Independent supplier discoveryUS & UK launch markets / Evidence updated 2 Oct 2026
criticalsupply.Infrastructure starts here

Supplier assurance · Reviewed 26 August 2026

How to vet a data-centre supplier.

A six-step evidence workflow for moving from discovery to a defensible shortlist—without confusing a listing, registry entry or sales claim with qualification.

Build a shortlist

The evidence sequence

Six checks before award

  1. Step 1
    Define the package and consequence of failure
    Write down the required outcome, interfaces, location, programme and acceptance criteria. Increase the depth of evidence when failure could affect safety, availability, compliance or a critical path.
  2. Step 2
    Match the trading name to the contracting entity
    Record the legal name, registration identifier, registered status, parent relationship and the entity that would sign the contract. A brand name, directory profile or registry match is a starting point—not proof of capability.
  3. Step 3
    Test capability claims against relevant work
    Ask for recent examples with a comparable scope, scale, market and project stage. Separate the supplier's own delivery from work performed by a parent, partner or subcontractor.
  4. Step 4
    Verify standards, accreditations and people
    Check the issuing body, holder, scope, location and expiry of each credential. Confirm that named technical resources and required authorisations will be available for this package.
  5. Step 5
    Map resilience and subcontracting
    Identify critical subcontractors, single-source components, data or system access, lead-time assumptions, spares, incident routes and practical alternatives. Set assurance depth in proportion to the relationship's risk.
  6. Step 6
    Convert evidence into controls
    Put responsibilities, submittals, tests, acceptance criteria, change control, incident notification and review dates into the procurement record and contract. Refresh evidence when scope or risk changes.

Evidence pack

What to capture, and when

Claim

Identity and authority

Evidence to request

Legal entity, registration status, ownership path and signing authority

Refresh point

Before invitation and before award

Claim

Relevant capability

Evidence to request

Comparable scope, supplier role, references and boundaries of responsibility

Refresh point

Shortlist and technical evaluation

Claim

Capacity and programme

Evidence to request

Current team, production slot, lead times, dependencies and recovery plan

Refresh point

Tender return and pre-award refresh

Claim

Technical assurance

Evidence to request

Applicable standards, certificates, designs, test plans and acceptance evidence

Refresh point

Design review through commissioning

Claim

Supply-chain resilience

Evidence to request

Critical subcontractors, single points of failure, cyber access, spares and incident routes

Refresh point

Tender, contract and material change

Claim

Operations and exit

Evidence to request

Warranty, maintenance, response times, obsolescence, data return and end-of-life route

Refresh point

Before handover and during service reviews

Market checks

Use registries for the claim they support

United Kingdom
Confirm the entity, then keep checking
Companies House exposes company status, registered details, filings, officers, charges and insolvency information. Its own guidance says the register is not comprehensive, so use it as one identity and status source—not as proof of technical competence or financial suitability.
Companies House guidance
United States
Use SAM.gov only where it is relevant
SAM.gov provides official entity validation and Unique Entity IDs. A full, active registration is required to bid directly for US federal awards; a Unique Entity ID alone is not that registration and neither is a general-purpose supplier qualification.
SAM.gov guidance

Build the research set

Start with scope, not names

Choose the project stage first, then open the capability categories that carry the largest consequence or interface risk. The filtered directory is a research list; document why each firm enters or leaves the shortlist.

Site & PlanConnect & PowerDesign & BuildFit Out & CommissionOperate & MaintainUpgrade & Exit
Grid Connections & High VoltageTransformers & SwitchgearUPS, Generators & Critical PowerCooling, Liquid Cooling & WaterDesign, Build & CommissioningFibre & ConnectivityEnergy Storage & FlexibilityPhysical Security & FireOperations & MaintenancePlanning, Engineering & AdvisoryDecommissioning & Circular ITTalent & Recruitment

Primary references

Sources used for this guide

Companies House — Searching the register
UK company status, filings, officers, charges and insolvency information; the register itself warns that it is not a complete source for a decision.
NCSC — 12 principles of supply chain security
A four-part approach: understand risk, establish control, check arrangements and improve continuously.
NCSC — Supplier assurance questions
Supplier questions and supporting evidence should be tailored to criticality and kept current rather than treated as a box-ticking exercise.
SAM.gov — Entity registration
Official US guidance on entity validation, Unique Entity IDs and the additional registration needed to bid for federal awards.
UK Cabinet Office — Central Digital Platform guidance
For covered UK public procurement, core supplier information includes identity, financial standing, connected persons and exclusion information.

Sources checked 26 August 2026. Requirements vary by contract, market and risk; confirm the rules that apply to your procurement.