defoneos.mod/delivery-accreditation · csoai.org · ship-grade · tick 93

UK SC-Cleared Delivery Accreditation Playbook

The single playbook DEFONEOS uses to plan first SC-cleared delivery to UK government. 5 named stages gate-gate, 12 person-month Statement-of-Capability, £450k costed path, named CCP-equivalent roles, named referees, and SIGIL-anchored audit trail.

Total stages (gate-gate)5 (S1–S5)

Person-month effort12 PM over 18 months

Costed path (central scenario)£450k (range £380k–£620k)

First accredited deliveryQ3 2027 (Month 18)

Named CCP-equivalent roles6 (CSO / CTO / DPO / IAO / SIRO / IA Auditor)

Document versionv0.4 · 2026-07-13 · SIGIL T93-accreditation-a8e3f1c6b9d2

1 · Why SC Clearance + Accreditation Matter

UK Security Check (SC) clearance is the entry-level national-security vetting for routine access to OFFICIAL-SENSITIVE and occasional SECRET assets. DEFONEOS cannot deliver AI substrate to UK government without named-cleared principals and an audited delivery process. This playbook covers both — the personnel clearance (Nick + 5 named roles) and the delivery accreditation (5-stage gate-gate audit chain).

Three sources of authority: GovS 007 (Personnel Security), GovS 008 (Physical & Personnel Security for Protecting Parties), ISO 27001 + 27002 (Information Security Management). DEFONEOS passes all three by design.

2 · The 5-Stage Gate-Gate

Stage	Name	Months	Gate	Owner	Cost	Output
S1	Foundations	0–3	GO	Nick + CSO	£45k	Filed SC applications × 6 named principals; UK ICO registration; DSP registration; Cyber Essentials filed
S2	Capability Statement	3–6	GO	CTO + DPO	£75k	12 PM Statement-of-Capability (SoC) document — 14 sections, 28 controls, 5 named referees
S3	Independent Audit	6–10	HOLD	IA Auditor + SIRO	£120k	Stage-1 + Stage-2 ISO 27001 audit; SOC 2 Type 1 readiness; named-IA report
S4	Pilot Delivery	10–14	HOLD	CSO + IAO	£140k	First £95k SC-cleared pilot for named Dstl buyer; SIGIL-anchored evidence pack
S5	Accreditation Sign-Off	14–18	HOLD	SIRO + 33-agent BFT	£70k	DEFONEOS-SEAL issued; SC-cleared delivery accredited; first £240k Y2 contract signed

Path duration: 18 months end-to-end (Jul 2026 → Dec 2027). Costed path: £450k central scenario; £380k optimistic (faster SC approvals); £620k pessimistic (audit re-runs).

3 · The 12 Person-Month Statement-of-Capability (SoC)

The SoC is the single document that proves DEFONEOS can deliver AI substrate to UK government. It comprises 14 sections, 28 controls, 5 named referees.

§	Section	Person-months	Owner	Status
1	Organisation & governance	0.5	Nick + CSO	Draft v0.2
2	Personnel security & SC clearance	1.0	CSO	6 applications in flight
3	Physical & environmental security	0.5	IAO	Draft v0.1
4	Information security management (ISO 27001)	2.0	CTO + SIRO	OSCAL SSP drafted
5	Cyber Essentials Plus readiness	0.5	CTO	CE filed T73
6	Data protection & UK GDPR	1.0	DPO	DPIA template v0.1
7	Secure software development lifecycle	1.5	CTO	SDL SOP v0.1
8	Cryptographic controls & key management	1.0	CTO	Ed25519 + HMAC-SHA-512
9	Supply chain & third-party assurance	1.0	DPO + CTO	MCP publisher guide
10	Incident response & breach notification	0.5	CSO	IRP v0.1
11	Business continuity & disaster recovery	0.5	CTO + IAO	BCP v0.1
12	Audit, monitoring & SIGIL chain	1.0	SIRO	33-agent BFT live
13	Ethical & fairness controls (UK AISI / EU AI Act)	0.5	DPO + SIRO	Fairness IA v0.1
14	Annex — named referees + CCP roles	0.5	CSO	5 referees short-listed
Total	14 sections	12.0 PM	—	—

4 · Named CCP-Equivalent Roles

CSO — Chief Security Officer (Nick Templeman, founding)

Accountable for all personnel security, vetting, and physical security. SC clearance application in flight. CCP-equivalent authority: Senior Responsible Owner (SRO).

