Selling into the MoD or working within the defence supply chain places suppliers in a category apart from general public sector procurement. The requirements are stricter, the consequences of non-compliance are more serious, and the threat environment is more deliberate.
Four sets of requirements normally apply:
Forensic Control supports defence suppliers in meeting these requirements. The work is led by David Webb, who brings 26 years of military service (including 16 in UK Special Forces) and an MSc in Security & Risk Management to a sector where lived understanding of defence operations is rare among cyber security consultancies.
The contract's cyber risk profile sets the level a supplier has to meet under DEFCON 658. Higher profiles, and Defence Cyber Certification Levels 2 and 3, require Cyber Essentials Plus, and most defence primes ask their subcontractors for Plus as a matter of course. That is why we recommend it as the default for suppliers who expect to bid across a range of defence work, even where a single contract would accept Cyber Essentials.
DEFCON 658 sets specific cyber security obligations within MoD contracts, including notification requirements and supply chain flow-down. We explain the clause, the cyber risk profile that sets your level, and the MOD's 31 December 2026 request in our guide to DEFCON 658 and Cyber Essentials for MOD suppliers.
Prime contractors are expected to assure cyber security across their supply chain. Your security affects your prime contract, not only your own.
Where US-controlled technology is involved, ITAR may restrict who can access technical data and require specific protections beyond standard cyber controls.
Defence contracts routinely involve OFFICIAL-SENSITIVE and sometimes higher classifications. Each level has specific handling requirements.
Defence contracts include specific incident notification clauses with tight timelines. Knowing what to report and to whom is critical.
Cyber Essentials Plus is the level we recommend for defence suppliers, and it is the base for Defence Cyber Certification Levels 2 and 3 under DEFCON 658. The independent technical audit provides the evidence that prime contractors and contracting authorities expect. For the clause itself, the levels and what to do when you find it in a contract, see our guide to DEFCON 658 and Cyber Essentials for MOD suppliers.
Forensic Control is an authorised IASME Certification Body, not a reseller. We have been delivering Cyber Essentials since 2017, and we work with defence suppliers to certify quickly:
Most defence suppliers can be certified within weeks once scope is agreed. We work to your bid or contract timeline and to the specific requirements of the contracting prime or authority.
A typical engagement from initial contract scoping through certified and ready to operate. We work to your contracting prime or authority timeline.
“Defence cyber security is not a paperwork exercise. The threat environment is real, the contracting requirements are specific, and the supplier ability to demonstrate genuine security maturity is part of how the supply chain is assured. Having spent 26 years in the military, 16 of them in UK Special Forces, I know the difference between a security programme that works under pressure and one that only looks good on a tender response.”
Whether you are preparing for a specific MoD or prime contractor bid, responding to DEFCON 658 obligations, or improving your wider defence supply chain security posture, we can help. Contact us or book a short call to talk through where you are and what you need.
