UK Defence Market Entry for US Suppliers | MOD Bids | Glaxtons

Glaxtons Consulting

For United States defence suppliers

Selling into UK defence, from the United States

The UK market is open and the policy direction favours new entrants. What stops US suppliers is rarely access. It is the assumptions carried across the Atlantic: that a US clearance transfers, that CMMC satisfies MOD, that you need a facility clearance before you can bid. None of those are true, and each one costs months.

Cleared support

Consultants cleared to Baseline Personnel Security Standard and Security Check, with Developed Vetting cleared personnel available where a requirement demands it.

Talk to a director +44 20 3668 5488

Why the timing is unusually good

The Defence Industrial Strategy 2025 committed to increasing MOD spending with small and medium-sized enterprises by £2.5 billion by 2028, and to raising direct SME spend by 50 percent by May 2028. It created a Defence Office for Small Business Growth and an SME Commercial Pathway, appointed a National Armaments Director, and announced a new UK offsets regime and an Office of Defence Exports.

For a mid-sized US supplier that is a stated policy tailwind rather than a hopeful reading of the market. MOD is under public commitment to move money towards smaller and newer suppliers, and it has built institutional machinery to do it.

The offsets regime cuts the other way and is worth understanding early. A new regime points towards commitments to place value back into the UK economy on significant awards, which rewards suppliers who have built genuine UK relationships in advance and penalises those who arrive with commitments they cannot deliver. Detailed policy has been emerging rather than arriving complete, so confirm the current published position rather than planning against summaries.

The four assumptions that cost US entrants the most

These come up in almost every first conversation, and each one is expensive in a different way.

That a US clearance transfers

It does not. A cleared American engineer is, for UK classified purposes, an uncleared person until a UK clearance is sponsored and granted. Lead times run to months and clearances cannot be bought off the shelf.

That you need facility clearance to bid

You generally do not. MOD guidance is that facility security clearance is not a prerequisite for bidding other than in exceptional circumstances. It also cannot be requested, only sponsored, so pursuing it before you have a sponsor is a dead end.

That CMMC or NIST 800-171 is enough

It is not recognised as equivalent. UK defence cyber runs through the Cyber Security Model and Defence Standard 05-138, with a risk profile per contract and controls that must be in place by contract start, evidenced via the Supplier Assurance Questionnaire.

That the best technology wins

UK evaluators score against published criteria, and social value is a weighted criterion with no US equivalent. A superior solution written for a technical reviewer loses to an adequate solution written for the scoring scheme.

The eight things to get right

Roughly in the order they bite. The first three decide whether you can operate at all, the middle three decide whether you can win, and the last two decide whether a win is worth having.

UK entity, and foreign ownership control or influence

A US parent cannot simply extend its own clearances across the Atlantic. MOD requires that foreign ownership, control or influence cannot be exerted over a facility handling UK classified material, and satisfying that is a structural question about your UK entity rather than a form to complete.

The trap: Assuming the UK works like the US in reverse. American suppliers arrive familiar with FOCI mitigation, Special Security Agreements and DCSA, and reasonably expect a mirrored process. The UK regime has the same underlying concern and different mechanics, different terminology and a different sponsor model. Mapping your existing US arrangements onto MOD assumptions is the most common source of wasted months.

UK entity, and foreign ownership control or influence in detail

Facility Security Clearance, formerly List X

List X is now Facility Security Clearance. FSC lets a contractor hold and process classified material on its own premises, it cannot be applied for on request, and it is not a prerequisite for bidding in most cases. Every one of those three facts routinely surprises US entrants.

The trap: Trying to get cleared before you have anything to be cleared for. FSC is sponsored, not requested, and a supplier with no contract, no prime relationship and no government sponsor has no route to it. The correct sequence for most US entrants runs the other way: win or subcontract on work that does not require it, build the UK relationship, and let the sponsorship follow the requirement.

Facility Security Clearance, formerly List X in detail

Personnel security clearances and cleared people

UK personnel clearances run from Baseline Personnel Security Standard through Security Check to Developed Vetting. They are sponsored, they take time, and a US clearance does not transfer. For a new entrant, cleared people are frequently the binding constraint rather than capability or price.

The trap: Assuming a US clearance carries across. It does not. A cleared American engineer is, for UK classified purposes, an uncleared person until a UK clearance is sponsored and granted. Bid programmes built on the assumption that existing group personnel can simply be deployed tend to discover this at the point where it is most expensive to fix.

Personnel security clearances and cleared people in detail

Cyber: Defence Standard 05-138 and the risk profiles

Every MOD contract carries a cyber risk profile of Very Low, Low, Moderate or High, and that profile dictates the controls you must hold under Defence Standard 05-138. Compliance is contractual, it flows down to your subcontractors, and it has to be in place by contract start.

The trap: Assuming NIST 800-171 or CMMC compliance satisfies MOD. It does not map across. A US supplier with a mature security posture is in a good starting position, but the UK regime asks for evidence against its own control set and its own questionnaire, and the assessment is contractual. Budget for the translation exercise rather than expecting recognition.

Cyber: Defence Standard 05-138 and the risk profiles in detail

JOSCAR and supplier qualification

JOSCAR is the shared supplier qualification system used across UK defence and aerospace. One qualification is recognised by multiple buyers instead of each running its own assessment, which makes it the practical front door to the UK prime supply chain.

