DEFONEOS · Defence RFQ · v1.0

12 Jul 2026 Crown / BAE / Rolls / Leonardo DEFCON 760 / JSP 440 / JSP 936

DEFONEOS Defence Request for Quotation (RFQ) — pre-completed for the UK defence supply chain.

This is the canonical RFQ form DEFONEOS issues to UK defence primes (BAE Systems, Rolls-Royce, Leonardo UK, Thales, Babcock, QinetiQ, Marshall, Serco, Capita) and Crown procurement authorities (CCS, MOD DE&S, Dstl, RAF, Royal Navy, British Army procurement commands). It is structured to mirror the Crown's DEFCON 760 short-form contract template (when used as a prime contract) and the DefSTAN 05-138 procurement-specific security-requirements format. Where the buyer has their own RFQ format, this form maps one-to-one against standard MOD acquisition templates (the JFD / DEFCAR / ITN / ITT family).

12RFQ sections

52Pre-completed fields

7Defence standards

£252kPilot fixed fee

Section 1 — Supplier information

1.1 Supplier legal name

1.2 Trading name

1.3 Company registration number

1.4 Registered office

1.5 VAT number

1.6 Primary contract contact

1.7 Defence contracting contact

1.8 Ultimate beneficial owner

1.9 DSP registration

1.10 Companies House URN

Section 2 — Buyer information

2.1 Buyer organisation

2.2 Buyer type

2.3 Procurement contact

2.4 Procurement reference

2.5 Procurement procedure

2.6 Required return date

Section 3 — Requirement

3.1 Requirement title

3.2 Requirement description

A sovereign AI platform providing compliance assurance, audit-trail generation, risk-scoring, watermarking (EU AI Act Art 50), Ed25519-signed SIGIL evidence chain, 33-agent BFT governance, and 30-framework compliance cross-walk. Deployed on UK sovereign infrastructure (NCSC cloud principles 1-14) OR on buyer-supplied air-gapped environment.

3.3 Functional requirements

F-01   Deploy on UK sovereign cloud OR air-gapped environment
F-02   Support UK GDPR Article 28 DPA (controller / processor)
F-03   Implement EU AI Act Article 50 watermarking
F-04   Emit Ed25519-signed SIGIL audit chain per action
F-05   Pass 240-test pytest acceptance gate (Schedule 6)
F-06   Operate against a 33-agent BFT governance council
F-07   Surface 30-framework compliance cross-walk
F-08   Provide Article 14 effective human oversight
F-09   Maintain verifiable no-foreign-data-flow attestation
F-10   Issue DEFONEOS-SEAL sovereign compliance certificate

3.4 Non-functional requirements

NF-01  Availability 99.5% (Pro) / 99.99% (Enterprise SLA)
NF-02  Mean latency under 200ms at p95 for risk scoring
NF-03  Support 10,000 concurrent SIGIL events / sec
NF-04  Quantum-safe migration path (ML-KEM-768, ML-DSA-65)
NF-05  Tenancy isolation per UK GDPR Art 28(3)(a)
NF-06  Air-gap option for SECRET and above
NF-07  Sovereign-only data residency (no foreign bytes flowed)
NF-08  Cyber Essentials Plus + ISO 27001 + ISO 42001 cert
NF-09  SC-cleared personnel undertaking for UK OFFICIAL-SENSITIVE
NF-10  List X facility for SECRET (target Q1 2027)

3.5 Pilot scope

Section 4 — Security

4.1 Security baseline — JSP 440, JSP 936, DefSTAN 05-138

Requirement	Reference	DEFONEOS evidence
Cyber Essentials Plus	JSP 936 §3.2	Certified Mar 2026 (CYB-2026-DEFONEOS-001)
ISO 27001:2022	JSP 440 §6	Stage 1 audit passed Jun 2026; Stage 2 Sep 2026
ISO 42001:2023	JSP 936 §3.7 (AI deployments)	Stage 1 booked Q4 2026
SC-cleared personnel (≥5)	JSP 440 §10; UKSV framework	6 personnel SC-cleared, 2 in process
DV-cleared personnel (≥2)	JSP 440 §10; UKSV DV	2 personnel in DV process (target Q4 2026)
Security incident reporting	JSP 440 §14	24/7 SOC + 60-min SLA + SIGIL evidence pack
OFFICIAL-SENSITIVE handling	SPF 2023	Air-gap option; AES-256-GCM + TLS 1.3
List X facility (SECRET)	DefSTAN 05-138 SRL5	Tier-2 data centre (Telehouse North); List X target Q1 2027
Security Requirements Level (SRL)	DefSTAN 05-138	SRL 1-3 implemented; SRL 5+ via air-gap + List X
Cyber Security Model Level	JSP 936 §3.4	Level 2 confirmed
Personnel security (BPSS baseline)	JSP 440 §8	All 8 staff BPSS-checked baseline
Physical security of premises	JSP 440 §12	Tier-2 data centre physical security
Supply chain assurance	JSP 936 §4 (Supply Chain)	Supplier risk register + SIGIL-signed third-party assurances
Cyber Risk Assessment	JSP 440 §15	Annual risk assessment; quarterly review; BFT Council sign-off

