Defence supply
Selling to UK defence
The Ministry of Defence and its prime contractors buy from companies of every size. Winning that work depends as much on meeting security, cyber and quality expectations as on the product itself.
Not legal advice. Requirements depend on the contract, its risk level and its classification. Check each tender's documents and ask the contracting authority when unsure.
Finding opportunities
- Public tenders. Since the Procurement Act 2023 came into force in February 2025, public procurement notices and supplier registration run through the government's Find a Tender service and the central digital platform. Contracts Finder also lists lower-value opportunities.
- Defence-specific portals. The MOD also publishes defence opportunities through its own sourcing channels. Check the Defence Sourcing Portal guidance for current arrangements.
- Prime contractors' supply chains. Much defence work reaches smaller firms as subcontracts. Primes run their own supplier registration and qualification processes, and many use shared supplier-assurance schemes.
Cyber security requirements
The MOD assesses the cyber risk of each contract and sets requirements for suppliers accordingly, through its Defence Cyber Protection Partnership approach. In practice:
- Each contract has a cyber risk profile that determines the controls expected of suppliers.
- Suppliers complete a supplier assurance questionnaire showing how they meet those controls.
- Cyber Essentials or Cyber Essentials Plus certification is commonly required, depending on the risk level.
- Requirements flow down, so a small subcontractor can inherit obligations from the main contract.
Quality expectations
| Standard | Where it comes up |
|---|---|
| ISO 9001 | Baseline quality management expected by most defence customers |
| AQAP 2110 | NATO quality requirements, called up in many defence contracts |
| AS9100 | Aerospace and many defence-aerospace supply chains |
| First article and configuration control | Commonly required by primes for new or changed parts |
A certificate's scope matters as much as its existence. Buyers check both, and check that the certificate is current.
Security for classified work
- Facility security clearance is needed where a company will hold classified material at its own site. It is sponsored through a contract that requires it; companies can't simply apply for it speculatively.
- Personnel vetting ranges from baseline checks to Security Check (SC) and Developed Vetting (DV), depending on the role.
- Handling rules for classified and sensitive information are set out in the contract's security conditions.
Export controls
Military and dual-use goods, software and technology need export licences from the UK government's Export Control Joint Unit unless an open licence applies. Technology transfers, including by email or cloud access, can count as exports. Read AUKUS and export controls.
Traceability
Defence customers increasingly ask for provenance: where materials came from, who built each unit, and the evidence that it was built correctly. Cargovate for manufacturers records serial and lot genealogy and the custody chain of parts in transit.
Last reviewed 2026-09-17