To describe what happens in practice, you need to know which systems the answer covers, who operates the controls and what evidence supports the statement.
That is a coordination task. You do not need to become a Microsoft administrator to do it well. You need a clear request, a responsible technical owner and an answer whose limits are understood.
Give the question a boundary
Before collecting documents, establish what the customer is asking about. Is the question about access your company grants to subcontractors? Your employees’ access to a client system? Personal information? A particular project, or the business as a whole?
Those answers can lead to different evidence. A company-wide policy alone may not establish how one client-managed application works. Equally, a screenshot from one project does not demonstrate the position across the whole business.
Record the exact request, the organisation or project it concerns and the date of the response. If the wording is unclear, clarify it with the customer rather than quietly extending the claim.
Send IT a request they can answer
Asking “Are we compliant?” leaves too much unspecified. Give the technical owner the actual question and ask for the information needed to support a proportionate answer.
You can adapt this request:
We need to answer the attached customer question about subcontractor access to project information. Please confirm the systems and user groups your answer covers, who approves access and how changes or departures reach the person who can act. Please link to a recent, appropriately redacted example showing the process being carried out. Include any exceptions, outside owners or limitations we should mention. Please identify who can review the final wording for technical accuracy.
Use your normal secure channel for the response. Avoid emailing credentials, unredacted personal records or sensitive configuration details simply to demonstrate that evidence exists.
Keep the answer and its evidence together
An evidence register does not need to reproduce every technical log. It needs enough information to locate the underlying record and show who checked it.
| Register field | What belongs there |
|---|---|
| Customer question | The actual wording and the requested scope |
| Proposed answer | The statement you intend to submit |
| Systems and users | The applications, organisations and access types covered |
| Control owner | The person responsible for operating or confirming the control |
| Supporting record | A secure reference to policy and relevant implementation evidence |
| Date checked | When the owner confirmed the information |
| Exceptions | Anything outside the statement, pending or qualified |
| Approval and review | Technical reviewer, response approver and next review trigger |
A review trigger might be a change of provider, a new project application or a material change to the access arrangement. A calendar review still helps, but a statement should also be revisited when the facts behind it change.
An example of a supportable answer
The following is an illustrative construction scenario, not an account of an Assured Digital customer.
A specialist contractor uses a company-managed project folder and a portal controlled by its principal contractor. The customer asks how access is withdrawn when a subcontractor finishes.
The internal team can demonstrate the request and change to its own folder permissions. The portal administrator belongs to the principal contractor, so the evidence for that part is a request and the administrator’s confirmation. The final answer distinguishes the two responsibilities.
A draft could read:
For the systems in scope, the project manager confirms when access is no longer required. Our IT team changes the permissions it administers. Client-managed portal changes are requested from the client’s nominated administrator, and the project owner records confirmation or follows up outstanding requests. Supporting records and any exceptions are retained against the project handover.
Use that wording only where it describes the actual arrangement. If client confirmations are not collected, record that as a gap to resolve rather than submitting a statement that says they are.
An access record you can check against
This record is wholly illustrative. The project, references and events are examples, not real customer or CRM data.
| Field | Illustrative entry |
|---|---|
| Person and work | External specialist A, Project A work package |
| Company-controlled access | Read access to the named project folder |
| Approval | Project manager approval, request AR-017 |
| Account and control owner | Guest access; internal IT administers the folder permissions |
| Review | Project owner confirms access is still needed at the agreed checkpoint |
| End event | Project owner confirms the package of work is complete |
| Internal withdrawal | IT confirms removal of the relevant folder permissions, record IT-042 |
| Client portal | Separate request CR-009 awaits the client administrator’s confirmation |
| Overall status | Internal action completed; client action pending, with a named follow-up owner |
The final row matters. Evidence of your own action does not confirm a different organisation’s action. Keep the outstanding item visible and describe it accurately in any response.
Check certification scope before treating a certificate as the whole answer
Cyber Essentials v3.3 distinguishes employee-owned devices used for organisational work from devices owned by third-party contractors. The latter are outside the device assessment scope, while accounts your organisation provides to third parties remain in scope. Organisation-owned equipment loaned out is a different case. Employee phones used only for native calls, texts or MFA have a specific exception.
Those distinctions affect how you describe the arrangement. Being outside the device assessment does not make the access risk disappear. Confirm your particular scope with your certification body. NCSC requirements.
Keep the certificate’s legal entity, scope and validity alongside the response. For an already certified business, the useful exercise may be checking that the customer’s question matches the certified scope and the current operation.
A timely Common Assessment Standard check
Build UK’s Common Assessment Standard includes information security. In version 5, question 161 provides an exemption from questions 163–169 for valid Cyber Essentials Plus or qualifying ISO 27001 certification. The guide specifies accreditation conditions for the ISO certificate; basic Cyber Essentials is not the listed exemption. Check applicability with your assessment body before preparing additional evidence. Build UK guide.
Build UK says version 6 will be published on 1 November 2026. Review the published version when available and confirm which question set applies to your assessment. The publication date is not a universal deadline for contractors. Publication notice.
Customer-specific questions may still need a response even where an assessment exemption applies. Keep the source of the requirement clear: customer questionnaire, assessment standard, contractual term or internal policy. They are not interchangeable.
Keep supplier requirements proportionate
The NCSC’s supply-chain playbook recommends profiling suppliers by risk when developing Cyber Essentials requirements. Use the actual relationship and information involved to decide what assurance to request; a certificate or a long questionnaire alone does not explain how a particular access arrangement works. NCSC supply-chain playbook.
For an occasional external specialist, a clear record of approved access and its end date may be especially useful. For a supplier administering your systems, you will need to understand the responsibilities and evidence appropriate to that much greater access. Agree the requirement with the people who own the risk.
Check one answer before the next return
Choose a security response you already use. Find the technical owner, the evidence reference and the scope it covers. Check whether the systems or suppliers have changed since it was approved. Then ask whether a colleague could find the same evidence without starting the search again.
That exercise may confirm the answer is sound. It may reveal a missing confirmation or a statement that needs narrowing. Either is more useful than collecting another policy without knowing what it establishes.