Could you produce evidence of your current security certifications (e.g. ISO 27001, SOC 2, or equivalent) if BHP requested them tomorrow?
Has your business had a penetration test in the last 12 months, and do you know what it found?
Are all your business's software licences current and compliant, no expired, unlicensed, or "grey market" software in use?
If BHP conducted an on-site or online compliance review of your environment today, would every device pass inspection, patched, protected, and properly configured?
Do you have a documented process for reporting a suspected or confirmed data breach immediately, and does your team know what it is?
Is multi-factor authentication enforced across all systems that touch BHP data or communications, not just email?
Do you know exactly which of your systems, devices, or staff have access to BHP-related data or contracts?
When did you last have an independent review of your security controls against a recognised framework (like NIST)?
If a subcontractor or third party you use had a breach, would it expose your BHP-related data or systems?
Could your business currently demonstrate, in writing, that it meets its cyber security obligations as a BHP supplier?
