Supplier security is usually assessed once, at onboarding, then filed. The NCSC's twelve principles run as a loop instead: understand the risks, establish control, check the arrangements, keep improving. Checking is the stage that dies first. Contracts hold requirements nobody revisits. Per the 2025 Security Breaches Survey, very few UK businesses set minimum security standards for their suppliers at all. Onboarding evidence says how a supplier looked on one day; the loop exists because suppliers change. https://www.ncsc.gov.uk/collection/supply-chain-security #CyberSecurity #InfoSec #SupplyChain #RiskManagement