I don't believe they have to be SQF in particular but do need a GFSI current certification
"All the requirements in the code for contract manufacturers and distribution centers combine to ensure these important partners are managing food safety systems similar to the certified site" See previous guidance for assistance
What does it mean? Contract manufacturers are facilities that are contracted by the SQF certified supplier to produce, process, pack, and/or store part of all of one or more products included in the supplier’s product scope. In some cases, a product may be manufactured interchangeably at the supplier’s site and at a contracted site. In other cases, a contract manufacturer may only be used intermittently to fulfill or supplement the supplier’s production. Whatever the situation, any contract site used to manufacture, in part or in whole, an SQF certified product MUST fulfill the same requirements as the SQF certified supplier. The responsibility for ensuring that these conditions are met is part of the primary supplier’s SQF System. What do I have to do? The supplier must have a documented procedure detailing how they will ensure that product in the care of the contact manufacturer meets their customer specifications and the requirements of the SQF Code. Control of the food safety management system in an external site that is under different management is not an easy task. However the supplier must ensure that facilities selected to contract manufacturer are committed to meeting SQF System requirements. This includes management commitment, pre-requisite programs, document control and records, adhering to specifications, food safety plans, and all other food safety controls. The supplier may simply require the contract manufacturer themselves to be independently SQF certified, or may choose to control the conditions in the contract site via sampling, testing, inspections and internal auditing. In the latter case, a verification schedule, including a sampling plan and internal audit procedure must be included. If the contract manufacturer is processing or packing high risk product on behalf of the supplier, then the contract manufacturer must undergo an audit to the requirements of the SQF Code for the particular food sector category. The audit may be conducted by the supplier, or by an independent third party agency, and must be conducted at least annually. The audit does not necessarily require certification but must confirm compliance to the requirements of the SQF Code. An annual SQF audit of the contract manufacturer does not replace the need for other regular checks and inspections at regular intervals. Any changes to customer specifications must be fully documented. Procedures must include a communication plan to contract manufacturer(s) with changes to specification identified. The supplier’s procedure must include verification that the contract manufacturer is aware of the changes to specification and that product produced after the change has been implemented reflects those required changes.
https://www.sqfi.com...ce-Document.pdf
The answer re: risk level is embedded in the element "The site shall establish a method to determine the food safety risk level of contract manufactured product and shall document the risk" There is this guidance https://www.sqfi.com...-Assessment.pdf