In the dynamic and rapidly evolving landscape of land equipment for defence, the imperative for robust supply chain security has never been more critical. Supply chain security is critical, especially during crises when timely and reliable delivery is vital. The long lifecycle of most military equipment further complicates this, requiring secure, sustained logistical support, upgrades, and modernisation over many years.
The Ministry of Defence (MOD) has recognised this priority, expecting industry partners to embrace comprehensive security measures that span physical, personnel, procedural, and technical domains. As cyber threats continue to escalate, defence suppliers are now expected to adopt a proactive, risk-based approach to security, ensuring the integrity and resilience of their operations and products. This is where CDS Defence & Security (CDS DS) steps in as a pivotal ally, offering expertise and guidance to simplify, understand and implement these complex security requirements effectively.
Supply chain security is paramount in the defence sector, where the stakes are exceptionally high. Cyber espionage poses a significant threat, enabling adversaries to gather intelligence, steal intellectual property, and potentially sabotage operations, both virtually and physically. The consequences of such breaches are severe, leading to financial loss, reputational damage, and even threats to national security and human lives. The MOD and its suppliers must be vigilant in mitigating these risks, which are not confined to cyber threats alone. Employees with authorised access to sensitive information and technology can inadvertently or deliberately cause security incidents, leading to data breaches and operational disruptions.
Over the last five years, numerous breaches have been witnessed among global defence suppliers, often perpetrated by state-backed cyber threats. The MOD provides extensive guidance and support to suppliers, outlining security expectations and requirements through bid and contract processes. However, these expectations can sometimes be overlooked or under emphasised in the rush to secure and deliver contracts. Suppliers, particularly those new to the defence sector, may need help understanding and implementing these requirements pragmatically and cost-effectively.
As technology advances, securing critical assets becomes increasingly complex. The MOD has introduced the Secure by Design (SbD) framework to address these challenges, embedding security into every aspect of system design and development. Launched on July 28, 2023, SbD represents a proactive approach to cybersecurity, moving beyond traditional reactive measures, and embedding security measures into the development lifecycle of systems. By integrating security from the outset, SbD ensures that MOD and its partners are equipped to defend against emerging cyber threats effectively.
The benefits of SbD include:
Our expert team of cyber security experts at CDS DS has worked hard to understand the MOD’s expectations of the recently introduced SbD framework. In doing so, we have developed a six-step approach to understanding and implementing its expectations. We have proved the approach already with several MOD sector industry organisations with great success. We can offer a quick maturity assessment against your existing SbD arrangements and/or help you to implement everything from scratch.
Our 6-step process is built on principles that emphasise resilience, security risk reduction and robust safeguards:
This methodology aligns with the National Institute for Standards in Technology Cyber Security Framework (NIST CSF). Since March 31, 2024, all programs, projects, and systems transitioned to SbD upon the expiration of their current legacy accreditation. SbD is now in effect.
All defence suppliers must store, handle, and process at least OFFICIAL tier classified information and will be risk assessed using the MOD’s Defence Cyber Protection Partnership’s (DCPP) Cyber Security Model (CSM). These security expectations apply to both prime contractors and their subcontractors. Suppliers are assessed through the MOD's Octavian portal (or manually) to determine their risk profile—Very Low, Low, Moderate, or High—which dictates the necessary security controls.
Suppliers must achieve at least Cyber Essentials Basic, with Cyber Essentials Plus often required. The MOD conducts audits to ensure compliance with DCPP CSM requirements. Additionally, personnel accessing MII must be vetted to at least the Baseline Personnel Security Standard (BPSS).
Security expectations for systems handling SECRET information still need to meet SbD principles and CSM expectations. This demands more stringent security arrangements than those for lower classifications. Personnel accessing SECRET information must be SC cleared at minimum, with BPSS allowing occasional access. Developed Vetting (DV) is required for higher classifications and sometimes for SECRET roles with privileged access.
A Facility Security Clearance (FSC), approved and periodically audited by the MOD, must be attained and maintained. This clearance focuses on physical and personnel security, requiring measures like CCTV, Automated Access Control Systems (AACS), and approved alarm systems. Additionally, at least 50% of the company's Board must be UK Nationals, and there must be a nominated Security Controller and, if applicable, an Cyber Security Officer (CSO). A Board-level UK National must oversee all security matters related to SECRET information.
CDS DS offers invaluable support to defence suppliers navigating MOD security requirements and the transition to SbD. With certified security experts and years of MOD experience, CDS DS provides cyber security consultancy and virtual security manager support, helping suppliers achieve Cyber Essentials certification and meet the stringent security standards outlined by the MOD. By partnering with CDS DS, suppliers can ensure they remain trusted providers of resilient and secure land equipment capable of withstanding the cyber threats of today and the future.
CDS D&S offers comprehensive support throughout the SbD process:
By leveraging CDS D&S' expertise, organisations can effectively implement SbD, strengthen their cyber defences, and build lasting resilience.
CDS D&S also supports ongoing SbD alignment by:
In conclusion, the defence sector's focus on supply chain security and the adoption of Secure by Design are critical steps towards safeguarding national security CDS DS stands ready to assist suppliers in this journey, providing the expertise and guidance needed to meet the MOD's rigorous security expectations and deliver resilient, secure products to the defence community.
Would you like to know more about a specific aspect of Secure by Design or CDS D&S' services?
Our experts will be available at DVD 2024 to share insights into our comprehensive services and discuss cyber in defence, supply chain security and SbD.
Book an appointment to visit us at stand C3-608 today.