---
id: KB-LE-025
url: https://app.codecontract.io/help/legal/passing-the-requirement-down-the-chain
idioma: en
categoria: sector-legal
subcategoria: tic
audiencia: usuario
nivel: avanzado
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-LE-024, KB-LE-003]
citadoPor: [KB-LE-026]
---

# Passing the requirement down the chain

_Your client makes demands of you and you depend on four suppliers who have never heard of them. You are what holds the chain up._

**Responde a:** passing client requirements to my suppliers · sub-processors and documentation · my supplier does not meet what is asked of me · controlling the supplier chain

You signed with a demanding client, and inside that signature are commitments that **do not depend on you but on the people you buy from**: whoever hosts the data, whoever performs part of the service, whoever sends the technicians. Yours is the position holding the chain up, and it is also the only one that can be chased from both sides at once.

## The sum that does not add up on its own

| What is required of you | Who it depends on | Who answers |
| --- | --- | --- |
| How you handle the information | You | You |
| Where it is hosted | Your supplier | You |
| Who may access it | Both | You |
| **What your supplier's supplier does** | **Nobody you know** | **You** |

> [!IMPORTANT]
> **The rule that avoids 90% of this position's problems is requiring downwards at least what is required of you — and doing it when you contract, not when you are asked.** What is not in your contract with the supplier you will not obtain later: at that point you are a client asking a favour, and the favour has a price or a polite refusal.

## What to hold for each supplier touching the client's work

1. **What you required of them, in writing** — And checking it covers what was required of you.
2. **What they have provided and when** — With dates, because what expires here expires upwards.
3. **Who they subcontract to** — Asking at contracting is normal; asking afterwards is an incident.
4. **And what happens if something changes** — A supplier that moves premises or owners affects you before they tell you.

> [!WARNING]
> The moment this position hurts is **a client audit that goes one level deeper**. They no longer ask what you do: they ask about your suppliers, by name. If that question is met with a list and current documents, it is a formality. If it is met with «I would have to ask», the finding is no longer about the supplier: it is about you, because what has been demonstrated is that you did not know.

> [!NOTE]
> What duties you carry over your suppliers depending on the service and the information, what must be agreed contractually and what regime applies to each link **is settled by your adviser**, and varies greatly between sectors and countries. Here we cover the organisational part: how to ask for it, how to keep it current and how to answer for the whole chain without phoning anyone.

**Must I require of my supplier what is required of me?**

It is what closes the gap. How it is framed is for your adviser.

**What if my supplier is far larger than me?**

It happens often, and then the leverage is choosing well at contracting.

**How often should this be reviewed?**

Better than reviewing: be told when something falls due. Reviewing stops happening.

## Ejemplos

**The client audits and asks about your suppliers by name.**

- Keeps a file per supplier with their documentation

→ You answer with a list instead of an enquiry.

**A supplier's document expires and affects what you promised.**

- Warns about third-party expiries as it does your own

→ The gap closes before the question arrives.

**Nobody knows who your supplier subcontracts to.**

- Records the chain declared by each supplier

→ The chain is known before it is asked about.

**What was required of the supplier was agreed verbally.**

- Keeps what was agreed alongside the supplier's file

→ What is enforceable is demonstrable.

**Each department contracts suppliers on its own.**

- Gathers supplier files in a single place

→ There is one picture of the chain, not four.

**Chasing suppliers for documentation is done by hand.**

- Requests and chases automatically

→ The chain stays current without dedicating a person.