Yes. A buyer should know every legal entity and individual category that may access systems, credentials, source material or vulnerability evidence before access is granted. The prime vendor may remain accountable, but accountability is not a substitute for visibility and approval.
Penetration testing creates privileged access and highly sensitive artefacts. Undisclosed freelancers, affiliates or specialist partners can change confidentiality, jurisdiction, competence, conflict and incident-response assumptions that formed the award decision.
Define subcontracting broadly
Cover affiliates, group companies, freelancers, independent consultants, platform partners and temporary specialists—not only firms labelled subcontractors. If someone outside the contracted legal entity performs testing or handles evidence, the buyer needs visibility.
Distinguish ordinary software suppliers with no data access from delivery participants. The disclosure should follow actual access and responsibility rather than procurement labels.
- Legal employer of each delivery role.
- Entities receiving credentials or evidence.
- Remote specialists and overflow teams.
- Report writers and quality reviewers outside the prime.
Require disclosure before access
Place the obligation in the RFP, SOW and contract so the vendor cannot treat names or entities as a post-award surprise. Set a deadline early enough for due diligence and access provisioning.
No subcontractor should receive credentials, environment details or raw findings while approval is pending. Commercial urgency does not replace the access gate.
- Entity and beneficial ownership where required.
- Named personnel or defined role pool.
- Country and work location.
- Planned access and engagement dates.
Ask why the subcontractor is needed
The provider should state whether the party supplies mobile, cloud, protocol, language or domain expertise; regional capacity; independent review; or general labour. This lets the buyer judge whether the arrangement strengthens capability or masks missing core competence.
Compare the explanation with the evaluated team. Material outsourcing after selection may change the basis on which technical scores and price were accepted.
- Specialist capability and deliverable.
- Percentage or workstream delegated.
- Supervision and decision authority.
- Reason the prime cannot perform directly.
Validate competence and role fit
Review relevant experience and scenario evidence for the work actually assigned. A specialist’s certification or résumé is supporting context, not proof that the person can execute safely in this architecture.
Confirm who performs hands-on testing, who reviews findings and who can communicate critical issues. Do not let a named senior expert become a ceremonial reviewer while unknown staff perform the sensitive work.
- Technology and platform experience.
- Production-safety judgement.
- Evidence and reporting capability.
- Availability for evaluation and readout.
Repeat conflict and independence checks
Subcontractors can introduce recent employment, product alliances, remediation interests or customer relationships not present in the prime provider. Require the same conflict declaration applied to the selected team.
Where a conflict is accepted, document a specific safeguard and independent reporting route. If no safeguard reduces the threat adequately, replace the person or provider.
- Prior work on the target or control.
- Financial or personal relationships.
- Product reseller or implementation role.
- Concurrent work for affected parties.
Flow down every relevant obligation
The prime contract should require equivalent confidentiality, acceptable use, evidence protection, incident notice, retention, deletion, intellectual property and audit duties in enforceable subcontractor terms.
The buyer need not receive every commercial clause, but it should obtain assurance and evidence that mandatory controls are flowed down. The prime remains responsible for breach or failure.
- NDA and purpose limitation.
- Data protection and residency.
- Evidence storage, transfer and deletion.
- Security incident and cooperation duties.
Control identity and least-privilege access
Issue named accounts where feasible and map every credential to an approved person. Avoid shared vendor accounts that hide which entity performed an action.
Limit environment, time, role and data access to the delegated task. Remove access promptly when the specialist finishes, changes role or leaves the engagement.
- Named identity and MFA.
- Approved source network or device controls.
- Time-bounded least privilege.
- Logging and attributable activity.
Address location and cross-border handling
Work location can affect buyer policy, regulatory obligations, customer commitments and support hours. Ask where testing and evidence access occur, including backup and collaboration services.
A provider’s registered address does not prove delivery location. Changes require notice and approval before data or access moves.
- Tester and reviewer locations.
- Evidence storage and backup regions.
- Remote-access path.
- Applicable transfer and residency controls.
Protect communication and incident response
The prime should remain the accountable operational contact and maintain visibility into subcontractor activity. Define whether specialists may contact the buyer directly for technical clarification or critical escalation.
An incident involving a subcontractor must enter the same urgent response path. The prime cannot delay notice while resolving responsibility with its supplier.
- Prime delivery owner.
- Critical-finding escalation.
- Security-event notification timeline.
- Investigation and evidence preservation.
Require approval for substitutions
The contract should prohibit silent additions or replacement. The vendor submits the same disclosure and competence evidence, explains the reason and waits for approval.
Set an emergency continuity process with minimum standards and buyer rejection rights. Schedule pressure does not justify a materially weaker team.
- Advance notice period.
- Equivalent-or-better capability.
- Conflict and location recheck.
- Access disabled for the departing person.
Verify offboarding and deletion
At workstream completion, reconcile accounts, devices, repositories and evidence copies. Obtain deletion confirmation under the agreed retention policy.
The prime’s final closure statement should cover subcontractors and affiliates, not only its own systems. Any legally retained material remains protected and inaccessible for reuse.
- List every approved external delivery participant.
- Revoke accounts and tokens.
- Confirm artefact return or deletion.
- Record exceptions and retention expiry.
Keep prime accountability explicit
The buyer can approve a subcontractor without creating a direct management duty. The prime remains responsible for quality, schedule, safety, confidentiality, reporting and remediation of delivery defects.
Price markups and internal supplier disputes must not weaken acceptance criteria. The contracted provider owns the complete outcome.
Use NIST SP 800-115 for assessment planning, roles and rules of engagement, and the supplier controls in NIST SP 800-53 Rev. 5 as authoritative control context. Apply the contract, privacy and sector obligations governing your systems and data.
Make the delivery chain as visible as the scope
A buyer cannot govern privileged testing when it does not know who performs it. Early disclosure lets the organisation validate competence and trust without blocking legitimate specialist support.
WIMD treats subcontractor approval as an access prerequisite, flows controls through the delivery chain and reconciles every identity and artefact at closure.