UK: Account for Supplier Access to File Systems

By Dan Gordon

Last Updated: November 12, 2026

Under the Cyber Security and Resilience Bill, managed service providers and digital service providers will have to tell their customers when those customers are likely to have been affected by an incident. For the organization receiving that message, the first question is immediate and specific: what could the supplier reach?

Most UK organizations can answer that for their cloud applications, where access is provisioned per user and logged per session. Far fewer can answer it for their file systems. There, an outsourced IT provider typically holds administrative credentials, reaches shares over SMB, and leaves no record that tells routine maintenance apart from someone reading the finance folder.

The short answer: to audit third-party access to file servers under the Cyber Security and Resilience Bill, you need two things in place before a supplier notification arrives. First, each supplier account should reach only the shares it needs, enforced through Active Directory groups and NTFS permissions. Second, every file event from those accounts should be logged with user, device, source IP, share, path, operation, result and bytes transferred, and sent to your SIEM. With both in place, "what could the supplier reach?" becomes a filtered query instead of a forensic project.

What the Cyber Security and Resilience Bill Changes

The Cyber Security and Resilience (Network and Information Systems) Bill reforms and extends the NIS Regulations 2018. The government's summary of the Bill groups the reforms into three pillars: expanded scope, more effective regulators, and enabling resilience.

Expanded scope: MSPs, data centres and critical suppliers

The expansion of scope reaches most organizations indirectly, through the companies they buy IT services from.

• Managed service providers. Medium and large MSPs come into the regime for the first time, with the Information Commission (the successor body to the ICO) as their regulator. For many UK organizations, this is the outsourced IT provider that already holds their domain admin credentials.
• Data centres. Data centres are classed as essential services, and data infrastructure becomes a NIS sector. Ofcom is the operational regulator for medium, large and enterprise data centres that meet the thresholds.
• Critical suppliers. Regulators gain a power to designate critical suppliers, so that the most important suppliers to essential and digital services fall under the regime. The government compares this to the critical third parties regime in financial services.

Twelve regulators, also called competent authorities, oversee their respective sectors.

Incident reporting: 24 hours, 72 hours and customer notification

Incidents will be reported in two stages to the regulator, with the National Cyber Security Centre (NCSC) informed at the same time.

“…with initial notification within 24 hours and a fuller report within 72 hours.”

Source: GOV.UK, Cyber Security and Resilience Bill: summary of the Bill

Separately, data centres and digital and managed service providers must inform their customers if those customers are likely to have been impacted. That second duty is the one most organizations will actually feel. The reporting clock belongs to the supplier, but the questions land with you.

When the obligations start

Any internal planning document should handle timing carefully. The Bill had not received Royal Assent as of 12 November 2026. It completed its House of Lords stages on 2 November 2026 and has gone back to the House of Commons for consideration of Lords amendments.

Even after Royal Assent, most of the regime arrives in phases:

• Month 2 after Royal Assent: the statement of strategic priorities and the information sharing provisions.
• Through secondary legislation, at times set by the Secretary of State: the provisions covering data centres, managed and digital service providers, critical suppliers and incident reporting.

The government has said it will consult on implementation proposals, publish a response and then lay the secondary legislation, and that affected parties will get an adjustment period. Treat the Bill as a planning horizon, not a dated deadline. The supplier access work it points to can't be done in an adjustment period anyway.

The figures behind the Bill

The Question That Arrives With a Supplier Notification

A notification from a managed service provider does not, by itself, mean your data was breached. It tells you there is something you now have to investigate. That investigation turns on one question, and the answer decides whether anything further is owed: a personal data breach assessment for the ICO under UK GDPR, notices to your own customers, or a report to your own regulator if you are in scope.

For a modern SaaS application, the answer can be retrieved. Access was federated through an identity provider, sessions were logged, and the records show which accounts were used and what they opened.

For file infrastructure, the answer usually has to be reconstructed.

• Admin credentials reach everything. An outsourced provider holding domain administrator rights can reach any share the domain can reach. "What could they reach?" has a one-word answer: everything.
• Auditing is off by default. Windows Server can audit object access through system access control lists (SACLs), but it has to be switched on with an audit policy and a SACL on each folder you want watched. When it is on, it writes to the Security event log at a volume that makes targeted investigation slow, and on a busy server older events may already have been overwritten.
• The events don't match how the business thinks. File system events (such as event 4663) describe an access attempt against a local path, a handle and an access mask. The business thinks in named shares: the Finance share, the HR share. Share access is a separate audit subcategory (events 5140 and 5145), and neither records how much data moved.
• Some routes leave no trace at all. If a provider moved files out through a personal cloud account, a remote session or email, the organization's own systems hold no record of it.

That leaves a gap between what an organization has to establish and what its infrastructure can tell it.

This Is Not a New Duty, Only a Newly Enforced One

None of this is a new expectation. UK organizations already have to show who can reach their data:

What the Bill adds is a trigger. Supplier notifications will arrive when the supplier's own regulatory duty says they must, not when the customer happens to discover a problem, and each one starts an investigation. Organizations that have never had to answer the access question quickly will start having to answer it on demand.

How to Audit Third-Party Access to Your File Servers

The useful time to do a supplier access audit is before any notification arrives. Five steps cover most of it.

1. Inventory suppliers and their accounts. List every MSP, software vendor, consultant and outsourced team, and every account each one uses, including shared and service accounts. Generic "support" accounts are the first thing to retire, because they make attribution impossible.
2. Map what each account can reach. For each account, record its AD group memberships, the NTFS permissions those groups carry, and any domain or local admin rights. Accounts with domain admin can reach every share, so note them separately.
3. Narrow access to what the work needs. A provider that needs three folders should have three folders. Remove standing admin rights where you can, and grant elevated access for a limited time when a task needs it.
4. Route supplier file access through a logged path. Supplier access to files should run through a path that records each event, rather than SMB over a VPN tunnel that the file server barely logs. Our guide to file access audit logging covers what a usable record contains.
5. Rehearse the query. Pick one supplier and one week. Filter the log by that supplier's accounts and the date range, and see whether you can list the shares reached, the files opened and the bytes transferred. If you can't do this in a drill, you won't do it quickly when a real notification comes in.

