Before the defence design review: decide what the shared workspace may contain
A design review starts tomorrow. Someone creates a shared folder, invites the partner team and uploads the latest review pack. The meeting is organised, but an important decision may still be missing: what is this workspace actually permitted to contain?
In defence supply chains, a review pack can combine material with different handling requirements. A publicly available brochure, a customer-supplied drawing and an internal comment thread should not acquire the same sharing decision simply because they sit in one presentation.
This guide offers an original preparation exercise for product, engineering and delivery colleagues. Use fictional material for practice. For real work, follow the contract and the organisation’s security instructions, with questions routed to the responsible security and commercial contacts.
What the June 2026 MOD notice says
Industry Security Notice 2026/04, issued 17 June, explains Security Aspects Letters and contractual security conditions. It replaces the 2025 notice to update links and the DEFCON 658 explanation; it does not describe an entirely new information-handling regime.
The notice says the Contracting Authority identifies project-specific classified aspects and security requirements, with relevant obligations passed to subcontractors and collaborators. It explains when a Security Aspects Letter is required, including OFFICIAL-SENSITIVE or higher aspects, and how uncertainties should be raised with the authority. OFFICIAL-only work still has contractual security obligations even where a letter is not required.
A Security Aspects Letter, often shortened to SAL, helps communicate the security obligations for that work. It is not a generic permission to share a whole project directory. The practical exercise below helps a team turn its established instructions into a clearer review preparation conversation.
Make the sharing decision before building the pack
Start with the review’s purpose. What decision must the invited people make, and what information do they need for it? “Bring everyone up to speed” encourages a broad upload. “Confirm whether the proposed interface meets the agreed mechanical constraint” makes the information need easier to discuss.
Write a short preparation note with the review owner. It should identify the intended audience, proposed material, approved collaboration route, reviewer for uncertain items and date of the decision. Keep the note in an appropriate location. Even its list of documents may reveal information that should not be broadly distributed.
1. Check the audience as well as the folder
Purpose: Connect each invitation to an agreed need.
Ask who needs to participate and in what capacity. A familiar company name does not establish that every account from that company should receive every file. Verify recipients through the project’s approved contact route, including the arrangements for substitutes or additional reviewers.
Consider where the participants will access the material and which organisational rules apply. International collaboration may require additional checks by authorised specialists. Do not infer permission from a calendar invitation, a previous meeting or an account successfully signing in.
2. Separate the material by its approved use
Purpose: Avoid treating a mixed pack as one harmless attachment.
Create an inventory of the items proposed for the meeting. Record the owner, current version and the established handling instruction. Include notes, screenshots, attachments and outputs from earlier reviews. Ask the responsible person to resolve missing or ambiguous instructions before sharing.
An absent marking is a question, not a safe classification decision. Equally, the meeting organiser should not invent a classification based on personal judgement. Ask the authorised owner to confirm the treatment. The exercise is about following an established decision, not making yourself the classification authority.
3. Confirm the workspace can support that use
Purpose: Check the route against the information and recipients.
Ask the responsible administrator or security owner to confirm that this workspace is approved for the proposed material and audience. Discuss guest access, onward sharing, downloads, retained versions and integrations according to the project’s requirements. A commercially reputable platform is not automatically approved for every defence use.
Check where meeting outputs will go too. Recordings, transcripts, automated summaries and exported comments can create additional copies. Include them in the decision rather than assuming the meeting platform and document store share the same approval. Use only the arrangements authorised for the work.
4. Prepare the minimum useful review version
Purpose: Give reviewers what they need for the agreed decision.
Where the owner permits a separate review version, prepare it through the approved process and check the resulting file. Speaker notes, hidden slides, embedded files and comment history deserve attention. Simply hiding a slide does not demonstrate that its contents have been removed from a distributed file.
Record the approved version and the location from which participants should access it. Avoid creating several loosely named copies across chat, email and a meeting folder. If a correction is needed, make the authoritative version and the communication route clear.
A fictional pack with three different needs
Illustrative exercise: a fictional supplier is preparing an interface review. Its proposed pack contains a public product description, a drawing supplied under project-specific handling instructions and an internal note discussing an unresolved issue. The partner needs to review one permitted interface extract, subject to the owner’s confirmation.
The organiser pauses the full-pack upload. The information owner confirms the appropriate review material and sharing route. The internal note is handled separately through the agreed issue process. Participants receive the approved review version rather than the working directory.
Now add a last-minute attendee. The team checks the new person’s need and access before extending the invitation. Being available for the meeting does not itself answer whether they should see the material. This scenario is invented and makes no claim about any real supplier or programme.
Close the review without losing the decision trail
Agree where approved actions and minutes belong, who checks them and how access is reviewed when the work ends. Do not remove evidence or delete material that the contract or retention process requires you to keep. Close collaboration through the authorised process.
For your next preparation session, ask one question early: “Who has confirmed that this version, in this workspace, is appropriate for these recipients?” A clear answer helps the meeting begin with the right information and fewer last-minute assumptions.
Sources and review
Primary reference: MOD ISN 2026/04, 17 June 2026. The preparation note, questions and mixed-pack scenario are original editorial exercises. This guide does not authorise disclosure or determine a classification. Use the applicable project instructions and responsible authority for actual sharing decisions.
You May Also Like
From Developer to Product Owner: a practical transition plan
Japanese management practices for better tech teams: 5 practical examples
