By EJN Labs · 4 Nov 2026 · 7 min read
Nuclear supply chain vendors are not themselves subject to nuclear security law; that legal duty sits with the dutyholder. ONR CSIA expectations reach vendors through contracts and supplier questionnaires covering remote access, patch management and incident response, commonly evidenced by an independent penetration test with remediation and retest evidence.
Why do nuclear dutyholders send third-party assurance requirements down the supply chain?
Dutyholders send third-party assurance requirements down the supply chain because a compromised vendor connection can undermine their own security arrangements, whoever operates it. Remote links and shared tools sit inside the boundary a dutyholder answers for, so the obligation follows the connection.
For the dutyholder, the paperwork trail matters almost as much as the technical control: a security submission that claims protection for connected systems needs evidence for every connection, yours included. Increasingly that evidence takes the form of a recent report from a CREST-accredited firm rather than a supplier’s own self-assessment questionnaire.
Does ONR CSIA regulate supply chain vendors directly?
No. The Nuclear Industries Security Regulations 2003 place legal duties on dutyholders, not on the wider supplier base. ONR uses its Security Assessment Principles to judge whether a dutyholder’s arrangements are adequate, and vendors meet that standard second-hand, through contract terms.
The full regulator name is the Office for Nuclear Regulation, and the discipline vendors most often meet is cyber security and information assurance, shortened here to CSIA, one of four pillars alongside physical, personnel and transport security. The framework is deliberately outcome-focused: it asks a dutyholder to identify systems important to nuclear security, understand the threat to them and assure itself the protection works, rather than prescribing a fixed control list. In our experience, testing is how dutyholders commonly discharge the assurance half of that outcome for anything a supplier touches, which is why CSIA questions land on vendors even though the regulation never names them.
What do nuclear CSIA supplier questionnaires actually ask for?
Nuclear CSIA supplier questionnaires typically ask for evidence across four areas: remote access controls, patch and vulnerability management, incident response arrangements and independent security testing, mapped to the exact connection your systems have into the dutyholder’s estate, not the business as a whole.
In our experience the testing question is rarely a simple checkbox. The reviewer wants a report with findings, severity and remediation status, not a certificate on its own.
- Remote access controls. Who can connect into the dutyholder’s systems or yours, from where, with what authentication, and what happens to that access once a contract ends.
- Patch and vulnerability management. How quickly critical and high-severity findings get fixed, and whether there is a repeatable process behind the answer rather than a one-off effort.
- Incident response arrangements. Who gets told if something goes wrong on your side, and how quickly, given the connection into a nuclear estate.
- Independent testing evidence. Usually a recent external infrastructure or cloud penetration test covering whatever actually connects to the dutyholder’s estate, plus proof that findings were fixed and retested.
The pattern worth noticing is that questionnaires rarely ask about your whole business. They ask about the specific route in, which is exactly why a generic off-the-shelf test often falls short of what a dutyholder’s security team is looking for.
What happens after a dutyholder requests CSIA assurance evidence?
A request usually arrives as a security schedule attached to a contract or a standalone questionnaire ahead of renewal. The first task is mapping exactly what connects to the dutyholder’s estate: which systems, which accounts, which data, and through which route, before any testing is scoped.
That map becomes the test scope, not a generic web or network assessment bought off the shelf. When we scope this work, the questions we ask first are about the connection: what a compromised credential or an unpatched jump host on your side could reach once inside the dutyholder’s network, not just whether your login page is exposed to the internet. Testing runs against that scope, findings are rated by severity, and anything above the agreed threshold is remediated and retested before the report goes anywhere near the dutyholder. The output is a technical report plus, where the questionnaire asks for one, a short attestation letter a non-technical reviewer can read on its own.
What does CSIA assurance testing cost a nuclear supply chain vendor?
