Defence cyber assurance: build an evidence record your team can maintain
A defence supplier can hold a certificate and still struggle to answer a practical question: which evidence supports this particular piece of work, and who will notice when the work changes?
For a delivery lead, developer or small supplier preparing for a customer review, that connection matters. A certificate, a questionnaire and a contract each describe something different. Keeping their relationship visible makes it easier to ask an accurate question without claiming that a project is approved on the strength of one document.
This guide explains a relevant 2026 clarification and offers an original evidence-record exercise. It does not assess any supplier’s compliance. The applicable contract and the responsible buyer determine the requirements for the work.
What the 2026 DCC notice clarifies
The MOD’s Industry Security Notice 2026/02, dated 30 March, says suppliers maintaining valid Defence Cyber Certification at the appropriate level may submit it as evidence of the relevant DEFSTAN 05-138 control requirements under DEFCON 658. Certification must be at least the required level. The notice directs questions about conflicts with a contract-specific Security Aspects Letter to the Delivery Team.
The separate Cyber Security Model guidance describes CSMv4 risk profiles at Levels 0 to 3, supplier self-assessment and subcontractor flow down. It also says a valid DCC certificate does not yet remove the need to complete the full Supplier Assurance Questionnaire in the online service. Confirm current instructions with the buyer before submitting.
The distinction is useful: evidence that satisfies a control requirement does not automatically complete every procurement step. An internal record can help the team keep those steps connected.
Build a small contract-to-evidence record
The following is an editorial working aid, not an MOD form or an alternative certification scheme. Use it within the organisation’s approved information-handling arrangements. References to documents are often more useful than duplicating their contents into another spreadsheet.
1. Name the work and the requirement
Purpose: Make it clear which decision the evidence supports.
Record an internal work reference, the customer contact, the applicable requirement reference and the person who confirmed it. Capture the date and where that confirmation is held. Avoid a row that simply says “Defence: compliant”. It does not tell a colleague what was assessed.
For an early opportunity, some details may still be unresolved. Record the question and the person responsible for obtaining an answer. Do not guess a risk level because a similar previous contract used it. Keep the buyer’s requirement separate from the team’s interpretation.
2. Describe what the evidence covers
Purpose: Prevent a document from being used beyond its established scope.
For each evidence item, record its type, identifier, relevant scope, validity or review date, custodian and approved storage location. The scope might identify an organisational boundary, service or set of activities. Ask the responsible assurance specialist how to interpret it.
Write down the relationship in a sentence: “This evidence is being offered for this requirement, subject to confirmation of this scope question.” That is more informative than attaching a certificate and expecting a reviewer to infer the connection. Do not copy detailed system diagrams or sensitive customer material into a widely shared tracker.
3. Give changes somewhere to go
Purpose: Make the record useful after the tender has been submitted.
Choose a person who receives changes affecting the work. Examples for discussion include a new hosting arrangement, a different delivery site, a new subcontractor or a major change to the service. The owner should route the change to the people authorised to assess its effect.
A delivery team can flag an assumption without deciding the compliance outcome itself. Record what changed, which previous statement it may affect and who will confirm the next step. Agree a review point before the changed work begins where required by the organisation’s process.
4. Track gaps as decisions with owners
Purpose: Keep uncertainty visible without overstating assurance.
Use plain statuses such as “evidence located”, “scope confirmation requested” or “action awaiting buyer response”. Define what each means. A document being available is different from an authorised reviewer accepting it for the intended purpose.
For an unresolved requirement, record the question, owner, agreed next action and target date. Where the formal process calls for an improvement plan, use that process. A local action list does not grant permission to proceed or replace the customer’s decision.
A fictional supplier changes its delivery model
Illustrative exercise: a fictional engineering supplier has prepared evidence for work delivered by its existing team. A new bid introduces a subcontracted testing service. The bid folder contains a current certificate, so the delivery lead initially assumes the assurance material is ready.
The evidence record exposes a missing connection. The requirement belongs to the proposed work, but no one has established how the new testing arrangement affects the evidence or which obligations must reach the subcontractor. The lead records that question and routes it to the buyer and assurance owner through approved channels.
The useful output is a confirmed requirement and a clear action trail. The example deliberately stops before declaring the arrangement compliant. That conclusion needs the appropriate assessment, not a persuasive paragraph in a bid.
Test whether someone else can use the record
Choose one fictional requirement and ask a colleague to locate its owner, evidence reference, review date and open question. Give them no verbal explanation first. If they cannot distinguish an unresolved question from an accepted item, improve the wording.
Keep access proportionate. A bid coordinator may need a status and contact rather than the full technical evidence. A customer review should use the approved route for the underlying material. The record itself may reveal supplier relationships or security gaps, so give it an appropriate owner and handling rules.
Start with one active work package. The next useful improvement is usually a clearer relationship between a requirement and its evidence, rather than a larger collection of attachments.
Sources and review
Sources: MOD ISN 2026/02, 30 March 2026 and MOD Cyber Security Model guidance. These are UK defence supplier references, not universal rules for every defence organisation. The record, statuses and example supplier are original editorial exercises.
You May Also Like
PRINCE2 in Practice: How Structured Project Governance Turns Business Strategy into Controlled Delivery
Six Sigma and the Delicious Dominance of Domino’s Pizza
