Cyber Essentials for MOD Suppliers & Sub-contractors
Every new MOD requirement now carries a Cyber Security Model risk assessment, and depending on how sensitive the information or systems involved are, that assessment can call for anything from a Cyber Essentials certificate through to higher assurance levels. This applies right down the supply chain, so being a sub-contractor rather than a prime doesn't automatically take you out of scope. Defence buyers treat this as part of onboarding you as a supplier, so it's something to sort out early rather than after you've already won the work.
Why it applies to you
Every new MOD requirement now carries a Cyber Security Model risk assessment, and depending on how sensitive the information or systems involved are, that assessment can call for anything from a Cyber Essentials certificate through to higher assurance levels. This applies right down the supply chain, so being a sub-contractor rather than a prime doesn't automatically take you out of scope. Defence buyers treat this as part of onboarding you as a supplier, so it's something to sort out early rather than after you've already won the work.
Typical Trigger / Source
MOD Defence Cyber Protection Partnership (DCPP)
Requirement levels reflect current UK government, NCSC and IASME guidance. If you're unsure which category applies to your organisation, our team can help you confirm it on a quick call before you commit to certifying.
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Questions from mod suppliers & sub-contractors
The contracting authority or prime contractor you're working under should tell you which risk profile has been assigned, usually through a Cyber Security Model questionnaire early in the procurement process. If nobody has told you yet, it's worth asking directly rather than assuming standard Cyber Essentials will automatically be enough.
Not always. Cyber Essentials satisfies the lower risk profiles under the Cyber Security Model, but higher risk MOD work can call for additional controls beyond what Cyber Essentials checks. Treat Cyber Essentials as the likely starting point, not a guarantee it closes out every defence requirement on its own.
It can, yes. The Cyber Security Model is designed to flow requirements down the supply chain, so the prime contractor you're working for may pass the same expectation on to you as a condition of the subcontract. Ask them directly what's expected of your part of the work.
Yes, for some higher risk profiles it is. The risk assessment for your specific contract will state whether standard certification is sufficient or whether the more rigorous Plus assessment, which includes hands-on technical testing, is expected instead.
Latest from the blog
See other categories
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.