Rob Demain

In preparation for my speaker slot at the inaugural West Midlands Defence Procurement Event tomorrow, I’ve been reflecting on my key observations about navigating the Defence Cyber Certification (DCC) scheme. As early adopters of the framework, operating as an IASME accredited Level 1 Certification Body, Assure Technical has gained certification, in addition to certifying numerous clients. This dual experience has provided us with the critical observations and practical insights needed to support defence supply chain partners in making an effective, seamless transition to DCC, no matter which level your contracts demand. The biggest takeaway from the frontline is simple: you need to start the process early. Giving your business the runway to prepare before an impending tender deadline completely changes the dynamic. Taking a proactive head start allows you to focus on three critical areas: 🕰️ Start Preparing Early: You are required to provide concrete evidence that you actively comply with each control. This involves a significant amount of preparation for Level 1 certification and above. 🔍 Engage a DCC Certification Body Upfront: Don’t wait for the formal evaluation. Bringing in an accredited CB for a preliminary gap analysis gives you an objective view of your data flows, systems and policies - allowing you to effectively define your scope and prioritise changes. ⚙️ Embed routines before the rush: True readiness isn’t achieved by a last-minute scramble to pass an audit. Getting ahead of the timeline gives your team the space to weave baseline checks into standard daily routines, meaning your compliance evidence gathers naturally in the background. I’ll be diving deeper into these field insights tomorrow, joining @RyanProtheroe to explore realistic, grounded approaches to business governance. Entrance to the event is free, so why not pop down to Millenium Point in Birmingham. 👉 Explore our Defence Cyber Certification services: https://hubs.la/Q04l0_R60 #CyberSecurity #DefenceProcurement #SupplyChainResilience #DCC #AssureTechnical #BusinessGovernance #DPC2026

9

A few years back, we carried out an IT Health CHECK for a well-known UK council. They had a vulnerability management solution in place, so we took a full sample of the data. What we found was staggering: around 30,000 high-criticality vulnerabilities. We presented the findings. The response was hostile, to put it mildly. We were told their previous ITHC supplier had only assessed 10 percent of the estate, and the council chose the sample themselves. One quote stuck with me: “We can’t possibly patch all that in time for you to issue a clean report.” We explained that the report was a point-in-time assessment and couldn’t be changed. They refused to share it with the PSN team, saying it would be too damaging. Instead, we got pushback: “We won’t be using you next year.” “We’re one of the most secure councils in the UK.” I then issued a heavily caveated report (my team had already downed tools!), clearly stating: “We only assessed the scope provided by the client. Systems outside this scope were not assessed.”. For those in the know, this means "the client chose their own scope", and is sufficient coverage if things outside that scope were then breached at a later date. That version, along with a remediation action plan (RAP), presumably written by the client, was then submitted to the PSN team, and I was told "it passed". We weren’t invited back the following year. I’ve been doing this sort of work for 30 years. I’m thick-skinned. But I do get upset and stressed when my team's professionalism and integrity are questioned. I take it personally. Over time, I’ve developed strong consulting and customer-facing skills to manage these situations, but the industry needs to do better. Integrity should never be negotiable. Does anyone else have experience of being put into awkward situations by clients, whom want to save face rather than admit to systemic security flaws?

4