Supply chain security is easy to write about in the abstract and hard to implement, because the organisations that most need hardening are usually the ones least able to absorb the cost of it.
The UK’s current approach to its defence supply chain is a reasonably interesting case study in how a government tries to solve that, and it is worth looking at because the mechanism is more pragmatic than the rhetoric around supply chain security usually is.
The mechanism
The UK Ministry of Defence has operated contractual cyber requirements for some years through DEFCON 658 and the Cyber Security Model, under which suppliers complete a Supplier Assurance Questionnaire appropriate to the risk level of the contract.
That is a self-assessment, with the familiar limitation that self-assessment carries whatever the respondent believes to be true.
Defence Cyber Certification sits alongside that as an independently assessed scheme, built on Defence Standard 05-138 Issue 4 and run by IASME, the organisation that also administers the UK’s Cyber Essentials scheme.
It has four levels, from 0 to 3, with the control set growing at each.
The design decision worth noting is at the bottom. Level 0 is deliberately small: three controls rather than a governance programme.
It requires Cyber Essentials certification covering the contract scope, that personal data is processed in compliance with UK GDPR, and that resilience against cyber attack and system failure is built into the supplier’s systems.
That is a low bar by the standards of most assurance frameworks, and it appears to be low on purpose.
The population being targeted is the second and third tier of the supply chain: small engineering firms, fabricators, logistics providers and specialist manufacturers, many of them with no internal IT function.
A framework that demanded an information security management system from that population would achieve compliance theatre at best and exclusion at worst.
The timing
In May 2026 the MoD’s Director of Cyber Defence and Risk wrote that industry partners had been asked to achieve Level 0 certification by 31 December 2026, and the department repeated the ask subsequently.
That is a clearly signposted expectation with a date attached.
It is worth being precise about its status, because it is widely described inaccurately. It is an ask rather than a contractual mandate.
IASME states that the scheme is currently not mandatory and that suppliers may continue to tender through the normal process, and government guidance confirms that holding a certificate does not yet exempt a supplier from completing elements of the Supplier Assurance Questionnaire.
What binds contractually today remains DEFCON 658 and the Cyber Security Model.
The practical effect is still real. Prime contractors are asking, individual contracts are beginning to specify a level, and a supplier cannot bid above its certified level where one is specified.
Why building on Cyber Essentials matters
The architectural choice here is the interesting part for anyone looking at supply chain assurance elsewhere.
Rather than writing a bespoke baseline, the scheme reuses an existing national one. Cyber Essentials covers five control areas: firewalls and boundary protection, secure configuration, user access control, malware protection, and security update management.
The scheme has been running since 2014, there is an established body of assessors, and the question set is already understood by thousands of small UK organisations.
The consequences are mostly practical. A supplier reaching Level 0 is doing something it can reuse: Cyber Essentials satisfies a growing number of commercial contracts, insurer questions and public sector requirements that have nothing to do with defence.
That changes the economics of compliance for a small firm from a sunk cost into something with a return outside the originating contract.
It also means the control set is one that assessors can verify consistently, which is not true of frameworks written as principles.
A detail that causes repeated confusion, and costs suppliers money: Cyber Essentials applies at every DCC level, but Cyber Essentials Plus, the independently audited version, applies at Levels 2 and 3 only.
Suppliers are regularly quoted for the audited assessment on the basis of a Level 1 requirement that does not call for it. The applicability table in the standard settles it, and the standard is public.
What this looks like for a supplier
For a small manufacturer with no security function, the work is mostly inventory and configuration rather than purchase.
Establishing what devices exist, bringing patching within the scheme’s timescales, enforcing multi-factor authentication on cloud services, separating administrative accounts from daily ones, and dealing with whatever cannot be updated by isolating it properly rather than describing it as isolated.
The common obstacle in this population is not the office estate. It is the machine controller running an operating system whose vendor stopped supporting it a decade ago, which cannot be replaced because the machine around it has twenty years of service left.
The scheme accommodates that through scoping and segregation, provided the segregation is genuine.
That is a reasonable accommodation, and it is also the point where a lot of submissions fail, because a permissive firewall rule between two VLANs is not segregation.
Where a supplier is working to a contractual date, the certification underneath is usually the critical path rather than the assessment itself, which is why Fast Cyber Essentials tends to be the first conversation rather than the last.
The wider scheme structure, including what each level requires, is set out in this guide to DCC Level 0.
What transfers
Three things seem generalisable to anyone designing supply chain assurance.
Make the bottom rung genuinely small. A baseline that a two-person supplier can reach is worth more across a population than a comprehensive framework that only the top tier implements.
Reuse an existing national scheme rather than writing a new one. It gives you assessors, a question set people recognise, and a certificate the supplier can use elsewhere, which is what makes the cost tolerable.
Be accurate about mandatory status. Overstating an obligation produces short-term compliance and long-term mistrust, and in this case it has already produced a market in suppliers being sold certifications their contracts do not require.
Whether the approach works is an open question, and the December date will be a reasonable first indicator. The design, though, is a more careful piece of policy than supply chain security usually gets.
Solusec is a UK cyber security practice based in Shropshire. It is an IASME appointed Certification Body for Cyber Essentials and IASME Cyber Assurance and is able to deliver Defence Cyber Certification assessments, so the certification underneath a DCC level and the DCC assessment itself come from the same place.
