Skip to content
Westmark Assurance

Home › Defence Supplier Mark

Westmark Defence Supplier Mark

Prove how you handle security risk on the work you actually deliver

An independent assessment for organisations delivering into the Ministry of Defence, government and government-aligned contracts, at any size from a sole director upwards. Scored against a published standard, reviewed before issue, and shown on a public register.

Talk to us about an assessmentDownload the brochure (PDF)

Assessments open October 2026. Enquiries and scoping are open now.

Saint Mary Axe, London. Nick Fewings on Unsplash.

Is this for you

Government describes Secure by Design as an approach, and certification against it sits outside what any body offers. Security duties reach you through Security Aspects Letters, Defence Conditions, Defence Standards and Industry Security Notices, and a prime assessing you usually does the work itself or takes a self-declaration on trust. The Defence Supplier Mark gives both of you an independent judgement to rely on.

The mark is for you if

  • You deliver, or bid to deliver, work into the Ministry of Defence, another government department or a government-aligned contract
  • A prime or a buyer has asked for evidence of your security arrangements and you want to answer once, properly
  • You want to be judged on what your delivery records show
  • You are a sole director, a small practice or a larger firm. Fees are banded by size, so the scheme reaches all of them

Who can commission it

  • The supplier itself, to hold a mark it can show to any buyer
  • A prime or a department, as a commissioning party, to have a supplier in its chain assessed. The commissioning party sees the outcome through a disclosure link in the hub

Choose a scope

  • OperationalThe requirements marked for Operational scope, across all seven sections
  • CyberThe requirements marked for Cyber scope, which bring in Section 5, cyber and technical security
  • BothOne assessment, one register entry, both scopes shown

What is examined

Seven sections and fifty-four requirements, all published in advance in the Control Set, so nothing on the day is a surprise.

  1. S1Governance and accountability6 requirements, 15% of the score
  2. S2Risk management and project implementation9 requirements, 20%
  3. S3Contractual, statutory and personnel security10 requirements, 20%
  4. S4Information and asset handling9 requirements, 13%
  5. S5Cyber and technical security9 requirements, 12%. Assessed at Cyber scope
  6. S6Incident management and continuous assurance6 requirements, 10%
  7. S7Supply chain5 requirements, 10%. Where you use subcontractors

How the evidence is judged

  • The assessor selects between three and six of your own engagements and works from what the delivery generated
  • Records made while doing the work are the evidence that scores
  • Delivery staff are interviewed on their own, unless the worker asks otherwise
  • Full marks on any requirement need evidence from more than one independent source
  • Eleven disqualifying conditions apply. Any one of them stops a mark regardless of the score

How it runs

The same seven steps under both schemes. Every one happens in the Westmark hub, and every screen says whose turn it is and what is waiting. From agreement to outcome we plan on four to eight weeks, set with you at scoping.

  1. Westmark and you

    Scope

    What you deliver, for whom, and which scope fits.

  2. Westmark, then you

    Quotation and agreement

    Issued in the hub and accepted on screen. Nothing is signed until both are in writing.

  3. Westmark

    Assessor assigned

    Authorised for the scheme and the scope, and independent of any advice you have had.

  4. You

    Self-assessment

    Plain questions in the hub, one for each requirement. It tells the assessor where to spend the time.

  5. Your assessor

    The assessment

    Documents, delivery records, observation and interviews. Anything adverse is put to you before it settles.

  6. A second assessor

    Technical review

    Somebody independent of the assessment confirms the record or returns it with reasons.

  7. Westmark

    Outcome and register

    Documents issued in the hub, the entry published, and the claim wording sent to you.

How assessment works, in full

The three outcomes

Every outcome carries a confidence level, which answers a different question from the score: how good was the evidence behind it.

  • Defence Supplier Mark

    Overall 80 per cent or above, every section above 50, no disqualifying condition met.

    On the register for twenty-four months, with an annual declaration at twelve.

  • Defence Supplier Conditional

    Overall 60 per cent or above, with improvement actions attached and completable within three to six months.

    A positive outcome, and common on a first assessment. Published on the register. Once the actions are verified complete it converts to the full Mark for the rest of its period.

  • Not Confirmed

    Below 60 per cent, or a disqualifying condition met.

    No certificate is issued and nothing appears on the register.

What it costs

Fees are calculated on assessor days, banded by the size of the organisation and the scope assessed. The whole fee is quoted in writing before anything is signed.

Basis
Assessor days, banded by organisation size and scope
Smallest band
A band 1 organisation of up to five staff starts at one assessor day
Reductions
Holding Defence Cyber Certification or ISO/IEC 27001 reduces the day count
After a positive outcome
An annual scheme fee, covering the register listing, the licence to use the mark and review of the annual declaration
Quotation
Issued in the hub, in writing, before agreement. Scoping itself costs nothing

Getting ready

Most organisations find gaps on a first read of the Control Set, and scoping, which is where they surface, costs nothing. Where you want help, Westmark introduces you to a Licensed Partner: a consultancy Westmark has approved, whose consultants work with your people so the arrangements are built around the work you actually deliver and belong to you.

What a partner does

  • Goes through the published Control Set with you and says plainly what is missing, before anything is booked
  • Advises on what each requirement is really asking, then works with your people so the procedures, screening and handling records are yours
  • Stays with you between assessments, so the annual declaration is quick to complete

Kept apart from the judgement

  • During the assessment you speak for yourself, and the partner stands aside
  • Your assessor is always independent of your partner. The hub enforces that automatically at assignment

Ask us to introduce a partnerHow the partner arrangement works

Free guidance on the four areas of security, for any organisation to use

Documents for this scheme

Assessing a supplier, or being assessed?

Tell us what you deliver and to whom. We will come back with the scope, the timetable and the fee.

Make an enquiryVerify a mark