Cyber Security for the Defence Supply Chain

How requirements flow down to you

The MOD manages supply-chain cyber risk through its Cyber Security Model: each contract is given a cyber risk profile, and suppliers must meet the controls for that profile — then flow the same requirements down to their own subcontractors. In practice that means:

• Cyber Essentials as the floor. Lower-risk contracts require Cyber Essentials; higher-risk contracts require Cyber Essentials Plus, the independently audited level. The tender or prime tells you which profile applies.
• Defence Cyber Certification (DCC). For contracts handling more sensitive information, the DCC builds on Cyber Essentials with additional controls — it's increasingly written into defence agreements.
• Flow-down is mandatory. If you subcontract, you're expected to require the same of your suppliers. Primes audit this.
• OFFICIAL-SENSITIVE data. Handling controlled information raises the bar; getting the scope and level right first time saves an expensive re-test.

Get the level right the first time

The commonest and costliest mistake is certifying at the wrong level — getting Cyber Essentials when the contract needed Plus, or vice versa. We read the actual requirement in your tender or prime's flow-down and tell you exactly what to pursue, rather than selling you the higher tier by default.

Certification and testing under one roof

You're guided by a certified IASME assessor for Cyber Essentials and CE Plus, and where a contract calls for a penetration test of a product or system, a CREST-accredited tester delivers it. One relationship from scoping to certificate to test report.

Common questions