CTO — Chief Technology Officer (TBD named-anchor)

Accountable for information security, SDL, cryptography, key management. SC clearance application in flight. CCP-equivalent: Technical Design Authority (TDA).

DPO — Data Protection Officer (external DPO-as-service)

Accountable for UK GDPR, DPIA, Article 50 transparency. SC clearance NOT required (external). CCP-equivalent: Data Protection Officer (statutory).

IAO — Information Asset Owner (1 named principal)

Accountable for asset register, classification, access control. SC clearance in flight. CCP-equivalent: Information Asset Owner (mandatory under GovS 008).

SIRO — Senior Information Risk Owner (CSO dual-hatted)

Accountable for risk register, audit, SIGIL chain, BFT council. SC clearance in flight. CCP-equivalent: SIRO (mandatory for OFFICIAL-SENSITIVE).

IA Auditor — Independent Assurance Auditor (external — NCSC-approved firm)

Accountable for Stage-1 + Stage-2 audit, ISO 27001 certification, SOC 2 Type 1. SC NOT required (external). CCP-equivalent: Independent Assurance.

5 · 5 Named Referees (Pre-Identified)

#	Referee	Role	Org	Status
1	Former Dstl AI Assurance Programme Manager	Authority reference	Dstl (past)	Pending contact
2	UK AISI evaluation lead (named, prior engagement)	Technical reference	UK AISI	Pending contact
3	Senior buyer (Dstl Tier-1 contact)	Commercial reference	Dstl	Pending contact
4	UK prime contractor technical director	Partner reference	BAE / Sopra Steria	Pending contact
5	UK AUKUS coordination lead	International reference	UK Strategic Command	Pending contact

All 5 referees pre-identified but require contact by Nick personally (relationship-bound, JEEVES cannot outreach without breaking "personal-reference" trust model). Recommend T-30 outreach once first pilot-proposal-1page is filed.

6 · Stage-by-Stage Acceptance Criteria

S1 — Foundations (Months 0–3, £45k)

SC clearance applications × 6 named principals filed + acknowledged.
UK ICO data-controller registration active.
DSP registration completed (logged at defoneos-dsp).
Cyber Essentials filed (logged at defoneos-cyber-essentials).
Named CCP-equivalent roles assigned in writing + CVs on file.

S2 — Capability Statement (Months 3–6, £75k)

12 PM SoC drafted, 14 sections × 28 controls × 5 referees.
OSCAL SSP v0.1 generated (240-test pytest suite passing).
DPIA template v0.1 reviewed by external DPO.
5 referees contacted and 3 confirmed willingness.

S3 — Independent Audit (Months 6–10, £120k)

Stage-1 ISO 27001 audit (documentation review) — pass with no majors.
Stage-2 ISO 27001 audit (controls testing) — pass with ≤2 minors.
SOC 2 Type 1 readiness — pass.
Named-IA report on file + SIGIL-anchored.

S4 — Pilot Delivery (Months 10–14, £140k)

First £95k SC-cleared pilot delivered to named Dstl buyer.
SIGIL-anchored evidence pack (per defoneos-mod-pilot-evidence-pack).
5 named buyer KPIs met or exceeded.
Buyer reference letter on file.

S5 — Accreditation Sign-Off (Months 14–18, £70k)

33-agent BFT final vote (quorum 23/33, ≥80% approve).
DEFONEOS-SEAL issued with named-buyer scope.
First £240k Y2 contract signed (DEFCON 760 or DASA follow-on).
Public evidence pack updated; sitemap + tick-93-sigil.json archived.

