TL;DR: DCC obligations don't stop at the MOD's direct suppliers — they flow downstream. Tier 1 MOD contractors are now required to assess and manage cyber risk in their own supply chains. That means IT providers, software vendors, and managed service providers supporting those contractors can find themselves in scope. Your clients may already be asking about your cyber security posture — and they have good reason to. Having Cyber Essentials and ISO 27001 in place puts you ahead of the question before it becomes a problem. A client calls and asks...