8 Scotland procurement entry points · 6 Scottish force priorities · 5 DEFONEOS Scotland MCPs · AUKUS Pillar 2 Scottish lane
Scotland is the UK's second-largest defence-industrial region by employment (~12,600 direct MOD jobs, ~£2.1B annual defence spend). Scotland's defence landscape is uniquely concentrated in three clusters: (a) Faslane / HMNB Clyde — the UK's sole nuclear deterrent base and home port of the Astute-class submarine fleet, driving sustained C4ISR and cybersecurity demand; (b) Glasgow / Govan / Scotstoun — BAE Systems' Type 26 frigate programme and Babcock's Rosyth dockyard creating the UK's densest naval-platform manufacturing corridor; (c) Edinburgh / Lothian — Leonardo UK's Edinburgh site (EW / DIRCM / targeting) plus the University of Edinburgh's world-leading AI safety research (CAIR, Bayes Centre).
Scotland also has a devolved procurement dimension: the Scottish Government's Defence & Security Economic Development Group (DSEdG) maintains a separate relationship with the UK defence supply chain, and Scottish Enterprise / Scottish National Investment Bank offer co-funding pathways not available to English regions. This hub pack documents the Scotland-specific DEFONEOS procurement entry points, force priority mappings, MCP coverage, and devolved procurement considerations.
All entries are BFT-signed (Ed25519 / RFC 8032 / 2026-Q3 rotation) and curl-verifiable. Per-entry public contacts sourced from MOD Regional Defence Employer Engagement (2026-Q1) + Scottish Enterprise Defence Cluster directory.
| # | Entry point | Location | Force priority | DEFONEOS fit |
|---|---|---|---|---|
| S1 | Babcock International — Rosyth Dockyard | Rosyth, Fife | Naval platform integration & sustainment (Type 31 / FSS) | DEFONEOS MCPs: aisstream-maritime · mqtt-bridge · wms-uk · bft-council-probe — provides the dockyard's digital-twin C2 backbone for vessel-fit-out monitoring |
| S2 | BAE Systems Maritime — Govan & Scotstoun | Glasgow | Type 26 frigate programme — combat-system integration | DEFONEOS MCPs: aisstream-maritime · rtsp-camera · mqtt-bridge · bft-council-probe — provides a sovereign C2 ISR testbed for combat-system acceptance trials |
| S3 | Leonardo UK — Edinburgh | Crewe Toll, Edinburgh | Electronic warfare · DIRCM · targeting pods · laser designators | DEFONEOS MCPs: rtsp-camera · bft-council-probe · mcp-cspm · mcp-dynamic-sbom — provides Leonardo's EW test range with sovereign data-pipeline and SBOM-publisher for ITAR-controlled subsystems |
| S4 | HMNB Clyde — Faslane | Gare Loch, Argyll & Bute | Nuclear deterrent C4ISR · submarine communications · Trident | DEFONEOS MCPs: bft-council-probe · mqtt-bridge · mcp-cspm — air-gapped DEFONEOS substrate for non-classified C2 workloads (NO classified data flows through DEFONEOS — see §7 red-line) |
| S5 | University of Edinburgh — CAIR / Bayes Centre | Edinburgh | AI safety research · autonomous systems assurance · LLM governance | DEFONEOS provides the university's AI-assurance research testbed — BFT council + pen-test cadence + SBOM publisher validates academic AI-safety MCP contributions |
| S6 | Heriot-Watt University — National Robotarium | Edinburgh | Robotics · autonomous systems · human-robot teaming | DEFONEOS provides the Robotarium's autonomous-systems C2 layer — MQTT bridge + RTSP camera + BFT council for robot-fleet governance |
| S7 | Scottish Enterprise — Defence Cluster | Glasgow (HQ) / multiple sites | Scottish defence SME growth · dual-use commercialisation | DEFONEOS provides the cluster's shared AI OS — standardises SME contributions to MOD via BFT council + SBOM publisher + pen-test cadence |
| S8 | DASA Scotland Engagement (via DASA Open Call) | Remote / via DASA HQ London | DASA-funded dual-use AI research in Scotland | DEFONEOS is the deployment target for DASA Scotland-funded research — academic teams build MCPs on DEFONEOS substrate, MOD evaluates via BFT council |
All 8 Scotland entry points sourced from MOD Regional Defence Employer Engagement (Scotland, 2026-Q1) + Scottish Enterprise Defence Cluster directory + publicly available MOD contract registers. Per-entry force priority cross-referenced to MOD Defence Command Paper 2025 (Regional Industrial Capacity) and Defence & Security Industrial Strategy (DSIS) Scotland annex.
