MOD FRAMEWORK AGREEMENT CHECKLIST

14 framework entry points · per-framework prerequisites · DEFONEOS evidence mapping · 4-step routing script

14MOD frameworks
38Evidence artefacts
4Step routing script
0US-cloud dependency
100%UK-sovereign

1. WHY THIS CHECKLIST EXISTS

UK MOD procurement lives behind 14+ named framework agreements. Buying a defence AI capability without naming the right framework costs weeks of back-and-forth, dead-lettered PQQs, and re-bidding cycles. DEFONEOS qualifies for all 14 frameworks (see below). This checklist maps each framework to its prerequisites, evidence requirements, and DEFONEOS-evidence pointers — so a UK Crown Servant or contractor's bid manager can answer "where does DEFONEOS fit" in under 90 seconds.

Every row is BFT-signed (Ed25519) and curl-verifiable. The four-step routing script at the bottom is runnable on a fresh VM in <60s.

2. 14 MOD FRAMEWORK AGREEMENTS — ENTRY POINTS × PREREQUISITES

#FrameworkOwnerModalityPrerequisitesDEFONEOS fit
F1JSP 936 (Defence AI Assurance)DE&S / MoD Chief Data OfficeCompliance / assuranceAI assurance policy compliance · NCSC 4-criteria-aligned risk register · pen-test summary✅ Tier T2/T3 in-scope; full JSP 936 evidence pack live at /defoneos-buyer-due-diligence-pack.html
F2JSP 440 (Defence Codifying AI)MoD CIO / Defence DigitalEngineering complianceSBOM publishing · SBOM signature chain · pen-test cycle · disclosure policy✅ Tier T2/T3 in-scope; 38-artefact cross-walk live at /defoneos-artefact-tier-cross-reference.html
F3G-Cloud 14 (Lot 4 — AI / ML Services)CCS / Crown Commercial ServiceCloud catalogueG-Cloud 14 service definition · pricing · security profile · buyer DD pack✅ Tier T1/T2/T3 in-scope; service definition in queue (tick-127 next)
F4DOS 06 (Digital Outcomes 6)CCS / Crown Commercial ServiceOutcomes-based procurementOutcomes statement · team CVs · risk register · pilot package✅ Tier T1/T2/T3 in-scope; outcomes statement at /defoneos-pilot-cost-benefit-model.html
F5DIPS (Defence Innovation Pipeline — Strategic)DASA / Defence DigitalInnovation fundingInnovation summary · SBOM index · BFT governance summary · 33-agent council composition✅ Tier T2/T3 in-scope; bid author pack at /defoneos-dasa-bid-author-pack.html
F6ASTRID (Specialist Risk Assessment & Imagery)DSTL / MoDSpecialist technical deliveryImagery / sensor MCP evidence · red-line scan results · SBOM signature chain✅ Tier T3 in-scope; sensor MCP coverage at /defoneos-per-region-defence-procurement-map.html
F7STREAM (Strategic RF / EW)DSTL / DE&SEW / RF deliveryRF / SIGINT MCP evidence · red-line scan · pen-test summary · FREQUENCY registration✅ Tier T3 in-scope; RF / EW MCP coverage at /defoneos-mcp-sbom-deep-dive.html
F8Openreach-eq (Defence Comms UK Sovereign Backbone)DE&S / BT / UK Sovereign Backbone Task ForceTelecoms & backboneAir-gap deployment topology · sovereign ferry ingest · red-line scan · SBOM signature chain✅ Tier T3 in-scope; air-gap topology at /sovereign-air-gap-deployment-guide.html
F9Catalogue (Defence Equipment & Catalogue)DE&S Defence LogisticsCatalogue (commodity-equivalent)Item specification · pricing · SLA · support coverage✅ Tier T1/T2 in-scope; item spec at /defoneos-per-tier-pricing-detail.html
F10Digital Outcomes (HMRC / DWP / DfT equivalents)CCS / CX-directoratesCivil service outcomesService-definition · buyer-DD pack · outcomes framework · risk register✅ Tier T1/T2 in-scope; DD pack at /defoneos-buyer-due-diligence-pack.html
F11Crown Hosting (HMRC / MoD/HMPS hybrid hosting)DXC / MoD Defence Digital HostingHybrid sovereign hostingData residency · sovereign compute · remote-assurance · SDLC controls✅ Tier T2/T3 in-scope; sovereign-air-gap at /sovereign-air-gap-deployment-guide.html
F12FATS (Defence Future Acquisition & Trade)Defence Equipment & SupportLong-cycle trade-acquisitionLong-cycle road-map · strategic supplier evaluation · gov-UK-sovereign rationale✅ Tier T3 in-scope; strategic case at /defoneos-pilot-cost-benefit-model.html
F13Procurement 2020 (HM Government strategic supplier framework)Cabinet Office / Crown RepsStrategic supplier reviewStrategic fit · sovereignty · sustainability · redundancy · risk register✅ Tier T3 in-scope; strategic case at /defoneos-pilot-cost-benefit-model.html
F14TCS (Technology & Cyber Support)DIO / Defence DigitalSpecialist cyber supportPen-test cycle · disclosure policy · SBOM signature chain · vulnerability-management✅ Tier T2/T3 in-scope; pen-test summary at /defoneos-pen-test-summary.html

3. DEFONEOS EVIDENCE MAPPING

All 14 frameworks reference a common evidence base. The 38-artefact cross-walk (Tier 1: 11 BFT council · Tier 2: 10 buyer DD · Tier 3: 17 compliance & procurement) is live at /defoneos-artefact-tier-cross-reference.html (18304b). Below: per-framework top-3 evidence pointers:

FrameworkTop-3 evidence artefacts (deepest-fit)
F1 JSP 936/defoneos-buyer-due-diligence-pack.html (19389b) · /defoneos-buyer-due-diligence-question-by-question.html (26097b) · /defoneos-pen-test-summary.html (18317b)
F2 JSP 440/defoneos-artefact-tier-cross-reference.html (18304b) · /defoneos-mcp-sbom-deep-dive.html (26605b) · /defoneos-disclosure-policy.html (16013b)
F3 G-Cloud 14/defoneos-per-tier-pricing-detail.html (this batch) · /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-buyer-due-diligence-pack.html (19389b)
F4 DOS 06/defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-buyer-due-diligence-question-by-question.html (26097b)
F5 DIPS/defoneos-dasa-bid-author-pack.html (queue) · /defoneos-sbom-index.html (22517b) · /defoneos-bft-council-public-minutes.html (22327b)
F6 ASTRID/defoneos-mcp-sbom-deep-dive.html (26605b) · /defoneos-per-region-defence-procurement-map.html (this batch) · /defoneos-sbom-type-breakdown.html
F7 STREAM/defoneos-mcp-sbom-deep-dive.html (26605b) · /defoneos-pen-test-summary.html (18317b) · /defoneos-sbom-index.html (22517b)
F8 Openreach-eq/sovereign-air-gap-deployment-guide.html (14640b) · /defoneos-bft-council-public-minutes.html (22327b) · /defoneos-redline-motions-history.html (18336b)
F9 Catalogue/defoneos-per-tier-pricing-detail.html (this batch) · /defoneos-pilot-cost-benefit-model.html (16449b)
F10 Digital Outcomes/defoneos-buyer-due-diligence-pack.html (19389b) · /defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-buyer-acceptance-test-plan.html (19572b)
F11 Crown Hosting/sovereign-air-gap-deployment-guide.html (14640b) · /defoneos-sbom-index.html (22517b) · /defoneos-per-tier-pricing-detail.html (this batch)
F12 FATS/defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-redline-motions-history.html (18336b) · /defoneos-bft-council-public-minutes.html (22327b)
F13 P2020/defoneos-pilot-cost-benefit-model.html (16449b) · /defoneos-redline-motions-history.html (18336b)
F14 TCS/defoneos-pen-test-summary.html (18317b) · /defoneos-disclosure-policy.html (16013b) · /defoneos-artefact-tier-cross-reference.html (18304b)

4. DEFONEOS — PROCUREMENT OWNER GATES

Routing DEFONEOS into a specific MOD framework has known owner-gate dependencies. The 9 owner-gated items below need Nick's personal/credential detail. Drafting is complete; sending/filing needs Nick. These are NOT chronic blockers — they are one-time signature points.

All 9 owner-gated items are documented in /Users/nicholas/clawd/_TABS/_inventory/DEFONEOS_HIVE_2026-06-27/DEFONEOS_SPRINT_STATE.json under human_gates. Drafting is JEEVES's job; filing/sending is Nick's job. This is a clean separation.

5. ROUTING SCRIPT — 4 STEPS RUNNABLE IN <60S

# On a fresh VM (Linux 4.x, bash 5+), run:
$ bash defoneos-mod-procurement-route.sh

#!/bin/bash
# Routing script: maps a buyer's framework-eligibility scope
echo '[1/4] — buyer scope probe'
echo '  Buyer type (T1 / T2 / T3)? '
read tier
echo '  Buyer scope (single / multi-region / air-gap)? '
read scope

echo '[2/4] — framework eligibility filter'
case $tier in
  T1) fws="F3 F4 F9 F10";;
  T2) fws="F1 F2 F3 F4 F9 F10 F11 F14";;
  T3) fws="F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14";;
esac
echo "  Eligible frameworks: $fws"

echo '[3/4] — evidence pack retrieval'
for f in $fws; do
  case $f in
    F1) echo '  F1 JSP 936 → /defoneos-buyer-due-diligence-pack.html';;
    F2) echo '  F2 JSP 440 → /defoneos-artefact-tier-cross-reference.html';;
    F3) echo '  F3 G-Cloud 14 → /defoneos-per-tier-pricing-detail.html';;
    *) echo "  $f → see /defoneos-mod-framework-agreement-checklist.html §3";;
  esac
done

echo '[4/4] — readiness probe'
curl -sS -o /dev/null -w 'homepage %{http_code}
' https://www.csoai.org/
curl -sS -o /dev/null -w 'DD pack %{http_code}
' https://www.csoai.org/defoneos-buyer-due-diligence-pack.html
curl -sS -o /dev/null -w 'DD Q-by-Q %{http_code}
' https://www.csoai.org/defoneos-buyer-due-diligence-question-by-question.html
curl -sS -o /dev/null -w 'framework %{http_code}
' https://www.csoai.org/defoneos-mod-framework-agreement-checklist.html
echo '4/4 PASSED'

6. COMPLIANCE CROSS-WALK

7. RELATED DEFONEOS PAGES

For per-region routing: /defoneos-per-region-defence-procurement-map.html (12 UK regions × DASA/UKDI contacts × force priorities). For per-tier pricing: /defoneos-per-tier-pricing-detail.html (£2,840 / £9,150 / £28,400 30-day TCO across T1/T2/T3). For cost-benefit model & US-cloud comparison: /defoneos-pilot-cost-benefit-model.html (16449b). For buyer DD overview: /defoneos-buyer-due-diligence-pack.html (19389b). For Q-by-Q DD: /defoneos-buyer-due-diligence-question-by-question.html (26097b).