4.2 Security classification of this RFQ

Security classification: OFFICIAL (UK Government Security Classifications 2018). The contents of this RFQ, including any annexes, are to be handled as OFFICIAL. Where any buyer-side annexe contains OFFICIAL-SENSITIVE information, it shall be transmitted via the Defence Share (DS) system or via NCSC-approved encrypted email. Defence suppliers are reminded of their obligations under the Official Secrets Acts 1911-1989 and the Computer Misuse Act 1990.

4.3 Required classification level

4.4 Defence-supplier due diligence

DEFONEOS has completed defence-supplier due diligence including:
  (a) Companies House check — confirm active status, no disqualifications
  (b) HMRC tax check certificate (TC-2026-Q2) — confirms tax compliance
  (c) DBS check for all 8 personnel — clean
  (d) SC clearance for 6 personnel — UKSV framework
  (e) UKSV-confirmed DV in progress for 2 personnel (target Q4 2026)
  (f) No presence on UK government debarment lists
  (g) Companies House persons with significant control (PSC) verified
  (h) Conflict-of-interest declaration signed by all staff

Section 5 — Technical architecture

DEFONEOS Technical Architecture (defence deployment) ═════════════════════════════════════════════════════════════ Layer 1 — Sovereign Edge (Buyer premises or Tier-2 UK cloud) • Hardware: NCSC-approved Hypervisor (see NCSC cloud principle 1) • OS: Ubuntu 22.04 LTS (CC EAL2) or RHEL 8 (CC EAL4+) • Hypervisor: VMware vSphere 8 (CC EAL4+) or KVM (CC EAL2) • Hardware root of trust: TPM 2.0 • Encryption: AES-256-GCM (storage) + TLS 1.3 (transit) Layer 2 — Sovereign Compute (DEFONEOS runtime) • Container: gVisor (defence-grade sandbox) or Kata Containers • Service mesh: Istio + mTLS + zero-trust • Identity: SPIFFE / SVID for workload identity • Crypto: Ed25519 (current) + ML-DSA-65 (PQC migration Q4 2026) • KEM: ML-KEM-768 (PQC) by Q4 2026 Layer 3 — Sovereign Data (UK-resident only) • Database: PostgreSQL 16 with TDE + pgcrypto • Vector store: Qdrant (in-memory + on-disk) • Object store: MinIO with server-side encryption • Backup: 3-2-1 immutable WORM (S3 Object Lock) • Geographic residency: 100% UK / EU (no third-country) Layer 4 — Sovereign AI (DEFONEOS models) • LLM: SOV3-small (1.5B, in-house) + Llama-3-8B-Instruct • Reasoning: Mamba-2 + Transformer hybrid • Embeddings: nomic-embed-text-v1.5 (sovereign-tuned) • Fine-tuning: QLoRA on sovereign data only Layer 5 — Sovereign Governance (33-agent BFT Council) • BFT council: 33 sovereign agents (BFT quorum = 23/33) • SIGIL chain: Ed25519-signed hash-chained audit log • Watchdog: HORUS real-time monitoring • ZK-proofs: DORADO sovereign switch position SOVEREIGN • 30-framework compliance cross-walk Layer 6 — Sovereign Interfaces (Open Hands OS) • Protocols: MCP, A2A, x402, DID, JWT, ANP, AGNTCY, IBC • API: REST + gRPC + WebSocket • Auth: OAuth 2.1 + WebAuthn + TOTP • Export: OpenAPI 3.1 + AsyncAPI 3.0 ───────────────────────────────────────────────────────────── Compliance: NCSC Cloud Principles 1-14 (all 14 implemented) Standards: JSP 440, JSP 936, DefSTAN 05-138, Cyber Essentials+ PQC status: ML-KEM-768 + ML-DSA-65 by Q4 2026

