Defence supply chain management has changed more in the last two years than it did in the decade before. New procurement law, a new industrial strategy, a push to bring more small firms into defence and a new cyber security model have all landed close together. Each one adds to what primes, Tier 1s and their suppliers are expected to know, check and evidence about the organisations they work with.
For many businesses the hard part is no longer knowing that requirements exist. It is keeping track of them across dozens or hundreds of suppliers, on top of delivering the contract. This article sets out the main changes, what they mean in practice, and how WHG can take that work off your hands.
1. A new procurement regime with tougher supplier scrutiny
The Procurement Act 2023 came into force on 24 February 2025. It now governs competed defence and security contracts, replacing the Defence and Security Public Contract Regulations, and comes with amended Single Source Contract Regulations.
For supply chain management, the important changes are the expanded exclusion grounds and the new central debarment list. Suppliers can be excluded from public procurement for up to five years. Contracting authorities and primes therefore have a much stronger reason to know exactly who is in their supply chain, who owns them and how they have performed before.
What it means: due diligence is no longer a one-off check at tender stage. You need a defensible, repeatable process for vetting suppliers and keeping that information up to date.
2. More SMEs in defence, and more suppliers to onboard
The Defence Industrial Strategy, published on 8 September 2025, made growing the UK industrial base and opening defence to smaller firms a central aim. The MOD has since set a target to increase its direct and indirect spend with SMEs by £2.5 billion, to £7.5 billion, by May 2028. That is a 50% rise on the 2023/24 baseline. A Defence Office for Small Business Growth was launched in January 2026, and the MOD has published an SME Action Plan.
Because the target covers indirect spend, primes and Tier 1 suppliers are expected to bring more SMEs into their own supply chains, not just the MOD.
What it means: for primes, more new suppliers who may never have worked under DEFCONs, Def Stans or AQAP before, each needing onboarding and assurance. For SMEs, a real opportunity, but only for those who can show a prime that they are ready.
3. Cyber assurance now runs the length of the supply chain
The MOD's Cyber Security Model version 4 (CSMv4) and Defence Standard 05-138 Issue 4 have moved the focus from protecting MOD information alone to the cyber resilience of a supplier's whole organisation. In March 2026, Industry Security Notice 2026/01 clarified that the requirements apply to a supplier's business-critical operations across the supplier as a single legal entity. Each organisation must identify and justify its own business-critical dependencies.
Industry Security Notice 2026/02 then confirmed that a valid Defence Cyber Certification (DCC) at the right level can be submitted as assurance that the relevant Def Stan 05-138 controls are met under DEFCON 658.
Most pressing of all, the MOD's Director of Cyber Defence and Risk has asked all industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials for all applicable business-critical systems in scope. Where higher DCC levels are needed lower down the supply chain, the MOD has said these should be scheduled for after that date.
What it means: every supplier in your chain needs a plan for Level 0 now. You also need visibility of which of them will later need Level 1, 2 or 3, based on the Cyber Risk Profile of the work you flow down to them.
4. Resilience and readiness are under the spotlight
The MOD is engaging industry earlier, before requirements are fully defined. It has acknowledged pressure points such as constraints on critical raw materials and long lead times for key components, and it has wargamed how supply chains would cope under sustained pressure. Suppliers are increasingly expected to show that they, and their own suppliers, can scale and keep delivering when it matters.
What it means: knowing your single points of failure, where you rely on sole or overseas sources, and how quickly your supply chain could respond. This is becoming part of normal supplier management.
At a glance
| Change | What you now need |
|---|---|
| Procurement Act 2023: exclusions and debarment | Repeatable due diligence on ownership, conduct and past performance, kept current |
| Defence Industrial Strategy and SME spend target | A proportionate way to onboard and assure new, smaller suppliers |
| CSMv4, Def Stan 05-138 Issue 4 and DCC | Correct flow-down of cyber requirements and a tracked route to DCC Level 0 for every relevant supplier by 31 December 2026 |
| Resilience and readiness | Risk-tiered supplier oversight, visibility of critical dependencies and evidence you can show your customer |
How WHG can manage this for you
WHG runs supplier assurance as a managed service for defence primes, Tier 1s and growing suppliers. Our ex-military team and qualified lead auditors take on the day-to-day work, so your people can focus on delivery.
- Map and tier your supply chain. We identify every supplier, what they do for you, and rank them by criticality, contract value and cyber, quality, security, export and ethical risk.
- Due diligence that stands up to scrutiny. Ownership, sanctions, PEP, financial stability, adverse media and certification checks, refreshed on a schedule rather than once.
- Get flow-down right. We make sure DEFCON, Def Stan and AQAP requirements, including the Cyber Risk Profile for each piece of work, reach the right suppliers with the right evidence requested.
- DCC Level 0 across your supply chain. We track each supplier's Cyber Essentials and DCC status against the 31 December 2026 deadline, help those who are behind, and plan for the higher levels to come.
- Onboard new suppliers properly. A baseline compliance pack before work starts, scaled so SMEs can meet it without drowning in paperwork.
- Audit and monitor. Risk-based second-party audits with tracked corrective actions, certificate expiry monitoring and clear, board-ready reporting.
If you are an SME looking to win work with a prime, we work from the other side too. We will set out what your customer will ask for, get your systems and evidence in place, and prepare you for independent assessment. WHG provides consultancy and audit support. Certification is carried out by independent, accredited bodies.
Seven weeks to the DCC Level 0 deadline: where to start
- List your suppliersIdentify which suppliers support work under MOD contracts or your business-critical operations.
- Check Cyber EssentialsConfirm who holds valid Cyber Essentials for the systems in scope, and when it expires.
- Ask for DCC statusFind out who already holds DCC Level 0, who is booked in, and who has not started.
- Prioritise by riskFocus support on suppliers that are critical to delivery and furthest behind.
- Record itKeep the evidence. Your own customer is likely to ask for it.
If that list already feels like a project in its own right, that is exactly the work we take on.
Talk to us about managing your supply chain
This article is general information based on published MOD and UK Government guidance at the time of writing. It is not legal advice. Always check the requirements in your own contract and any Security Aspects Letter.
Sources
- Defence Industrial Strategy 2025: Making Defence an Engine for Growth (GOV.UK)
- Departmental Small Business Procurement Targets (GOV.UK)
- Ministry of Defence SME Action Plan (GOV.UK)
- Industry Security Notice 2026/01 (GOV.UK)
- Industry Security Notice 2026/02 (GOV.UK)
- One Year of Defence Cyber Certification (Defence Digital blog)
- Early industry engagement increasing speed of Middle East support (GOV.UK)
Talk to WHG
Practical, defence-aware support across ISO, Def Stan and cyber compliance.
