What are BHP’s cybersecurity requirements for suppliers, and how do you actually get approved? For South East Queensland SMBs in engineering, transport, professional services, and trades chasing a slice of the mining supply chain, this is where a lot of promising tenders quietly stall. Not because the work isn’t good enough, but because the cybersecurity paperwork behind it isn’t there yet.
This guide breaks down exactly what BHP’s Minimum Requirements for Suppliers expect on cybersecurity and data, where SMBs typically get caught out, and the practical steps to close the gap before a tier-one client asks to see the evidence.
Key Takeaways: BHP’s Minimum Requirements for Suppliers
- BHP’s Minimum Requirements for Suppliers is a mandatory pre-requisite for doing business with BHP. It isn’t optional paperwork, and it applies to every supplier regardless of size.
- The cybersecurity and data clause has four core obligations: affirm good industry practice, maintain a documented risk assessment, apply a proportionate cybersecurity program, and demonstrate ongoing commitment, not a one-off snapshot.
- “Affirm,” “maintain,” and “demonstrate” all mean one thing: documentation. BHP procurement wants evidence they can file and reference, not a verbal assurance in a sales call.
- The most common gaps for SMBs are unglamorous and fixable: consumer-grade Windows Home devices, under-specced Microsoft 365 licensing without encryption in transit, no vulnerability scanning, no penetration testing, and no written risk assessment.
- A recognised certification like SMB1001 gives procurement teams independent evidence, rather than relying purely on self-affirmation. This is increasingly how SMBs stand out in a BHP supplier assessment.
- Compliance isn’t a one-off report. BHP is explicit about wanting ongoing commitment, which means monitoring, patching, and policy review need to continue after the initial submission.
Quick Answer: What Does BHP Require From Suppliers on Cybersecurity?
Under BHP’s Minimum Requirements for Suppliers, every supplier must meet four obligations, regardless of size. They must affirm they manage cybersecurity, data protection, and personal data to good industry practice, and maintain a documented risk assessment. They also need to run a proportionate cybersecurity program that finds and fixes weaknesses routinely. Finally, they must be able to demonstrate that this commitment is ongoing, rather than a one-time exercise.
Suppliers working on BHP sites or inside BHP systems also need to complete onboarding through the Global Contract Management System (GCMS) and BHP’s SAP Business Network (Ariba) account, plus set up a contractor profile in one of BHP’s contractor management systems.
Why BHP (and Other Large Enterprises) Push Cybersecurity Down the Supply Chain
Large organisations increasingly recognise that their own security is only as strong as their weakest supplier. Attackers have learned that it is often easier to compromise a smaller contractor with access to a client’s systems, data, or physical sites than to attack the large organisation directly, and supply chain compromises have driven major incidents across mining, construction, and infrastructure sectors globally.
This is not unique to BHP. It reflects a broader shift across resources, infrastructure, and government supply chains in Australia, where cybersecurity has moved from being treated as a purely internal IT concern to being treated as a genuine supply chain risk that needs managing at the procurement level, alongside the safety and business conduct obligations suppliers are already used to meeting.
BHP’s Minimum Requirements for Suppliers: What’s Actually in the Cybersecurity Clause
BHP’s Minimum Requirements for Suppliers document covers safety and business conduct, but it also contains a dedicated cybersecurity and data section that sits alongside those obligations as a condition of doing business with BHP. Every supplier in the chain, from major contractors down to small regional subcontractors, is held to it.
Specifically, the supplier must:
- Affirm that cybersecurity, data protection, and personal data are managed to good industry practice and in accordance with relevant data protection and data privacy laws.
- Maintain a documented risk assessment covering cybersecurity, data protection, and personal data.
- Apply a cybersecurity program, proportionate to the size of the business, that identifies and remediates weaknesses as a matter of routine.
- Demonstrate ongoing commitment to managing cybersecurity and data protection risk, not a static, one-off compliance exercise.
On top of the Minimum Requirements themselves, suppliers working within BHP systems or on BHP sites go through onboarding via the Global Contract Management System (GCMS) and BHP’s SAP Business Network (Ariba) account, along with a contractor profile in one of BHP’s contractor management systems.
Internally, BHP holds its own people to a Technology and Cybersecurity Global Standard and a Data Global Standard, and that same underlying bar of maturity is effectively what BHP is looking for when it assesses whether a supplier is safe to plug into its systems and supply chain.
Comparing the Requirements at a Glance
| Requirement | What It Means | What BHP Wants to See |
|---|---|---|
| Affirm good industry practice | A formal statement that cybersecurity and data protection meet accepted standards | A written affirmation, backed by real controls |
| Documented risk assessment | Risks to cybersecurity, data, and personal data identified and recorded | A risk assessment document, not informal knowledge |
| Proportionate cybersecurity program | A program sized to the business that finds and fixes weaknesses routinely | Evidence of vulnerability scanning and remediation on a schedule |
| Ongoing commitment | Continuous management, not a one-time policy write-up | Monitoring, patching, and periodic review over time |
| Onboarding (GCMS/Ariba) | Supplier profile and access setup for BHP systems | Completed contractor and supplier profiles |
Where SMB Suppliers Usually Get Stuck
We’re currently taking a small firm through exactly this process for a BHP contract, and the gaps we found are typical of a business that’s grown organically without an IT partner steering the ship.