CSIA assurance testing typically costs £3,300 to £7,000 in the UK market for a single remote-access route or hosted service, reflecting 3 to 5 days at £1,100 to £1,400 per day. Vendors with a wider footprint, such as a web portal alongside cloud infrastructure, typically see £5,500 to £11,200 for 5 to 8 days.
| Scope | Typical effort | Typical UK cost |
|---|---|---|
| Single remote-access route or hosted service | 3 to 5 days | £3,300 to £7,000 |
| Vendor portal or API used by the dutyholder | 5 to 8 days | £5,500 to £11,200 |
| Combined web, cloud and remote-access assurance programme | 8 to 12 days | £8,800 to £16,800 |
| Retest after remediation | 1 to 2 days | £1,100 to £2,800 |
These are typical UK ranges rather than a quote. The exact figure follows a short conversation about what actually connects to the dutyholder’s estate, and our guide to penetration testing costs in the UK sets out how these bands are built more generally. A single report reused across a whole tender cycle is usually cheaper than the account-management time lost when a security review stalls.
How EJN Labs approaches CSIA assurance testing for nuclear suppliers
EJN Labs is a UK-based, CREST-accredited penetration testing firm, certified to ISO 27001 and ISO 9001. All testing is carried out by UK-based testers, which matters given the sensitivity of the estates our clients connect into. Our guide to CREST penetration testing covers what that accreditation actually verifies.
We treat a nuclear supplier engagement as a connection audit first and a compliance exercise second. Scoping starts from your actual access map rather than a standard package, testing follows the path a real attacker or a misused credential would take, and the report is written so both your engineers and the dutyholder’s security reviewer can act on it. Retesting remediated findings is included as standard: we typically find that an unresolved high-severity item does not satisfy a dutyholder’s review.
Frequently Asked Questions
Do ONR CSIA rules apply directly to nuclear supply chain vendors?
No. ONR CSIA sits within the Nuclear Industries Security Regulations 2003, which places legal duties on dutyholders such as site licensees, not on their suppliers. Vendors meet CSIA expectations indirectly, through contract terms the dutyholder writes to protect its own compliance position.
What evidence satisfies a nuclear CSIA supplier questionnaire?
The most commonly accepted evidence is a recent penetration test report from a CREST-accredited firm, covering the systems and remote access that connect to the dutyholder’s estate, plus remediation status and retest results. A short attestation letter is often requested too.
What does CSIA assurance testing cost for a nuclear supply chain vendor?
A single remote-access route or hosted service typically costs £3,300 to £7,000 in the UK market, based on 3 to 5 days at £1,100 to £1,400 per day. Wider scopes covering a portal alongside cloud infrastructure typically run £5,500 to £11,200. Exact pricing follows a short scoping conversation.
How long does it take to prepare CSIA evidence before a contract deadline?
Testing itself typically takes one to two weeks depending on scope, with the report following shortly after. Vendors should allow extra time for remediation and a retest before submitting evidence. Starting four to six weeks before the deadline is a comfortable margin.
What happens if a vendor cannot provide CSIA assurance evidence?
The consequence sits in the commercial relationship rather than in regulatory enforcement, since ONR’s compliance relationship is with the dutyholder, not the vendor. In our experience, a dutyholder facing a gap in supplier evidence will typically pause onboarding or narrow the vendor’s access.
Get your CSIA evidence moving before the next questionnaire lands
If a nuclear dutyholder is asking your business for CSIA assurance evidence, we can scope a test around the exact route that connects into their estate. Get a CREST pentesting quote and we will send back a scoped, fixed price.
Related research
For the dutyholder side of this same regulatory picture, see what ONR SyAPs evidence nuclear site inspectors ask to see and what ONR CSIA guidance actually asks of site operators. For a broader supply chain view outside the nuclear sector, our guide to NPSA supply chain guidance and penetration testing covers how public bodies assess suppliers more generally.
Related: Penetration Testing Cost for UK Nuclear Supply Chain Vendors and Best Penetration Testing Companies for the UK Nuclear Supply Chain.
Leave a Reply