Section 6 — Deployment options

Section 7 — Acceptance criteria

Option	Description	Indicative cost	Security classification ceiling
A — UK sovereign cloud	DEFONEOS-hosted on Tier-2 UK infrastructure (Telehouse North)	£180,000 (90-d pilot) / £420,000 (12-mo)	OFFICIAL-SENSITIVE
B — Buyer-cloud (UK)	Deployed on buyer's own UK sovereign cloud (AWS UK, Azure UK, GCP UK)	£180,000 + £40,000 setup	OFFICIAL-SENSITIVE
C — Air-gapped on-premise	Fully isolated, no network connectivity, dedicated hardware	£240,000 + £60,000 deployment	SECRET (with List X)
D — List X facility	Deployed in MOD-approved List X data centre	£300,000+ (case-by-case)	SECRET / TOP SECRET (with DV)

Acceptance is gated by the 240-test pytest suite published at github.com/csoai-org/defoneos-acceptance. The acceptance schedule is:

Section 8 — Commercial

Payment milestone-billed against P1/P2/P3 acceptance (30/30/40). Invoices raised by CSOAI Ltd on the 5th working day after acceptance sign-off. Payment terms: 30 days end of month + 5 working days. Late payment: interest at 8% above Bank of England base rate under the Late Payment of Commercial Debts (Interest) Act 1998.

Extension options: 2 × 90-day extensions at +25% per extension (priced in Schedule 2 of the Form of Contract). Conversion to 12-month deployment: negotiable; typical conversion discount 8% versus fresh procurement.

Section 9 — IPR & Crown Copyright

Section 10 — Governance (BFT Council)

DEFONEOS is governed by a 33-agent Byzantine Fault Tolerant (BFT) council — a quorum of 23/33 is required for any material decision. The BFT Council comprises:

Material decisions (changes to the Charter, the SoW, the pricing, the security baseline, the BFT composition) require 2/3 majority (≥22 of 33). Operational decisions are made by the on-call duty sovereign agent under SOP. All decisions are SIGIL-signed and audit-trailed.

Section 11 — Case studies (defence-relevant)

Section 12 — Signature block

Annex A — DEFONEOS-SEAL issuance

On successful completion of the 90-day pilot (or the 12-month deployment), the Authority is issued a DEFONEOS-SEAL sovereign compliance certificate. The seal is Ed25519-signed and embeds the following attributes:

Acceptance milestone	Days from contract award	Pass criteria	Payment trigger
P1 — Mobilisation & security baseline	Day 0-30	SC-cleared personnel in place; cyber-baseline complete; test environment available	30% of pilot fee (£54,000)
P2 — Functional delivery + 240-test gate	Day 30-60	240-test pytest suite ≥98% pass; SIGIL chain live; ≥1,000 SIGILs emitted; BFT Council convened	30% of pilot fee (£54,000)
P3 — Pilot operations + acceptance	Day 60-90	Sustained operation 30 days; ≥99% uptime; DEFONEOS-SEAL issued; final report accepted	40% of pilot fee (£72,000)

Line item	Quantity	Unit price	Total (ex VAT)
DEFONEOS Platform pilot fee (90-day)	1	£180,000	£180,000
Air-gap deployment option (if required)	1	£60,000	£60,000
DEFONEOS-SEAL sovereign compliance certificate	1	£12,000	£12,000
TOTAL EX VAT			£252,000
VAT (20%)			£50,400
TOTAL INC VAT			£302,400

Case study	Sector	Outcome	Reference
NHS pilot — compliance assurance	Health / NHS Digital	7-day evaluation; 98.6% acceptance pass; 240-test gate green	NHS-DSPT-2025
Dstl proof-of-concept — sovereign AI	Defence R&D	60-day PoC; 19,040 SIGILs emitted; 33 BFT quorum met	DstL-PoC-2025
Royal Navy FLEET OS trial	Maritime defence	90-day Tier-2 deployment; incident reporting 60-min SLA met	RN-FLEET-2026
UK AI Bill sandbox (BCS cohort 4)	Regulatory	Graduated May 2026; cited as exemplification by DSIT	BCS-C4-2026
European Defence Agency workshop	EU defence	EU AI Act conformity assessment exemplar	EDA-WS-2026