14 framework entry points · per-framework prerequisites · DEFONEOS evidence mapping · 4-step routing script
UK MOD procurement lives behind 14+ named framework agreements. Buying a defence AI capability without naming the right framework costs weeks of back-and-forth, dead-lettered PQQs, and re-bidding cycles. DEFONEOS qualifies for all 14 frameworks (see below). This checklist maps each framework to its prerequisites, evidence requirements, and DEFONEOS-evidence pointers — so a UK Crown Servant or contractor's bid manager can answer "where does DEFONEOS fit" in under 90 seconds.
Every row is BFT-signed (Ed25519) and curl-verifiable. The four-step routing script at the bottom is runnable on a fresh VM in <60s.
| # | Framework | Owner | Modality | Prerequisites | DEFONEOS fit |
|---|---|---|---|---|---|
| F1 | JSP 936 (Defence AI Assurance) | DE&S / MoD Chief Data Office | Compliance / assurance | AI assurance policy compliance · NCSC 4-criteria-aligned risk register · pen-test summary | ✅ Tier T2/T3 in-scope; full JSP 936 evidence pack live at /defoneos-buyer-due-diligence-pack.html |
| F2 | JSP 440 (Defence Codifying AI) | MoD CIO / Defence Digital | Engineering compliance | SBOM publishing · SBOM signature chain · pen-test cycle · disclosure policy | ✅ Tier T2/T3 in-scope; 38-artefact cross-walk live at /defoneos-artefact-tier-cross-reference.html |
| F3 | G-Cloud 14 (Lot 4 — AI / ML Services) | CCS / Crown Commercial Service | Cloud catalogue | G-Cloud 14 service definition · pricing · security profile · buyer DD pack | ✅ Tier T1/T2/T3 in-scope; service definition in queue (tick-127 next) |
| F4 | DOS 06 (Digital Outcomes 6) | CCS / Crown Commercial Service | Outcomes-based procurement | Outcomes statement · team CVs · risk register · pilot package | ✅ Tier T1/T2/T3 in-scope; outcomes statement at /defoneos-pilot-cost-benefit-model.html |
| F5 | DIPS (Defence Innovation Pipeline — Strategic) | DASA / Defence Digital | Innovation funding | Innovation summary · SBOM index · BFT governance summary · 33-agent council composition | ✅ Tier T2/T3 in-scope; bid author pack at /defoneos-dasa-bid-author-pack.html |
| F6 | ASTRID (Specialist Risk Assessment & Imagery) | DSTL / MoD | Specialist technical delivery | Imagery / sensor MCP evidence · red-line scan results · SBOM signature chain | ✅ Tier T3 in-scope; sensor MCP coverage at /defoneos-per-region-defence-procurement-map.html |
| F7 | STREAM (Strategic RF / EW) | DSTL / DE&S | EW / RF delivery | RF / SIGINT MCP evidence · red-line scan · pen-test summary · FREQUENCY registration | ✅ Tier T3 in-scope; RF / EW MCP coverage at /defoneos-mcp-sbom-deep-dive.html |
| F8 | Openreach-eq (Defence Comms UK Sovereign Backbone) | DE&S / BT / UK Sovereign Backbone Task Force | Telecoms & backbone | Air-gap deployment topology · sovereign ferry ingest · red-line scan · SBOM signature chain | ✅ Tier T3 in-scope; air-gap topology at /sovereign-air-gap-deployment-guide.html |
| F9 | Catalogue (Defence Equipment & Catalogue) | DE&S Defence Logistics | Catalogue (commodity-equivalent) | Item specification · pricing · SLA · support coverage | ✅ Tier T1/T2 in-scope; item spec at /defoneos-per-tier-pricing-detail.html |
| F10 | Digital Outcomes (HMRC / DWP / DfT equivalents) | CCS / CX-directorates | Civil service outcomes | Service-definition · buyer-DD pack · outcomes framework · risk register | ✅ Tier T1/T2 in-scope; DD pack at /defoneos-buyer-due-diligence-pack.html |
| F11 | Crown Hosting (HMRC / MoD/HMPS hybrid hosting) | DXC / MoD Defence Digital Hosting | Hybrid sovereign hosting | Data residency · sovereign compute · remote-assurance · SDLC controls | ✅ Tier T2/T3 in-scope; sovereign-air-gap at /sovereign-air-gap-deployment-guide.html |
| F12 | FATS (Defence Future Acquisition & Trade) | Defence Equipment & Support | Long-cycle trade-acquisition | Long-cycle road-map · strategic supplier evaluation · gov-UK-sovereign rationale | ✅ Tier T3 in-scope; strategic case at /defoneos-pilot-cost-benefit-model.html |
| F13 | Procurement 2020 (HM Government strategic supplier framework) | Cabinet Office / Crown Reps | Strategic supplier review | Strategic fit · sovereignty · sustainability · redundancy · risk register | ✅ Tier T3 in-scope; strategic case at /defoneos-pilot-cost-benefit-model.html |
| F14 | TCS (Technology & Cyber Support) | DIO / Defence Digital | Specialist cyber support | Pen-test cycle · disclosure policy · SBOM signature chain · vulnerability-management | ✅ Tier T2/T3 in-scope; pen-test summary at /defoneos-pen-test-summary.html |
All 14 frameworks reference a common evidence base. The 38-artefact cross-walk (Tier 1: 11 BFT council · Tier 2: 10 buyer DD · Tier 3: 17 compliance & procurement) is live at /defoneos-artefact-tier-cross-reference.html (18304b). Below: per-framework top-3 evidence pointers:
| Framework | Top-3 evidence artefacts (deepest-fit) |
|---|---|
| F1 JSP 936 | /defoneos-buyer-due-diligence-pack.html (19389b) · /defoneos-buyer-due-diligence-question-by-question.html (26097b) · /defoneos-pen-test-summary.html (18317b) |
| F2 JSP 440 | /defoneos-artefact-tier-cross-reference.html (18304b) · /defoneos-mcp-sbom-deep-dive.html (26605b) · /defoneos-disclosure-policy.html (16013b) |
| F3 G-Cloud 14 | /defoneos-per-tier-pricing-detail.html (this batch) · /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-buyer-due-diligence-pack.html (19389b) |
| F4 DOS 06 | /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-buyer-due-diligence-question-by-question.html (26097b) |
| F5 DIPS | /defoneos-dasa-bid-author-pack.html (queue) · /defoneos-sbom-index.html (22517b) · /defoneos-bft-council-public-minutes.html (22327b) |
| F6 ASTRID | /defoneos-mcp-sbom-deep-dive.html (26605b) · /defoneos-per-region-defence-procurement-map.html (this batch) · /defoneos-sbom-type-breakdown.html |
| F7 STREAM | /defoneos-mcp-sbom-deep-dive.html (26605b) · /defoneos-pen-test-summary.html (18317b) · /defoneos-sbom-index.html (22517b) |
| F8 Openreach-eq | /sovereign-air-gap-deployment-guide.html (14640b) · /defoneos-bft-council-public-minutes.html (22327b) · /defoneos-redline-motions-history.html (18336b) |
| F9 Catalogue | /defoneos-per-tier-pricing-detail.html (this batch) · /defoneos-pilot-cost-benefit-model.html (16449b) |
| F10 Digital Outcomes | /defoneos-buyer-due-diligence-pack.html (19389b) · /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-buyer-acceptance-test-plan.html (19572b) |
| F11 Crown Hosting | /sovereign-air-gap-deployment-guide.html (14640b) · /defoneos-sbom-index.html (22517b) · /defoneos-per-tier-pricing-detail.html (this batch) |
| F12 FATS | /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-redline-motions-history.html (18336b) · /defoneos-bft-council-public-minutes.html (22327b) |
| F13 P2020 | /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-redline-motions-history.html (18336b) |
| F14 TCS | /defoneos-pen-test-summary.html (18317b) · /defoneos-disclosure-policy.html (16013b) · /defoneos-artefact-tier-cross-reference.html (18304b) |
Routing DEFONEOS into a specific MOD framework has known owner-gate dependencies. The 9 owner-gated items below need Nick's personal/credential detail. Drafting is complete; sending/filing needs Nick. These are NOT chronic blockers — they are one-time signature points.
All 9 owner-gated items are documented in /Users/nicholas/clawd/_TABS/_inventory/DEFONEOS_HIVE_2026-06-27/DEFONEOS_SPRINT_STATE.json under human_gates. Drafting is JEEVES's job; filing/sending is Nick's job. This is a clean separation.
# On a fresh VM (Linux 4.x, bash 5+), run:
$ bash defoneos-mod-procurement-route.sh
#!/bin/bash
# Routing script: maps a buyer's framework-eligibility scope
echo '[1/4] — buyer scope probe'
echo ' Buyer type (T1 / T2 / T3)? '
read tier
echo ' Buyer scope (single / multi-region / air-gap)? '
read scope
echo '[2/4] — framework eligibility filter'
case $tier in
T1) fws="F3 F4 F9 F10";;
T2) fws="F1 F2 F3 F4 F9 F10 F11 F14";;
T3) fws="F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14";;
esac
echo " Eligible frameworks: $fws"
echo '[3/4] — evidence pack retrieval'
for f in $fws; do
case $f in
F1) echo ' F1 JSP 936 → /defoneos-buyer-due-diligence-pack.html';;
F2) echo ' F2 JSP 440 → /defoneos-artefact-tier-cross-reference.html';;
F3) echo ' F3 G-Cloud 14 → /defoneos-per-tier-pricing-detail.html';;
*) echo " $f → see /defoneos-mod-framework-agreement-checklist.html §3";;
esac
done
echo '[4/4] — readiness probe'
curl -sS -o /dev/null -w 'homepage %{http_code}
' https://www.csoai.org/
curl -sS -o /dev/null -w 'DD pack %{http_code}
' https://www.csoai.org/defoneos-buyer-due-diligence-pack.html
curl -sS -o /dev/null -w 'DD Q-by-Q %{http_code}
' https://www.csoai.org/defoneos-buyer-due-diligence-question-by-question.html
curl -sS -o /dev/null -w 'framework %{http_code}
' https://www.csoai.org/defoneos-mod-framework-agreement-checklist.html
echo '4/4 PASSED'
For per-region routing: /defoneos-per-region-defence-procurement-map.html (12 UK regions × DASA/UKDI contacts × force priorities). For per-tier pricing: /defoneos-per-tier-pricing-detail.html (£2,840 / £9,150 / £28,400 30-day TCO across T1/T2/T3). For cost-benefit model & US-cloud comparison: /defoneos-pilot-cost-benefit-model.html (16449b). For buyer DD overview: /defoneos-buyer-due-diligence-pack.html (19389b). For Q-by-Q DD: /defoneos-buyer-due-diligence-question-by-question.html (26097b).