Giving Suppliers Access Without Giving Them the Estate

The structural fix is narrower access, not better forensics after the fact.

MyWorkDrive publishes existing file shares over HTTPS from a Windows Server the organization already operates, without migrating data or creating a second copy of the file set. For third parties, access is granted through share links issued against existing shares, with:

• expiry after a set number of days
• an optional password
• view-only access, without saving locally
• a maximum number of downloads per link

Dynamic watermarks show the viewer's name and the exact time the content was viewed. Device approval provides an allowlist for MyWorkDrive mapped drive and mobile clients.

Permissions are inherited, not recreated. MyWorkDrive's existing permissions remain authoritative: it adds a policy layer that can restrict access further but cannot grant access that hasn't already been granted. For an organization reviewing supplier access, the practical upshot is that the work is tightening NTFS permissions and Active Directory group membership, which it needed to do anyway. There is no second permission model to maintain in a separate platform.

Producing the Record That Answers the Question

Access is logged rather than inferred. MyWorkDrive records four kinds of event:

• Authentication events: login attempts, identity provider details, source IP and device identifiers.
• File operations: opens, downloads, uploads, saves and deletes, with full path and result.
• Sharing events: link creation, revocation, access and guest activity.
• Administrative changes: policy updates, device approvals and configuration changes.

Each entry carries the user, source IP, device identifier, share, path, operation, result and bytes transferred. Events export over Syslog, using UDP or TCP, so file activity lands in the same SIEM as everything else.

That is what turns the supplier question from an investigation into a query. An organization that can filter its log by a supplier's accounts and a date range can state which shares were reached and which files were opened within hours. That is fast enough to feed a UK GDPR breach assessment, which has a 72-hour notification window once you become aware of a breach, or the 24-hour initial notification if your organization is itself in scope of the NIS regime.

Authentication binds to the identity provider already in service through SAML 2.0, including Microsoft Entra ID, Okta, ADFS, Ping and Shibboleth, with native Duo integration for multi-factor authentication. Connections use TLS 1.2 or higher. Because access runs over HTTPS, there's no need to extend the corporate network to a supplier's devices through a VPN. If you are weighing that change more broadly, see our comparison of zero trust VPN alternatives for file shares.

Scope and Limitations

• MyWorkDrive provides technical controls and evidence. The organization remains responsible for its own compliance program, and no product delivers compliance with the Bill, the NIS Regulations or UK GDPR on its own. Nothing here is legal advice.
• Device approval is an allowlist, not a posture check. It applies to MyWorkDrive mapped drive and mobile clients. It isn't an endpoint compliance check, and it doesn't cover browser access. To enforce device posture, use Conditional Access at the identity provider.
• Permission review comes first. MyWorkDrive restricts access and never grants more than the underlying storage permits. An over-permissive share structure stays over-permissive, and the log will faithfully record access that should never have been possible.
• Server-level admin access is out of scope. A supplier who keeps direct administrative access to the file server at the operating system level is outside the reach of any access gateway. Narrowing supplier access means narrowing it at the server and directory level too, not only at the access layer.
• SharePoint Online and OneDrive data stays with Microsoft. Where they are connected as storage, the access path and the access record change. Where the data resides does not.
• Log retention is set where the logs land. Retention depends on your SIEM or log platform's configuration, not on the file access layer.

Frequently Asked Questions

Does the Cyber Security and Resilience Bill apply to organizations that are not managed service providers?

It applies directly to entities within the regulated sectors, including medium and large managed service providers and in-scope data centres, and regulators gain a power to designate critical suppliers. Organizations outside those categories are affected indirectly, mainly through the duty on providers to notify customers likely to have been impacted, and through supplier assurance questions from customers who are themselves in scope.

When do the obligations take effect?

As of 12 November 2026, the Bill has completed its House of Lords stages and returned to the House of Commons, and it has not received Royal Assent. The government has indicated that the statement of strategic priorities and the information sharing provisions commence two months after Royal Assent. The substantive provisions on data centres, managed service providers, critical suppliers and incident reporting arrive through secondary legislation at times set by the Secretary of State, after consultation and with an adjustment period for affected parties.

Who regulates managed service providers under the Bill?

The Information Commission, the successor body to the ICO, will regulate medium and large managed service providers. Ofcom will be the operational regulator for in-scope data centres.

What must a managed service provider tell its customers after an incident?

Under the Bill, data centres and digital and managed service providers must inform customers who are likely to have been impacted by an incident. This sits alongside the provider's own reporting to its regulator, which is an initial notification within 24 hours and a fuller report within 72 hours, with the NCSC informed at the same time.

Can a Windows file server show which files a supplier opened?

Not as deployed. Object access auditing is available through system access control lists but is disabled by default, and the event volume it produces when enabled makes targeted investigation slow. It records file system operations rather than access to a named share, and it cannot record activity that took place outside the organization's systems.

Is this a replacement for a VPN for supplier access?

For file access, yes. Share links and HTTPS access let a supplier reach specified folders without a VPN client and without the supplier's device joining the corporate network, and every access event is recorded. Suppliers who need other services will still need a route to them.

Does adding a file access layer require migrating data?

No. MyWorkDrive publishes existing shares from a Windows Server the organization already operates. Storage, Active Directory groups and NTFS permissions stay as they are.

Start a free trialBook a demoView pricing