- Define support obligations beyond the production launch.
- Require usable evidence and clear remediation responsibilities.
- Test whether another team could actually sustain the software.
Launch is the start of the obligation
A software component can meet every acceptance criterion at launch and become a commercial problem later. Its supplier may change a dependency, retire a cloud service or stop supporting a development tool. The vehicle maker still needs to understand the effect on products already in customers' hands.
The NCSC's supply chain guidance treats security as an ongoing relationship involving visibility, control and review. Applied to automotive procurement, that suggests a contract should describe how support continues through production and the agreed service period, with specific responsibilities when the surrounding technology changes.
Make the evidence deliverable
Ask what the supplier will provide when a vulnerability affects a component. Useful deliverables include an identified contact, an impact assessment, a dependency inventory and a documented remediation process. Define the response milestones and the evidence needed to close an issue; a broad promise to provide reasonable support is difficult to manage against.
The engineering team also needs reproducible build information and agreed access to relevant diagnostic records. Commercial teams should check that licences and subcontracting arrangements permit the intended support model. A contractual right is of limited value if the business cannot obtain the tools or rights required to use it.
Rehearse the end of the relationship
Consider the practical consequences of supplier failure or a planned transition. Who can maintain the software, operate the service and access the records? What must be transferred, in which format and on what timetable? Escrow may form part of an arrangement, but source code alone does not guarantee that another team can sustain the product.
The decision for procurement is how much continuity the programme needs and what it will pay to secure it. Resolve that while both parties are negotiating the launch contract, when the long-term obligations can still influence architecture, price and supplier selection.
Put continuity into the contract review
- Name the support period, response milestones and dependency information the supplier must maintain after launch.
- Confirm that licences, build tools, records and subcontractor arrangements permit the support model the programme is buying.
- Rehearse a supplier exit with engineering and operations. Identify what another team could actually run, maintain and recover.
Editorial prompts for your operation. Confirm the evidence with the responsible specialists.
Sources & further reading
National Cyber Security Centre: The principles of supply chain security ↗
Sources checked 2026-10-14. Corrections and feedback.
