Guidance

Reducing Cyber Risk Across Defence: FAQ

Updated 5 October 2023

Q: Does this competition focus on Threat detection & Response/Cyber Defence systems?

A: The Cyber Resilience Programme is not responsible for Threat detection and Response aspect of Cyber so it is not our main interest.

Q: Are you looking for solutions that can improve OT security, or is this phase limited to the tools to quantify the risk first?

A: The priority for challenge 3 of this competition is to understand and quantify the risk present in OT systems. However, if you think your innovation could help us at the next stage, to improve OT security, it would be considered.

Q: Does OT assets also include Cyber physical systems?

A: Yes.

Q: Does Challenge 1: Digital Resilience cover artificial intelligence (AI) resilience?

A: Yes, AI resilience is a subset of digital resilience. It is not the top of our priority as far as digital resilience is concerned but it is of interest.

Q: Are there any mandatory technologies that must be considered in terms of integration with specific SIEM tooling or applications?

A: No, we are looking for technologies that will deliver outputs up to Technology Readiness Level (TRL) 6. We are not expecting submitters to instantly be able to integrate with MoD’s current tools. MoD currently have a number of tools in this space, but no prior knowledge of these tools is required to submit a proposal. 

Q: Can you expand on the requirement “must show awareness of the contemporary military operating environment”?

A: Work completed through this competition will be for the Ministry of Defence, therefore we would like proposals to consider the types of environments that we operate in, the operations we run and the business that the Ministry of Defence conducts.

Q: Can MOD share work that is already being done in this field to enable us to understand if an idea is innovative?

A: We recommend reading the strategy that the Cyber Resilience Programme was defined under, available on the website. The Secure by Design portal is also due to become available, which will contain further information. We recommend contacting your regional Innovation Partner for further advice and guidance.

Q: Where can we find more information / examples of “the contemporary military operating environment” so that we can be sure we align our proposal appropriately?

A: The Defence Command Paper and Digital Strategy for Defence are useful publications that provide some orientation on Defence-wide activities and objectives.

Q: If we intend to conduct primary research, would you provide access to participants from the defence sector?

A: Participants from the Defence sector may be provided where possible, however it is not guaranteed. Suppliers request access to participants from Defence should outline how they could deliver the project if such access were not to be forthcoming.

Q: What level of GFX might be available?

A: The level of GFX available is specific to each proposal. Discussions around GFX would be held at a later stage on receipt of a ‘Fund’ decision. Suppliers requesting GFX should outline how they could deliver the project if GFX were not to be forthcoming.

Q: Are you only seeking software solutions to these problems, or are you looking for learning based solutions with workshops, train the trainers, etc.?

A: The solution does not need to be software. We would be interested in solutions such as an innovative approach for managing risk, rolling out resilience or secure by default.

Q: The brief said proposals should be innovative. Can you expand on what innovative means in this context?

A: The Ministry of Defence is already undertaking similar work with a number of industry partners, so the basic approaches to the topics outlined within the competition are understood. Therefore, we are interested in proposals that present new solutions, or improve existing ideas. 

Q: You state you are not interested in proposals that provide solutions that are already commercialised products, can you explain?

A: If the solution is already normal business within industry, it is not innovative. If commercial products are used, there needs to be an aspect of innovation. This could include adapting an existing solution for use within a Defence-specific context.

Q: Can we use commercial product and build a plug in as innovative solution and apply as a proposal?

A: It would depend on the extent of the modification being proposed. Take note of the IP conditions of this competition: make sure the proposal fits with the Defcon 705 requirement.

Q: What if we already have an applicable product currently on the market?

A: We would recommend you register to attend the CRP briefing via TechUK. The next such briefing is scheduled for Friday 6 October. Please refer to the TechUK events page here.

Q: Does the tool or technology prototype need to be ready at the proposal stage?

A: No, however it must be ready by the demonstration stage.

Q: What you are expecting in prototype demonstration?

A: We are expecting an indication of a solution that will help aid us in the challenges within the competition document. We do not have a strict view of the prototype and how it should work, however it must give us confidence your approach will work.

Q: If our idea is tangential to this competition but more relevant to a future competition, should we wait for the later competition before submitting?

A: If you’re unsure whether your idea is the right fit for this competition, do contact your regional Innovation Partner to discuss the opportunities available.

Q; Are the any requirements to work at classification levels greater than OFFICIAL?

