Personnel and Third-Party/Supplier Security
Personnel and Third-Party Security covers the people you hire and the organisations you depend on. The exam tests proportionate due diligence, contractual flow-down, and the discipline of ongoing rather than one-off checks.
Personnel security lifecycle
- Pre-employment: verify identity and right to work, employment history and references; criminal record checks where lawful; driving record and licence for drivers; drug testing per policy; port credentials where required, such as a TWIC for unescorted US port access.
- Legal discipline: in the US, the Fair Credit Reporting Act requires disclosure, authorisation and a pre-adverse action notice with a copy of the report before adverse action. In the EU and UK, data protection and equality law constrain what may be checked and how long it is retained.
- Onboarding: code of conduct, confidentiality agreement, security awareness training, badge issue, asset register.
- In service: refresher training, re-screening at defined intervals or on role change, review of access appropriateness.
- Leaving: a termination checklist - badge, keys, uniform, devices, system accounts, vehicle telematics, and notification to site security.
Third-party and supplier security
- Tier suppliers by criticality and by the access they receive: systems, sites, data, cargo.
- Pre-contract: security questionnaire, certificates, sanctions and adverse media screening, financial stability, insurance, site visit for critical suppliers.
- Contract: required standards, subcontractor approval and flow-down, incident notification windows, right to audit, KPI and remediation clauses, termination rights.
- Ongoing: performance reviews, audits, corrective action tracking, and mapping of fourth parties for concentration and single-point risk.
- Personnel changes at a supplier - new dispatcher, new ownership - are risk events worth recording.
Worked example
Two 3PLs bid for a high-value account. One is 12% cheaper than the incumbent but has no site certification, uses agency labour for picking and subcontracts linehaul. Reasoning: the saving is smaller than the modelled loss exposure and switching cost. Weighted scoring on security capability, subcontractor transparency and audit access selects the other bid despite a higher rate.
Traps
Onboarding as a one-time gate; assuming a contractual indemnity gives operational control; never mapping fourth parties; accepting certificates at face value; and screening practices that breach privacy or equality law.