Defence supply
Selling into the UK defence supply chain
The Ministry of Defence and its prime contractors buy from companies of every size, and most smaller manufacturers reach defence work as subcontractors rather than through direct MOD contracts. Winning that work depends as much on meeting security, cyber and quality expectations as on the product itself. This guide covers the supply chain route and what each tier will ask of you.
Not legal advice. Requirements depend on the contract, its risk level and its classification. Check each tender's or purchase order's documents and ask the buyer when unsure.
How the supply chain is structured
| Tier | Who | What they typically buy |
|---|---|---|
| Customer | MOD, including Defence Equipment and Support (DE&S) and other delivery teams | Platforms, systems, support and services |
| Prime contractors | Strategic suppliers such as BAE Systems, Babcock, Leonardo, MBDA, QinetiQ, Rolls-Royce and Thales | Subsystems, assemblies, engineering services |
| Tier 1 and 2 suppliers | System and subsystem specialists | Components, harnesses, machined and fabricated parts, electronics |
| Lower tiers | Specialist SMEs and service providers | Materials, processes, test, tooling, logistics |
Requirements flow down: cyber, security, quality and export conditions in the MOD's contract with a prime reappear, adapted, in the prime's orders to its suppliers.
Finding opportunities
- Public tenders. Since the Procurement Act 2023 came into force in February 2025, public procurement notices and supplier registration run through Find a Tender, the central digital platform. Contracts Finder lists lower-value opportunities. See the Procurement Act 2023 for suppliers.
- The Defence Sourcing Portal. The MOD states that the DSP hosts all of its advertised requirements, and primes are encouraged to advertise subcontract opportunities there too. See how to become an MOD supplier.
- Prime contractors' supply chains. Primes run their own supplier registration and qualification, and many use shared pre-qualification through JOSCAR.
- Clusters and trade associations. Regional defence and security clusters and trade bodies such as ADS and Make UK Defence run supplier events where primes meet smaller firms.
Working with a prime: the usual sequence
- Identify the right buyer. Primes organise purchasing by category. Find the category or commodity manager for what you make, not just a general supplier inbox.
- Pre-qualify. Complete the prime's supplier registration or JOSCAR, with quality, cyber, financial, export control and ethics evidence.
- Quote against a request. Expect detailed technical data packs, drawings with configuration control, and flowed-down terms. Read the terms before pricing; they affect cost.
- Supplier approval. The prime's quality team may audit you or rely on certification, and may approve you for specific processes or part families only.
- First article. New or changed parts usually need a first article inspection report before production deliveries are accepted.
- Performance monitoring. Primes track delivery and quality. Good scores lead to more work; poor scores lead to corrective action requests.
Cyber security requirements
The MOD assesses the cyber risk of each contract using its Cyber Security Model and sets requirements through the contract condition DEFCON 658. In practice:
- Each contract has a Cyber Risk Profile (Level 0 to Level 3 under CSM version 4) that determines the controls expected, as set out in Def Stan 05-138.
- Suppliers complete a Supplier Assurance Questionnaire showing how they meet those controls.
- Cyber Essentials or Cyber Essentials Plus is commonly required, and the MOD has asked industry partners to hold Defence Cyber Certification at Level 0 by 31 December 2026.
- Requirements flow down, so a small subcontractor can inherit obligations from the main contract.
Full detail: DEFCON 658, Def Stan 05-138 and DCC.
Quality expectations
| Standard | Where it comes up |
|---|---|
| ISO 9001 | Baseline quality management expected by most defence customers |
| AQAP 2110 | NATO quality requirements, called up in many defence contracts |
| AS9100 (EN 9100) | Aerospace and many defence-aerospace supply chains; see AS9100 certification |
| First article and configuration control | Commonly required by primes for new or changed parts |
| Counterfeit parts prevention | Required for electronic and other parts at risk of counterfeiting |
A certificate's scope matters as much as its existence. Buyers check both, and check that the certificate is current.
Security for classified work
- Facility security clearance is needed where a company will hold classified material at its own site. It is sponsored through a contract that requires it; companies can't simply apply for it speculatively.
- Personnel vetting ranges from baseline checks to Security Check (SC) and Developed Vetting (DV), depending on the role. See hiring engineers.
- Handling rules for classified and sensitive information are set out in the contract's security conditions, including any Security Aspects Letter.
Export controls
Military and dual-use goods, software and technology need export licences from the UK government's Export Control Joint Unit unless an open licence applies. Technology transfers, including by email or cloud access, can count as exports. Primes will ask for the control list rating of each part. Read control list classification, OGEL vs SIEL and AUKUS and export controls.
Traceability
Defence customers increasingly ask for provenance: where materials came from, who built each unit, and the evidence that it was built correctly. Cargovate for manufacturers records serial and lot genealogy and the custody chain of parts in transit.
Common questions
Is it easier to start with a prime than with the MOD?
For many component and process suppliers, yes. Primes buy the kinds of items smaller manufacturers make, in quantities the MOD rarely buys directly. Direct MOD work suits firms with a complete product or service.
Do primes accept suppliers without AS9100?
Some do, for some categories, particularly with ISO 9001 and a good audit. Aerospace flight hardware usually needs AS9100. Ask the buyer which quality requirements apply to the category.
What does "flow-down" mean in practice?
Clauses in the prime's contract with the MOD, such as cyber, security, export control and quality conditions, are copied into its orders with you. Read the referenced DEFCONs and the prime's own terms.
How are defence suppliers paid?
Subcontract terms are set by the prime. For public contracts under the Procurement Act 2023, 30-day payment terms are implied and must be flowed down through the supply chain.
Last reviewed 2026-09-17