A: There is no requirement to work at a classification level higher than OFFICIAL. DASA’s default approach is for all contracts to be issued at OFFICIAL in order to enable a wide pool of suppliers to participate. If there is a requirement to increase the classification level of the project, and provided that you have appropriately cleared, then this can be considered during the course of the project. The DASA Submission Service is limited to OFFICIAL information only.

Q: Is the target of TRL 6 for this initial Phase of the competition? The competition document states that further phases might occur to raise TRL.

A: This competition is interested in innovation projects that will deliver outputs at Technology Readiness Level (TRL) 6 – technology model or prototype demonstration in a relevant environment.

We are in the early stages for the three challenges within this competition and there are related projects and programmes being set up. As these projects and programmes develop, there may be further phases, where higher TRL work may be sought and contracted.

Q: Can proposals target multiple challenges?

A: Yes, one proposal can cover multiple challenge areas and Salesforce will allow you to select multiple challenge areas in your submission form. However, covering multiple challenge areas may result in a weaker proposal if they are not fully covered.

Q: What type of organisations are you looking to partner with?

A: DASA submissions are welcome from the private sector, academia, individuals (i.e. sole traders) and Public Sector Research Establishments (PSREs). DASA will examine the legal status of organisations prior to placement of any contract. In most cases there are no nationality restrictions, however DASA individual competition documents will detail any necessary restrictions.

Q: Can a university apply to this competition?

A: Yes, universities can apply (independently) to DASA competitions.

Q: Are you open to joint applications from businesses that can together meet a broader set of aspects of the challenges presented?

A: Yes, we welcome collaborative proposals. However, covering multiple challenge areas may result in a weaker proposal if they are not fully covered. A proposal will require a lead applicant, with partner organisations listed as subcontractors. We would also recommend clearly stating within the proposal the responsibilities of each organisation involved. 

Q: Can the same research team or institution submit more than one proposal?

A: Yes, more than one proposal can be submitted providing they are different proposals, tackling potentially different challenges. Proposals should be stand-alone and not have dependencies on DASA funding multiple projects from the same supplier.

Q: Is the funding £880k per proposal? Or £176k per proposal?

A: £880k in total is available for the overall competition. The funding will not be restricted to £176k per proposal. This competition is looking to fund up to five proposals. We anticipate that there will be variation in total project costs.

Q: Can expressions of interest be submitted before writing a proposal to see if the idea is in scope?

A: We recommend contacting your regional Innovation Partner for further advice and guidance.

Q: What accreditations (e.g. Cyber Essentials, etc.) are required at the time of application?

A: We do not require any specific accreditations. However due to the topic of the competition, we expect proposals to show considerations for accreditations.

We recommend reading Section 12.1 of the competition document which gives details of the Supplier Assurance Questionnaire (SAQ) which must be completed.

Q: Do we need national security clearance for our researchers and staff who will work on this project?

A: Security clearance is not required prior to applying to DASA. DASA’s competitions are open to UK nationals and nationals from friendly countries.

Q: Are there restrictions on working with foreign suppliers?

A: There are not any restrictions on working with foreign suppliers from friendly countries. However we would not look favourably on proposals that involve work with unfriendly countries.

Q: Is there a list of assessment criteria?

A: The assessment criteria is on the DASA GOV.UK page, and within the competition document under Section 14 ‘How your proposal will be assessed’. If you need support accessing the information, please contact the DASA Help Centre at [email protected].

Q: Is it mandatory for an end user to be identified?

A: Defence Digital are funding this competition and are the end user. End users do not need to be identified when applying to DASA’s Themed competitions.

Q: What is the maximum duration of the project?

A: Awarded contracts will be a maximum of 9 months.

Q: Who owns the intellectual property?

A: The intellectual property remains with the innovator. We recommend reading the DASA Standard Terms and Conditions on the website. There is a clause within DEFCON 705 that states that if you wish not to commercialise a solution after funding, we reserve the right to licence the intellectual property from you.

Q: Who has priority on export control?

A: You are required to abide by the local law of the country you are exporting from. We recommend speaking to local authorities in your country. We would not expect any issues if exporting from a friendly country.

Q: Can we submit a proposal if we are or have submitted the same or similar proposal to another competition?

A: If the proposal was of merit but not able to be funded due to budget restrictions e.g. ‘fundable not funded’, you are welcome to resubmit into this competition, however we would expect the proposal to be modified to meet the requirements of this competition. We suggest that suppliers in this situation engage with their regional Innovation Partner to obtain further guidance.