Instability and uncertainty on the global stage have sharpened the focus on the UK defence estate, identifying the need for significant upgrades to many facilities. The Defence Industrial Strategy contains ambitious plans to leverage increased defence spending to boost UK-based industries and employment.
Modernising and expanding existing facilities will call for many substantial civils and construction projects. While 30% of the increased defence budget is expected to be defence-related projects that will enable upgrades to facilities, much of the work will be on existing active sites. The ability to simplify projects to achieve value for money will be critical.
Multiple technical challenges include upgrading ageing structures that are poorly documented (for example, services routing) and not compliant with modern building codes. Sites often come with difficult access and limited scope to store equipment and materials while keeping facilities fully operational and secure.
New Technology, New Risks
Global instability and evolving technologies are also reshaping the information security risk profile for construction projects on defence establishments. Major threats and risks for contractors and their supply chains increasingly come not so much from the physical environment, but from cyberspace.
The critical nature of systems and information security is underlined by the recent case of Iranian hackers taking a UK power station offline for four days. There are many bad actors out there constantly probing for vulnerabilities and access to sensitive systems.
Safeguarding Physical Security
Suttle Projects operates strict procedures for working within high security sites including a robust onboarding process. At the tender stage, our suppliers are issued with Suttle Projects’ Safety, Health and Environment Code of Practice (SHE-COP), which sets out our minimum expectations and standards.
Successful subcontractors are required to sign up to the SHE-COP. Supporting policies include Modern Slavery, Equality, Diversity and Inclusion, Bribery and Ethical Trading, and Sustainability. This process ensures all our personnel and suppliers comply with specific high security location requirements.
Effective Vetting
All personnel working on site complete a site induction and Baseline Personnel Security Standard (BPSS) checks. These checks include identity verification, references, and a criminal record declaration. Any additional security clearances required by a defence establishment are coordinated by Suttle Projects prior to access being granted.
Where possible, we prioritise the use of suppliers and subcontractors who have already contributed to projects at these sensitive sites, ensuring their personnel already hold the required security clearances.
Where partners do not have an existing site presence, our project manager works closely with our HR Administrator to ensure all relevant personnel obtain the appropriate level of clearance. This may include a Visitor Notification Form (VNF) for one-off visits, or Baseline Personnel Security Standard (BPSS) clearance and higher levels of clearance where a more permanent site presence is required.
Our HR team liaises directly with our supplier’s HR department to ensure all documentation is completed and verified. This includes submission of the security clearance certificate, signed Official Secrets Act declaration, passport, and completed vetting table to the defence organisation’s vetting team before site access is authorised.
Information Security
To combat the risks and ensure sensitive information is kept secure, contractors need a suite of physical, online and cultural safeguards. Cyber Essentials certification really is essential and we’re in the process of implementing Cyber Essential Plus and ensuring supply chain partners meet an equivalent standard where required.
All company computers and phones are encrypted and password-protected; company cloud storage and email feature mandatory multi-factor authentication for all staff. Office-to-office connections use encrypted VPN tunnels, to keep data fully secure in transit . And while we use AI to improve efficiency, use is strictly limited to our self-contained in-house LLM platform.
It’s also vital to maintain a culture of security, where access to information is strictly controlled on a need-to-know basis and all staff maintain a high level of awareness and vigilance regarding potential threats.
Head over to our information and insights section to find out more about how Suttle Projects simplifies delivery for defence and high security civils projects.