Defence · prove the chain

If a prime or a regulator asked tomorrow, could you prove it?

Cyber flow-down, sanctions, forced-labour duties — they bind several tiers below you, on deadlines already set. There’s a difference between asserting your chain is clean and being able to evidence it.

Settled as the Compliance Evidence Pack

Bring us the decision Other decisions

The exposure

Most obligations are met by assertion until the day they’re tested. An Evidence Pack draws the boundary between what your records actually prove and what you’d have to reconstruct under a probe — before the prime, the auditor or the regulator draws it for you.

What the Compliance Evidence Pack settles

What you can evidence — and what you’d have to reconstruct.

Can you evidence it, or only assert it?

The boundary between what your records prove to the standard and what you’d have to reconstruct under scrutiny.

Where does the obligation bind below you?

Cyber flow-down, sanctions and forced-labour duties several sub-contracting tiers down — where the gap usually hides.

Are you ahead of the clock?

Mapped against the dated deadlines already binding you — so remediation goes to the genuine gaps first.

Typical reader: a contracts, compliance & assurance lead.

Why now

The clocks are already running.

The MOD’s Cyber Security Model v4 is now mandatory and cascades to the end of the chain; the UK Sanctions List became the single source in January 2026; the EU forced-labour regulation, now in force, begins to bite from its 2027 application date. The deadlines are set — the question is whether you can evidence the chain before they’re tested. See what changed →

If a prime or a regulator asked tomorrow, could you prove it?

What you can evidence — and what you’d have to reconstruct.

The clocks are already running.

Name the obligation you’re on the clock for.