For companies operating within the UK defence supply chain, demonstrating secure data handling is no longer optional. As cyber threats become more frequent and complex, holding the UK’s Cyber Essentials Plus certification is increasingly required for higher-risk contracts.
Robust data governance is critical for military operations as well as the industrial supply chain that supports them. GRiD’s recent success in achieving its Cyber Essentials Plus certification is the ultimate proof that as an SME, GRiD adheres to industry best practices and standards in this critical domain.
This blog considers what industry needs to know about this certification, while demonstrating how GRiD embodies these exact principles of rugged, high-level data security.
An aerial image of the Government Communications Headquarters (GCHQ) in Cheltenham, Gloucestershire.
GCHQ is one of the three UK Intelligence Agencies and forms a crucial part of the UKs National Intelligence and Security machinery. Crown Copyright.
What is Cyber Essentials?
Supported by the UK Government and managed by the National Cyber Security Centre (NCSC), Cyber Essentials is a foundational cybersecurity standard. It focusses on five core technical controls: boundary firewalls, malware protection, patch management secure device configuration, and strict user access control.
Whilst the standard Cyber Essentials involves a verified self-assessment, Cyber Essentials Plus raises the standard significantly. To add a highly robust layer of security, it requires independent verification of your controls, potentially highlighting areas of internal IT systems that require upgrading and changing.
The “Plus” distinction is a highly rigorous process whereby companies are thoroughly audited and technically assessed by an independent, qualified third party. The assessors perform hands-on verification and vulnerability scans on your active network and devices to prove your defences work in real-world scenarios.
What are the expectations?
The Ministry of Defence (MoD) and Tier 1 Prime contractors expect full compliance. To pass the audit, companies must show strict adherence to rules like applying critical security patches within 14 days and enforcing Multi-Factor Authentication (MFA) across all cloud and administrative accounts. At every entry point into your business, you must be actively hardened against opportunistic and targeted cyber threats.
Why this matters to defence companies
If you want to win or maintain business in the UK defence ecosystem, this certification is critical for four distinct reasons:
- A strict contractual prerequisite: Under regulations like Defence Condition (DEFCON) 658, holding Cyber Essentials is a legally mandatory requirement if your contract involves MOD-Identifiable Information. For moderate-to-high risk projects, Cyber Essentials Plus is non-negotiable before work even starts.
- The Defence Cyber Certification (DCC) framework: Tied to DEFSTAN 05-138, the DCC framework assesses a supplier’s cyber resilience across multiple tiers. Cyber Essentials serves as the mandatory baseline for this framework; if your certification lapses, your entire DCC compliance fails, placing your contracts in breach.
- Supply chain obligations: Primes are contractually obligated to flow these security mandates down to their subcontractors. If a supplier cannot produce a Cyber Essentials Plus certificate, it is unlikely they will be considered for tenders.
- Protecting state-level IP: Defence suppliers are high-value targets for nation-state hackers. Hardening your perimeter ensures that critical military IP cannot be compromised through simple, low-level digital exploits.
The Defence Cyber School (DCS) is the primary provider of cyber training and education to both joint and single service organisations. Located in Shrivenham, it is part of the Defence Academy of the United Kingdom. UK MOD © Crown copyright 2023
GRiD has proven that even as an SME, undertaking this rigorous certification sends a powerful message to the market: the team can be a trusted partner with its high-level data governance and security.
If you want to learn more on GRiD’s product range, please see here or if you would like to discuss how GRiD can support your operations or upcoming requirements in more detail, please get in touch sales@griduk.com.
