Solution Brief: DCC/DEFSTAN Compliance

The Situation

You’re a defence innovator with customers in UK or Allied defence services and agencies, and now you need to comply with DEFSTAN 05-138 or obtain Defence Cyber Certification standing. Maybe it’s a contractual requirement, a pre-qualification condition, or a customer expectation that can’t be ignored.

It’s not simple. These frameworks overlap with standards like Cyber Essentials Plus, ISO 27001, and NIST 800-171, each demanding specific technical controls, documentation, and assurance evidence. For many organisations, especially innovative defence startups or SMEs, it’s difficult to know where to begin or how to interpret the requirements correctly.

You want to move fast and meet obligations without getting bogged down in compliance jargon. What you need is a clear path to satisfying expectations and keeping your business focused on what it does best.

What's Important?

DCC and DEFSTAN compliance isn’t just a contractual checkbox. Defence customers and prime contractors expect suppliers to show that they can protect sensitive defence information. Ignoring compliance can lead to lost opportunities.

Getting compliance right builds credibility, proves reliability, and keeps you eligible for valuable MoD contracts and partnerships. Getting it wrong can delay project approvals, create uncertainty with clients, or even jeopardise existing work.

Questions to consider

  • Are you tracking the level of DEFSTAN and DCC compliance your organisation requires?

  • Can you evidence your security measures and procedures to an auditor or MoD assessor?

  • Are your systems ready to handle classified or sensitive defence information?

  • How will you maintain compliance as your contracts and technologies evolve?

How we can help

We help organisations interpret, implement, and maintain compliance with DEFSTAN 05-138, DCC, and related MoD frameworks. Our team includes former RAF cyber and information security experts who have managed and enforced these very requirements inside the Ministry of Defence. They bring first-hand knowledge of both the policy intent and how compliance is evaluated in practice.

Our AEGIS service builds on the core capabilities of MIDAS, adding the technical controls and consulting needed to bring your organisation up to the required level of DCC and DEFSTAN compliance.

AEGIS offers a fast, reliable path to compliance by leveraging proven design patterns, baseline controls, and tested policies that meet both the intent and the specifics of MoD standards.

We begin by assessing your current security posture against the relevant requirements, then close the gaps efficiently and effectively. Once compliance is achieved, our managed services maintain alignment through ongoing monitoring, configuration management, and updates as the standards evolve — so you remain audit-ready and contract-ready at all times.

What You'll Gain

  • Confidence that you meet DCC and DEFSTAN 05-138 requirements

  • Accelerated compliance through our AEGIS service built on proven frameworks

  • Guidance from experts with direct MoD and RAF experience

  • A clear, achievable roadmap to compliance and assurance

  • Ongoing support to sustain compliance and adapt to new requirements

  • The credibility and trust to compete and win in the defence supply chain

Nova Blue Technologies Ltd is registered in England and Wales with company number 12840005 and VAT number 363524891.

© 2025 Nova Blue Technologies Ltd

Powered by Growably
Website Terms and Conditions
Privacy Notice

Registered Address: Staverton Court, Staverton, Cheltenham, Gloucestershire, GL51 0UX