8 Common BHP Supplier Compliance Failures (and How to Avoid Them)

What actually causes BHP supplier compliance failures during a cybersecurity review? It’s rarely one dramatic gap. BHP supplier compliance failures are usually a handful of ordinary, fixable issues that nobody caught until procurement or an on-site reviewer went looking.

This guide walks through the 8 most common BHP supplier compliance failures, why each one keeps showing up, and what to do about it before it becomes a problem.

Key Takeaways

• BHP supplier compliance failures are rarely about one catastrophic security gap. They’re almost always a combination of ordinary, fixable issues, unpatched devices, licensing gaps, and missing evidence, none of which are individually dramatic but all of which are easy to check for.
• Missing or incomplete penetration testing evidence is one of the most common causes of BHP supplier compliance failures, since many suppliers have never had a test performed at all, or can’t produce documentation of one that was.
• Inconsistent multi factor authentication, enabled on some systems but not others, is a recurring finding behind many BHP supplier compliance failures, even in businesses that believe they’ve already covered this.
• Not knowing exactly which systems, devices, or staff have access to BHP-related data is a common gap in itself, separate from whether that access is actually secured.
• None of these issues require enterprise-level resources to fix. Most BHP supplier compliance failures can be closed within weeks once they’ve actually been identified.

Quick Answer

The 8 most common BHP supplier compliance failures are unpatched or unmanaged devices, expired or unlicensed software, missing penetration testing evidence, inconsistent multi factor authentication, no documented incident response process, not knowing who has access to BHP-related data, no recent independent review against a recognised framework, and being unable to demonstrate compliance in writing.

Most of these gaps aren’t unusual for a business that has never previously had a client formally assess its cybersecurity, and most BHP supplier compliance failures can be closed within weeks once identified through a proper gap assessment.

Why BHP Supplier Compliance Failures Follow a Pattern

BHP’s own published Minimum Requirements for Suppliers document sets a general, principle based cybersecurity standard, asking suppliers to manage cybersecurity to good industry practice, maintain a risk assessment, and run a proportionate cybersecurity program.

That general framing means the specific things a reviewer actually checks tend to be the practical, verifiable basics, not obscure technical edge cases, and it’s exactly why BHP supplier compliance failures tend to repeat across different suppliers and different industries.

That’s the pattern worth understanding before your own review happens. BHP supplier compliance failures aren’t usually unusual gaps, they’re common ones that simply haven’t been checked or documented yet.

NOT SURE IF YOUR BUSINESS WOULD PASS A BHP REVIEW?

Take our five-minute BHP supplier cyber security self-assessment and get an instant result.

BHP supplier self-assessment

The 8 Most Common BHP Supplier Compliance Failures

1. Unpatched or Unmanaged Devices

This is consistently one of the most common findings in any supplier compliance review, and one of the most frequent BHP supplier compliance failures overall. Laptops and mobile devices that haven’t been centrally patched, or that lack current endpoint protection, are an easy thing for a reviewer to check and an easy thing for a business to overlook if there’s no central IT management in place.

The underlying problem usually isn’t a lack of awareness that patching matters, it’s a lack of visibility. A business without centralised device management often genuinely doesn’t know which of its devices are behind on updates until someone actually goes looking, device by device.

2. Licensing Gaps

Businesses running outdated or unsupported software versions that no longer receive security updates show up frequently in reviews, often without the business realising the software had already reached end of support.

This is a quiet risk, since the software usually still works fine day to day, right up until a known vulnerability in that unsupported version becomes the way an attacker gets in, and it’s a common contributor to BHP supplier compliance failures that could otherwise be avoided with a simple licence audit.

3. No Penetration Testing History

A surprising number of suppliers have never had a penetration test performed at all, and for supplier programs that specifically require testing evidence as part of the assessment, this becomes a hard blocker rather than a minor deduction.

Testing needs to be scheduled in advance, which means this is one of the gaps most likely to catch a supplier out close to a compliance deadline, if it’s left until the last minute, and it remains one of the most common BHP supplier compliance failures for exactly that reason.

4. Inconsistent Multi Factor Authentication

MFA enabled on email but not on other systems, remote access, trust or line of business software, is one of the most common gaps found during a proper assessment, and it’s also one of the easiest to miss internally, since the business genuinely believes MFA is “already covered” based on the one system where it’s obviously visible.

5. No Documented Incident Response Process

An informal or entirely nonexistent incident response process shows up constantly. Many small businesses have never actually written down what would happen if a security incident occurred, who needs to be told, and how quickly, even if there’s a general sense of what everyone would do.

Demonstrating an ongoing commitment to managing risk, which BHP’s own baseline requirement specifically asks for, is difficult without something documented to point to.

6. Not Knowing Who Has Access to What

Beyond whether access is secured, a genuinely common gap is not being able to confidently answer which systems, devices, or staff currently have access to BHP-related data or contracts at all. This is a visibility problem as much as a security one, and it tends to surface during a review as a simple, direct question that a supplier isn’t prepared to answer precisely.

7. No Recent Independent Review Against a Recognised Framework

Many suppliers have never had their security controls reviewed against a recognised framework like the NIST Cybersecurity Framework, which covers the core areas of identify, protect, detect, respond, and recover.

Without that kind of structured review, a business may genuinely have reasonable controls in place but have no independent, defensible way to demonstrate it, which is functionally the same problem as not having them at all from a compliance perspective, and it’s one of the harder BHP supplier compliance failures to catch without an outside review.

8. Being Unable to Demonstrate Compliance in Writing

Even businesses with genuinely solid practical security can fail a review simply because they can’t produce it in writing.

A compliance review is ultimately an evidence exercise, and informal, undocumented good practice doesn’t hold up the same way a written policy, a recent test report, or a certification does.

This single gap alone accounts for a meaningful share of BHP supplier compliance failures, even among suppliers whose actual security posture is reasonable.

How These BHP Supplier Compliance Failures Compound

None of these issues are individually dramatic, which is exactly why they’re so common. A business that’s unpatched in some areas, inconsistent with MFA, and missing a penetration test isn’t unusual, it’s the typical starting point for a supplier who has never previously had a client formally assess their cybersecurity.

The risk isn’t any single gap, it’s the combination showing up together during a review with a compliance deadline attached, and no time left to close them properly. This is how isolated, individually minor issues turn into genuine BHP supplier compliance failures on paper, even when the underlying business isn’t unusually careless about security.

Closing These Gaps Before a Review

Most of the common failure points covered here map directly onto the questions in our BHP Supplier Cybersecurity Self-Assessment, which takes about five minutes and gives an instant, honest picture of where a business currently stands against these exact issues.

For a deeper look at what BHP’s baseline requirement actually says, and how frameworks like SMB1001 map onto it, see our full guide to BHP’s minimum requirements for suppliers.

Frequently Asked Questions