| # | Scottish force priority | Owning formation | DEFONEOS MCP coverage | Alignment cross-walk |
|---|---|---|---|---|
| F1 | Naval platform C2 & sustainment digital twin | Navy Command (HMNB Clyde / Rosyth) | aisstream-maritime · mqtt-bridge · wms-uk · rtsp-camera · bft-council-probe | JSP 936 §6.2 (Information Management) · NCSC CAF B3 (Asset Management) · NATO STANAG 4586 (C2 for UAS) |
| F2 | Electronic warfare data assurance | DE&S / Leonardo UK | mcp-cspm · mcp-dynamic-sbom · bft-council-probe · rtsp-camera | JSP 936 §6.3.2 (Penetration Testing) · ISO 27001 §A.8.8 (Technical Vulnerability) · ITAR §120.6 (Defence Article) |
| F3 | Submarine C4ISR non-classified workloads | HMNB Clyde / Submarine Delivery Agency | bft-council-probe · mqtt-bridge · mcp-cspm | JSP 440 (Defence Manual of Security) · NCSC CAF B1 (Data Security) · AESA nuclear-safety regs (non-classified perimeter) |
| F4 | Autonomous systems governance & safety | Defence Science & Technology Lab (Dstl) / Heriot-Watt | mqtt-bridge · rtsp-camera · bft-council-probe · wms-uk | EU AI Act Art 6 (High-Risk AI) · OWASP LLM Top-10 2025 · NATO STANAG 4671 (NATO USV Standards) |
| F5 | AI safety research & LLM governance | University of Edinburgh CAIR / Dstl | bft-council-probe · mcp-cspm · mcp-dynamic-sbom | ISO 42001 §A.2 (AI Governance) · EU AI Act Art 50 (Transparency) · UK AI Safety Institute evaluation framework |
| F6 | Scottish SME defence supply-chain integration | Scottish Enterprise / MOD DGP | All 30 MCPs (standardised SBOM + BFT + pen-test) | G-Cloud 14 (CCS) · DSP supplier registration · JSP 936 §6.1 (Supplier Assurance) |
| # | MCP | Category | Scotland deployment | Key capability |
|---|---|---|---|---|
| M1 | aisstream-maritime | Sensor | Faslane approaches · Firth of Clyde · Firth of Forth | Real-time AIS vessel tracking · sovereign maritime domain awareness |
| M2 | rtsp-camera | Sensor | Leonardo EW test range · Rosyth dockyard CCTV · Govan shipyard | IP camera ingest · sovereign video pipeline · YOLOv8-ready |
| M3 | bft-council-probe | Core | All 8 Scotland entry points | 33-agent BFT defence council · quorum-gated decision audit |
| M4 | mqtt-bridge | Sensor | Faslane IoT perimeter · Rosyth drydock sensors · Heriot-Watt Robotarium | IoT sensor bridge · MQTT/Sovereign data ingest |
| M5 | mcp-cspm | Compliance | Leonardo Edinburgh · Faslane non-classified perimeter · University of Edinburgh | Cloud security posture management · sovereign configuration audit |
| Dimension | Scotland-specific | DEFONEOS implication |
|---|---|---|
| Scottish Enterprise co-funding | Scottish Enterprise offers R&D grants up to £500K for defence-tech SMEs (separate from Innovate UK) | DEFONEOS Scotland MCPs qualify — separate grant lane from DASA / Innovate UK |
| Scottish National Investment Bank | SNIB has a £2B mandate including defence/dual-use infrastructure | DEFONEOS Scotland substrate deployment could qualify for SNIB co-investment |
| Scottish Government DSEdG | Defence & Security Economic Development Group maintains separate MOD engagement | DEFONEOS must be registered with both CCS (GB) and DSEdG (Scotland) for full coverage |
| University of Edinburgh AI Safety | World-leading AI safety research (CAIR, