requirements for external suppliers