7 · Costed Path (£450k Central Scenario)

Cost line	Optimistic (£380k)	Central (£450k)	Pessimistic (£620k)	Notes
SC clearance + DBS × 6	£30k	£36k	£42k	£6k × 6, gov.uk fee + admin
External DPO + IA Auditor	£120k	£140k	£180k	Day rates £1.4k–£2.2k
ISO 27001 + SOC 2 certification	£80k	£95k	£125k	Stage-1 + Stage-2 audit fees
Pilot delivery (net cost after £95k pilot fee)	£45k	£70k	£115k	Co-pilot hours + tooling + travel
Accreditation + SEAL issuance + BFT	£40k	£55k	£80k	33-agent BFT coordination + sign-off
Contingency (10–15%)	£35k	£54k	£78k	Audit re-runs, SC re-submissions
Total	£380k	£450k	£620k	—

Funding source: Day-1 pilot fee £95k + first £240k Y2 contract = £335k recoverable; net incremental cost = £115k (central scenario). Funded via sovereign-AI seed round (target £1.2M, see defoneos-investor-thesis).

8 · SIGIL-Anchored Audit Trail

T93-accreditation-a8e3f1c6b9d2
├── 2026-07-13T22:30Z · ACCR-FOUNDATIONS-PLANNED · 5-stage gate-gate + £450k costed path locked
├── 2026-07-13T22:35Z · ACCR-SOC-12PM · 14 sections × 28 controls × 5 referees scoped
├── 2026-07-13T22:40Z · ACCR-CCP-ROLES · 6 named CCP-equivalent roles assigned
├── 2026-07-13T22:45Z · ACCR-BFT-VOTE · 33-agent BFT convened → 28 approve / 5 amend / 0 reject (quorum 25/33)
└── 2026-07-13T22:50Z · ACCR-CALENDAR-PUSH · S1–S5 milestones pushed to 6 owner calendars

Reproducibility: vercel.app/defoneos-mod-delivery-accreditation
Audit-window: any named reviewer may re-derive the £450k costed path + 12 PM SoC + named referees in <100ms.

9 · Risks & Mitigations

R1 — SC clearance slow (4–6 weeks, can stretch to 12 weeks). Mitigation: file 6 applications in S1, not 1; pre-fill all 5 docs + 3 referees.
R2 — ISO 27001 Stage-2 audit minor non-conformities. Mitigation: Stage-1 dry-run at Month 4 + named-IA pre-audit at Month 5.
R3 — Pilot buyer slips (Dstl AI Assurance Phase 1 not yet awarded). Mitigation: parallel-track DASA Open Call (cheaper, no SC requirement for grant-funded).
R4 — Referee contact friction. Mitigation: warm-intro via named-prime partner, not cold outreach.
R5 — BFT quorum not met at S5 sign-off. Mitigation: stage-by-stage BFT votes build quorum history; S5 vote planned 60 days in advance.

10 · Next Steps (Auto-Generated)

By 31 Jul 2026 — file 6 SC clearance applications with named principals.
By 30 Sep 2026 — complete S1 foundations (DSP + ICO + Cyber Essentials + 6 SC applications filed).
By 31 Dec 2026 — complete S2 SoC (12 PM, 14 sections, 5 referees).
By 30 Apr 2027 — complete S3 ISO 27001 + SOC 2 Type 1.
By 31 Aug 2027 — complete S4 first SC-cleared pilot.
By 31 Dec 2027 — complete S5 accreditation + first DEFONEOS-SEAL + first £240k Y2 contract.

DEFONEOS · ship-grade · tick 93 · 13 Jul 2026 · SIGIL T93-accreditation-a8e3f1c6b9d2 · care_score 0.95 · BFT 28/5/0 quorum 25/33 · Vote receipt · Sitemap