The trap: Treating JOSCAR as a directory listing. It is a qualification consumed by buyers making real decisions about whether to invite you, and a thin or stale profile is worse than a considered one. It also surfaces gaps early, which is useful, but only if you act on what it surfaces.

JOSCAR and supplier qualification in detail

MOD routes to market and where the money is

The Defence Industrial Strategy 2025 set a target to increase MOD spend with SMEs by £2.5bn by 2028 and to raise direct SME spending by 50% by May 2028, supported by a Defence Office for Small Business Growth and an SME Commercial Pathway. For a mid-sized US supplier, that is a stated policy tailwind.

The trap: Bidding prime too early. A US supplier with excellent technology, no UK delivery record and no UK entity will lose prime competitions to firms the evaluator already knows, and will lose them expensively. The faster route is almost always a subcontract position that builds referenceable UK delivery, followed by prime bids once there is a track record an evaluator can verify.

MOD routes to market and where the money is in detail

UK offsets and industrial participation

The Defence Industrial Strategy 2025 announced a new UK offsets regime. For a US supplier winning significant UK defence work, that points towards commitments to place value back into the UK economy, and it is a question a board should be asking before bidding rather than after winning.

The trap: Treating industrial participation as a post-award compliance exercise. Commitments made in a bid without a supply chain behind them become obligations you cannot deliver, and the relationships that make them real take a year or more to build. This belongs in the entry strategy, not in the mobilisation plan.

UK offsets and industrial participation in detail

ITAR, export control and technology transfer

US-origin defence technology stays subject to US export control after it crosses the Atlantic. Deciding what can be shared, with whom, and under what authorisation is usually the first hard constraint on how a US supplier can structure its UK offer.

The trap: Leaving export control to the end. A delivery model designed for UK evaluation and then tested against ITAR frequently has to be rebuilt, and the rebuild lands after the bid has been priced. Export control belongs in the solution design conversation, not in the legal review.

ITAR, export control and technology transfer in detail

US suppliers entering UK defence: common questions

Can a US company win UK MOD contracts?

Yes. The UK defence market is open to overseas suppliers and current policy is actively favourable to new entrants. The Defence Industrial Strategy 2025 set a target to increase MOD spending with SMEs by £2.5bn by 2028 and to raise direct SME spend by 50% by May 2028, supported by a Defence Office for Small Business Growth and an SME Commercial Pathway. Market access is rarely the constraint. Verifiable UK delivery record, cleared personnel and UK-specific compliance usually are.

Do we need a UK entity and a facility clearance before we can bid?

Usually neither, and this is the most expensive misconception US suppliers arrive with. MOD guidance is that facility security clearance, the regime that replaced List X, is not a prerequisite for bidding other than in exceptional circumstances. It also cannot be applied for on request: it must be sponsored by a contracting authority. A UK entity becomes necessary for some work and not for other work, so test it against your actual target opportunities before spending on it.

Does our US security clearance transfer to the UK?

No. UK personnel clearances are granted under the UK regime and sponsored by a UK organisation against a genuine need, and they run from Baseline Personnel Security Standard through Security Check to Developed Vetting. A US-cleared employee is, for UK classified purposes, uncleared until a UK clearance is sponsored and granted. Lead times run to months, so this belongs in your capture planning rather than your mobilisation plan.

Does CMMC or NIST 800-171 satisfy MOD cyber requirements?

Not automatically. UK defence cyber runs through the Cyber Security Model and Defence Standard 05-138, with each contract assigned a risk profile of Very Low, Low, Moderate or High that dictates the controls required, evidenced through the Supplier Assurance Questionnaire. Existing US compliance is useful groundwork because the underlying controls overlap, but you will need to evidence against the UK standard, and the controls must be in place by contract start.

What do UK evaluators score that US contracting officers do not?

Social value, above all, and it catches nearly every US entrant. UK public procurement scores committed social and economic benefit as a weighted criterion, and the model is changing again under PPN 026 for procurements commencing from January 2027. Expect also to evidence UK supply chain commitments, and to write for an evaluator scoring against published criteria rather than for a technical reviewer assessing a solution.

Should we bid prime or subcontract first?

For most US entrants, subcontract first. Prime competitions weight verifiable delivery record heavily, and a UK evaluator cannot easily verify US performance. A subcontract position behind an established UK prime builds referenceable UK delivery while your clearances and compliance mature, and it makes a later prime bid credible rather than speculative.

How long does UK market entry realistically take?

Plan in years rather than quarters for a serious position, and in months for a first subcontract opportunity. The long poles are personnel clearances, cyber compliance evidence and building a UK delivery record. What can be done quickly is qualifying whether the market is worth it at all, which is the decision most US boards actually need first.

Reviewed 22 August 2026 against MOD published policy including the Facility Security Clearance policy and Defence Standard 05-138, and against the Defence Industrial Strategy 2025. Nothing here is legal, export control or security advice. Defence policy moves, and the offsets regime in particular is still emerging, so confirm the current published position before planning around anything on this page.

Is the UK worth it for what you sell?

That is the question a US board actually needs answered first, and we will answer it straight, including when the answer is not yet. A director replies, and we work US hours by arrangement.