None of this reflects poorly on the business, it’s the normal accumulation of shortcuts almost every fast-growing SMB makes on the way up. The difference is what you do about it before a tier-one client like BHP asks to see the paperwork.
Consumer-grade machines
Several devices were running Windows Home, which doesn’t support the domain join, group policy, and encryption management a compliance framework expects. Windows Pro or Enterprise is table stakes for a business that wants to demonstrate managed, auditable device security.
Under-specced Microsoft 365 licensing
Their license tier didn’t include encryption for data in transit as standard, a basic expectation once you’re handling anything sensitive for a client like BHP. Getting compliant meant a licensing uplift, not just a configuration change.
No vulnerability scanning
Nobody was regularly checking for exploitable weaknesses across their systems, so there was no way to demonstrate the “identifies and remediates weaknesses as a matter of routine” requirement BHP specifically asks for.
No penetration testing
No independent, adversarial test of their environment had ever been carried out, so there was nothing to point to as evidence beyond internal assurances.
No documented risk assessment
As with most businesses this size, risk was managed informally and in people’s heads, not written down in a form a procurement team can actually review.
No ongoing story
Even once the technical gaps are fixed, a policy written once and never revisited doesn’t demonstrate “ongoing commitment.” BHP is explicit about wanting continuity, not a snapshot in time.
How XCD IT Helps SMBs Close the Gap
This is the exact work we do for clients preparing to tender for, or maintain, contracts with large enterprise clients like BHP.
Gap assessment against BHP’s Minimum Requirements
We map your current environment against the cybersecurity and data clauses in BHP’s supplier requirements and tell you precisely what’s missing before you submit anything.
Documented risk assessment
We build a cybersecurity and data risk assessment specific to your business, covering the assets, threats, and controls BHP expects to see referenced.
A cybersecurity program you can point to
Using the tools we already run for clients, including Datto RMM for monitoring and patching, Microsoft 365 security controls, backup and access management, we help formalise what you’re doing into a program with policies behind it, not just infrastructure.
Where the underlying environment isn’t ready, that means the unglamorous fixes too. This includes moving devices off Windows Home onto Pro or Enterprise, and uplifting Microsoft 365 licensing to a tier that actually supports encryption in transit.
It also means putting regular vulnerability scanning in place, so you can show weaknesses are being found and fixed on a schedule, not discovered by accident.
Independent testing
For clients who need to demonstrate more than internal controls, we arrange penetration testing so there’s an adversarial, third-party result to hand to procurement, not just your own word that things are secure.
Independent certification as your proof point
We support clients through SMB1001 certification, which gives you a recognised, auditable standard to hand to BHP procurement instead of relying purely on self-affirmation. We’re proud to hold Gold level certification under SMB1001:2026 ourselves, so we know the assessment process from the inside out.
Ongoing management, not a one-off report
Compliance documents go stale. Our managed service model means monitoring, patching, and policy review continue after the initial submission, so when BHP or their auditors come back to check, the answer is still yes.
Why “Proportionate” Doesn’t Mean “Optional”
One thing worth being clear on: BHP’s language explicitly says the cybersecurity program should be “proportionate to the size of the business.” For most SMBs, that proportionate program is built around the ASD Essential Eight, a baseline set of mitigation strategies covering patching, multi factor authentication, application control, and regular backups, developed by the Australian Signals Directorate and widely referenced across Australian industry as a practical security starting point.
That’s a relief for a five-person trades business that isn’t going to run the same security operations as a Tier 1 contractor, but it isn’t an exemption.
The obligation to have a documented risk assessment and an active, evidenced program applies to every supplier, regardless of size. A smaller business simply needs a smaller, right-sized version of the same things: a written risk assessment, routine vulnerability checks, and a way to show the program is still running six months from now, not just on submission day.
A Realistic Starting Point
If you’re chasing a BHP tender and cybersecurity compliance feels like the thing standing between you and submission, start with a gap assessment. It’s a short engagement that tells you exactly what BHP will want to see and how far off you are, so you’re not guessing your way through procurement.
How long this takes depends on your starting point. A business with basic IT hygiene already in place, such as managed patching, MFA (Multi Factor Authentication), and backups, can usually get a risk assessment and policy set documented within a few weeks. Businesses starting from scratch, or pursuing a certification like SMB1001, should plan for a longer runway.
Getting BHP-ready, step by step
- Get a copy of BHP’s current supplier cybersecurity requirements for your specific contract type
- Run a gap assessment against those requirements, using Essential Eight or SMB1001 as a proxy if contract-specific documentation is limited
- Prioritise the gaps that block compliance first, usually MFA, patching, and endpoint protection
- Document your incident response process, even a simple one, if you don’t already have one
- Book a penetration test if your contract scope requires it, since these typically need to be scheduled in advance
NOT SURE IF YOUR BUSINESS WOULD PASS A BHP REVIEW?
Take our five-minute BHP supplier cyber security self-assessment and get an instant result.
Frequently Asked Questions: BHP Cybersecurity Requirements for Suppliers
- 8+ Best Cybersecurity Companies in Brisbane (2026 Guide for SMBs) - November 7, 2026
- 20 Best Managed IT Service Companies in Brisbane (2026 Guide for SMBs) - November 7, 2026
- Co-Managed IT: How It Works With Your In-House IT Team - November 4, 2026
