Cyber Essentials for Ministry of Defence Suppliers

How defence differs from other public sector work

Rather than a single blanket rule, defence contracts are risk-assessed and the contract then states the controls expected of the supplier. Two practical consequences follow: the certification level varies by contract, and the requirement is passed down to sub-contractors by the prime. Always read the specific contract wording before deciding what to certify.

When Cyber Essentials Plus is likely

• The contract involves identifiable defence information rather than general commercial data.
• You hold or process technical or design data relating to defence capability.
• You connect into a prime contractor's systems or a government network.
• The prime's own obligations require audited evidence from its supply chain.

Cyber Essentials Plus adds an independent technical audit including vulnerability scanning of a sample of devices. It requires a valid standard certificate first – see Cyber Essentials Plus and the Plus readiness checklist.

Sub-contractors: the part people miss

If you are delivering into a defence contract through a prime, the prime is accountable for supply chain assurance and will ask you for evidence. Being uncertified when the prime is audited puts their contract at risk, which makes them decisive about replacing suppliers. Certify before you are asked.

Preparation that matters most in defence work

• Clean scope – define exactly which people, devices, sites and cloud services deliver the contract.
• MFA everywhere, including remote access and any privileged accounts.
• No unsupported operating systems, including engineering workstations and legacy test kit.
• Documented 14-day patching for high and critical vulnerabilities with an exportable report.
• Removable media and data handling controls, which primes commonly ask about beyond CE itself.

Timescales and cost

• Cyber Essentials: £320 + VAT, 24 to 48 hours when prepared.
• Cyber Essentials Plus: £1,400 + VAT, one to three weeks depending on estate size.
• Legacy or air-gapped engineering equipment usually adds time – raise it early rather than at audit.

Also useful: Cyber Essentials for tenders and Government Commercial Agency frameworks.