Supermarket Supplier Audits: Do Food Businesses Need a Penetration Test?

No public rule makes a supermarket’s supplier audit require a penetration test from a food or agriculture business. The request comes from the customer’s own terms, not from legislation. In our experience it arrives as one of three asks: a recent independent penetration test report, Cyber Essentials Plus, or a written answer on how you test your security. Read the exact wording before you buy anything.

Does a supermarket supplier audit require a penetration test?

Not by any law or published standard that we can point you to. A supermarket, wholesaler or food-service buyer sets its own supplier approval terms, and those terms are private to the two companies. So the honest answer is that it depends on your customer, and the only way to know is to read the document they sent you.

What changes the answer is what you connect to them. A farm that sends a paper delivery note is rarely asked for a test. A supplier that logs into the customer’s ordering portal, feeds stock data through an EDI link, or runs a traceability platform that the customer’s recall team relies on is much more likely to be asked how that system is protected. In our experience the more of the customer’s data and processes you touch, the more detailed the security section of the audit becomes.

A food-safety certificate and a security test answer different questions. Food-safety certification such as BRCGS covers how food is made and handled. A penetration test covers whether someone on the internet could read, change or delete the data your systems hold. Auditors usually ask for both, but one does not stand in for the other.

What does a supplier audit actually ask for?

Supplier security questions are private, and there is no public template for food suppliers to quote. In our experience they come in three forms: a yes or no question on whether you have had an independent penetration test in the last twelve months, a request for a certificate such as Cyber Essentials Plus, or a free-text question on how you test and fix weaknesses.

The three are not interchangeable, and it matters which one you have been sent.

• A penetration test report. A tester tries to break into a defined system and reports what they found. This is the evidence to send when the question says “penetration test” or “independent security test”.
• Cyber Essentials Plus. The NCSC describes it as the same protections as Cyber Essentials “but with more rigorous independent technical testing”. In practice it is an assessor-led technical audit of your devices and settings. It is not a penetration test, and a customer who asks for a test is not satisfied by the certificate alone. See our page on Cyber Essentials Plus.
• A description of your process. Where the question is open, a short summary of what you test, how often, and how you track fixes is the answer. A dated report plus a retest note gives you something concrete to attach.

If the wording is unclear, ask the buyer one direct question: do you need a penetration test report, or a certificate? A one-line reply saves a lot of money and time.

Which public rules sit behind the request?

One public rule applies to almost every food business, and it does not name a penetration test. UK GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of your security measures. It does not name penetration testing as the method.

It matters in food and agriculture because supplier portals, grower platforms and traceability systems hold personal data about staff, farm workers, drivers and contacts at the customer. The ICO’s data security guide says you can undertake this testing through techniques “such as vulnerability scanning and penetration testing”. That is a list of options, not an instruction. Our page on GDPR penetration testing goes through what the test evidences.

Insurers are the other asker with something you can read. One published cyber proposal form asks whether you conduct penetration tests of your network at least annually. Requirements vary by insurer and policy, so check the form your broker gives you.

Who can carry out the test?

A supplier audit rarely names an accreditation, and where it does, use the one it names. Food and agriculture organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. If the document is silent, a CREST-accredited company is a sensible default.

CHECK is the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks. A food supplier selling to a supermarket is not normally in that position, so a requirement naming CHECK would be unusual. If you do see it, use a provider approved for it.

Two practical checks help whichever route applies. Ask which legal entity holds the accreditation, and whether you can see it on the scheme’s own register. Ask how the company will test around harvest, production runs and peak trading weeks, because a supplier portal that goes down in the week before a promotion costs you more than the test.

What should a food or agriculture business test?

Test the systems the customer’s audit is really asking about: anything that holds supplier data, batch records or pricing, and anything that connects to the retailer. Start with the system the buyer named in the questionnaire. Add the others only if they hold data the buyer cares about or sit on the same network.

• Supplier and grower portals. Whether one supplier can see another supplier’s pricing, volumes or quality data, and whether supplier, buyer and auditor roles stay separate.
• Traceability and provenance platforms. Whether a batch can be silently reassigned, and who is allowed to trigger a recall workflow.
• Retailer and EDI integrations. The APIs and feeds that link your systems to the customer’s ordering platform. See API penetration testing.
• Farm data and cold-chain telemetry. Dashboards and sensor platforms, tested from the cloud side, never directly on live farm machinery or irrigation controllers.
• Recipe and formulation data. Whether ingredient and product-development files can leak to the wrong supplier or partner.
• Corporate, farm office and packing-line networks. The separation between office IT and production equipment. See external infrastructure penetration testing.

What evidence do you hand back to the customer?

Hand back what the question asks for and no more. A dated summary letter naming the scope, the testing company and the outcome usually answers a supplier questionnaire. The full report is sensitive, so offer it under a confidentiality agreement rather than attaching it to a portal upload. This is practice, not a rule.

The part buyers tend to probe is what happened to the findings. A retest shows that high and critical issues were fixed, which a bare report cannot. Keep three things together: the report, the retest confirmation, and the scope document that says which systems were and were not tested. If an auditor asks why the farm equipment network was left out, the scope document is the answer.

Keep the insurer’s version separate. An insurance form usually wants the date of the last test and confirmation that serious findings were fixed. Our guide to cyber insurance renewals that ask for penetration testing covers it.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for food and agriculture businesses

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated food and agriculture service. We test the systems a supplier audit looks at: farm data platforms, traceability and provenance systems, supplier and grower portals, cold-chain telemetry, retailer and EDI integrations, and the networks around them.

Farm data platforms, cold-chain telemetry and connected equipment are tested from the cloud side, never directly on live farm machinery, milking robots or irrigation controllers. Work that reaches towards field or plant equipment only goes ahead against an agreed safe test plan with defined change windows. Testing is safe by default on production, with no denial of service, and out of hours slots are available.

The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees.

Frequently Asked Questions

Does a supermarket require its suppliers to have a penetration test?

No public rule says so. Each customer sets its own supplier terms, which are private. In our experience some ask for a recent independent test report, some ask for Cyber Essentials Plus, and some only ask how you test. Read the wording your customer sent and ask them which evidence they need.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus is an assessor-led technical audit of your devices and settings. Neither Cyber Essentials tier requires a penetration test. If the customer asks for a penetration test report, the certificate alone will not answer the question, and the reverse is also true.

Does BRCGS certification cover cyber security testing?

BRCGS is a food-safety certification, so it answers a different question from a security test. We do not rely on it to say what a customer will accept for security. Check the supplier audit wording itself, and if it asks for a penetration test, send a test report.

Does the testing company need to be CREST-accredited or a CHECK provider?

Supplier audits rarely name one. Food and agriculture organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Use the accreditation your customer, insurer or internal standard names, and ask them if it is not stated.

How often should a food supplier run a penetration test?

No rule for food suppliers sets a frequency. UK GDPR Article 32(1)(d) asks for regular testing without naming an interval. Some cyber insurance forms ask whether network penetration tests are run at least annually, so once a year, and again after a major change to a supplier portal, is a common starting point.

Get a quote for your food or agriculture business

Tell us which systems are in scope and which customer has asked for the evidence. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Food and Agriculture Businesses, Best Penetration Testing Companies for UK Food and Agriculture, penetration testing for UK food and agriculture, Cyber Essentials Plus, GDPR penetration testing and what underwriters accept at a cyber insurance renewal.