How to become an MOD supplier

First, a common misunderstanding

Many consultancy pages talk about becoming "MOD approved". The MOD does not run a general approval that a company can apply for and then hold. Suppliers are assessed procurement by procurement, framework by framework, and by each prime contractor that buys from them. What you can do in advance is get registered, get your cyber, quality and policy evidence in order, and be ready to answer the questions every buyer asks.

The two routes into defence work

Most smaller manufacturers start with subcontract work, because primes buy components, assemblies and services in volumes the MOD rarely buys directly. See selling into the defence supply chain for that route.

Step by step

1. Decide what you are offering, in the buyer's terms. Note the product and service categories you fit, the standards you already meet, and any export-controlled items you make. Buyers search and filter by category, so this shapes every registration that follows.
2. Register on the Defence Sourcing Portal (DSP). The MOD states that the DSP hosts all of its advertised requirements. Registration and use are free. Set up notifications for your categories so new opportunities reach you. The DSP supplier registration guide on GOV.UK walks through the profile forms.
3. Register on Find a Tender. Since the Procurement Act 2023 came into force on 24 February 2025, Find a Tender is the central digital platform. Suppliers register their organisation, receive a unique identifier and store core supplier information there, which buyers use when you bid. See the Procurement Act 2023 for suppliers.
4. Watch Contracts Finder and the MOD Acquisition Pipeline. Contracts Finder lists lower-value public contracts. The pipeline gives forward visibility of planned MOD procurements and frameworks, which helps you prepare before a notice is published.
5. Get your cyber baseline in place. Contracts carrying DEFCON 658 require a cyber risk assessment and a Supplier Assurance Questionnaire, and controls from Def Stan 05-138 at the assessed level. The MOD has also asked industry partners to hold Defence Cyber Certification at Level 0, which includes Cyber Essentials, by 31 December 2026. See DEFCON 658 and Def Stan 05-138.
6. Prepare your standard evidence pack. Company registration and ownership details, financial accounts, insurance certificates, quality certificates with their scope, health and safety, environmental and modern slavery policies, and business continuity arrangements. Buyers ask for the same things repeatedly; keeping them current saves time on every bid.
7. Check export control status. If your products, software or drawings are on the UK Strategic Export Control Lists, you will need licences to send them abroad, and primes will ask for the ratings. See classifying goods on the control lists.
8. Join frameworks and dynamic markets where they fit. Some MOD requirements can only be bid for by suppliers already on a framework or dynamic market. Some are open to join at any time; others reopen periodically.
9. Get known to the primes. The MOD names its strategic suppliers, including companies such as BAE Systems, Babcock, Leonardo, MBDA, QinetiQ, Rolls-Royce and Thales. Many advertise subcontract opportunities and use shared pre-qualification through JOSCAR.
10. Use the support that exists. The MOD set up a Defence Office for Small Business Growth in early 2026 as a single point of SME support. Regional defence and security clusters, UK trade associations and UK Defence Innovation (which brought together the former Defence and Security Accelerator and other innovation teams) are further routes in.

What a first bid usually asks for

• Supplier information already held on the central digital platform, confirmed as current.
• Exclusion declarations covering matters such as fraud, bribery, tax, and other grounds set out in the Procurement Act 2023.
• Conditions of participation, such as financial standing, relevant experience and certifications, proportionate to the contract.
• The technical and commercial response, assessed against published award criteria.
• Security and cyber responses, including the Supplier Assurance Questionnaire where DEFCON 658 applies.

Security clearance comes later

Facility security clearance is sponsored when a contract requires you to hold classified material at your own site. Companies cannot apply for it speculatively, and most suppliers never need it. Personnel vetting, from the Baseline Personnel Security Standard to Security Check and Developed Vetting, is likewise tied to specific roles. See hiring engineers for how vetting fits into recruitment.

Getting paid

The MOD publishes its payment performance. It states that all undisputed, valid invoices should be paid within 30 days, with a target of paying most valid SME invoices within 5 days. Subcontract payment terms are set by the prime's contract, so read them before you accept an order.

Common questions

Does it cost anything to register?

Registering on the Defence Sourcing Portal and on Find a Tender is free. Costs arise elsewhere: cyber certification, quality certification and, for some suppliers, the second stage of JOSCAR.

Can a newly formed company bid?

Yes. Buyers may assess financial standing and relevant experience, and the tests are meant to be proportionate to the contract. A new company often finds subcontracts, smaller contracts and innovation competitions an easier start than a large direct contract.

Do I need Cyber Essentials before I bid?

It depends on the contract's cyber risk profile, but Cyber Essentials sits inside the MOD's baseline expectations for its supply chain. Having it in place before you bid avoids a delay you cannot fix quickly.

Is defence work only for firms making weapons?

No. The MOD and its primes buy a wide range of goods and services, including components, materials, tooling, software, logistics and facilities services. The same core requirements apply, scaled to risk.

What records will a defence customer expect from us?

Expect questions about where parts and materials came from, how products were inspected, and how changes are controlled. Keeping that record from the start is easier than rebuilding it for an audit; Cargovate for manufacturers is one way to keep lot and serial genealogy and custody records together.