Defence supplier due diligence: how to assess security, capacity and delivery risk

Defence supplier due diligence should test whether a company can lawfully receive the work, protect the information involved, deliver the required configuration at the required rate and remain financially capable throughout the contract. The assessment must be specific to the work package, country, classification level and delivery schedule. A recognised customer, certification or framework place is useful evidence, but none substitutes for verification of the facilities, people, suppliers, funding and controls needed for the proposed contract.

What should a defence supplier assessment cover?

Begin by defining the unit of assessment. A legal entity may belong to a larger group, share facilities with an affiliate and depend on subcontractors that are not named in the bid. Record the contracting entity, beneficial ownership, operating sites, proposed work package, countries of performance and information classification. Then map which entity owns the intellectual property, employs the key personnel, holds the approvals and will accept contractual liability. Group reputation should not be used to fill gaps in the evidence of the entity that will perform the work.

How should eligibility, ownership and security be verified?

Test legal and procurement eligibility against the particular procedure. Directive 2009/81/EC provides the EU framework for many defence and sensitive-security contracts and permits contracting authorities to examine economic standing, technical ability, security of information and security of supply. National rules, exclusions and Article 346 TFEU decisions can change the route. Confirm registrations, licences, export-control status, sanctions screening and conflicts of interest with competent legal and procurement specialists rather than treating an EU establishment as automatic eligibility.

Ownership and control require more than a shareholder list. Identify ultimate beneficial owners, voting rights, board appointment powers, financing covenants, material state links and rights over sensitive technology. Consider how an acquisition or new investor could affect licences, security approvals or customer consent. The EU foreign direct investment screening framework shows why ownership of critical technologies and supply can attract public-interest review, although decisions remain subject to applicable national processes.

Security evidence must match the work. Establish which personnel, premises and information systems need clearance or accreditation; who sponsors those processes; and whether the timetable is compatible with mobilisation. Review segregation of classified and unclassified work, visitor controls, remote access, incident reporting and the handling of controlled technical data. A corporate security policy is only the starting point. Ask for the supported site, system boundary, approval status and evidence that relevant employees understand the procedures they will use.

How can capacity and supply-chain claims be tested?

Assess industrial capacity through the proposed configuration and delivery curve. Reconcile bill-of-material requirements with qualified suppliers, tooling, test equipment, skilled labour, yield, maintenance downtime and realistic ramp assumptions. Separate installed capacity from demonstrated output and reserved capacity from capacity shared with other customers. Commission Recommendation 2018/624 stresses proportionate, contract-specific requirements for security of supply and information. A useful review therefore connects every capacity claim to the quantities, dates and contingencies in the contract under consideration.

Map the critical supply chain beyond the first tier. For each component that could stop delivery, record the manufacturer, production location, lead time, approved alternatives, export constraints, minimum order quantities and evidence of stock or allocated capacity. Test whether substitution would require redesign, requalification or customer approval. Flow down quality, cyber, traceability, security and notification obligations explicitly. A prime contractor’s assurance is weaker when it cannot identify the sub-tier dependency on which that assurance relies.

Which cyber and financial risks matter before award?

Cyber due diligence should focus on the systems that support design, production, maintenance and delivery. Review asset ownership, privileged access, supplier access, backups, vulnerability management, incident response and recovery exercises. NIS2 places risk-management and reporting duties on covered entities and highlights supply-chain security, but legal scope and national implementation must be checked. Contractual requirements may exceed the statutory baseline. Verify how the supplier will notify the customer, preserve evidence and continue priority work after an incident.

Financial analysis should test the ability to finance the delivery schedule, not merely the latest balance sheet. Model customer advances, inventory purchases, supplier deposits, milestone billing, retention, warranty exposure and the cost of a delayed acceptance. Examine covenant headroom and dependence on grants, a future funding round or one dominant customer. A growing order book can increase working-capital pressure before it creates cash. Ask management to reconcile the proposed programme’s peak funding need with committed liquidity and credible contingency actions.

How should the decision be recorded and monitored?

Convert the review into a documented decision. Use weighted criteria tied to contract consequences, identify evidence owners and distinguish a condition precedent from a risk that can be monitored after award. High-impact gaps may require an on-site assessment, sample traceability exercise, cyber remediation, parent guarantee, dual-source plan or staged contract. Do not average away a disqualifying weakness with high scores elsewhere. The output should show what was verified, what remains an assertion, which assumptions were used and who accepted each residual risk.

Due diligence continues after selection. Track clearance progress, sub-tier changes, capacity milestones, non-conformities, cyber incidents, ownership changes and financial indicators against agreed thresholds. Reassess when scope, classification, geography or volume changes. The acquisition approval guide addresses transaction-related controls, while the security-clearance guide explains bid-stage evidence. Together, these checks turn a supplier profile into a contract-specific view of delivery risk.

The framework is not a substitute for legal advice, government security direction, technical qualification or an audit conducted under the relevant contract. Its purpose is to organise the questions and evidence so that procurement, engineering, security, finance and programme teams reach a traceable decision. The stronger conclusion is not that a supplier is generally safe or unsafe, but that the identified entity is or is not ready for a defined work package under stated conditions.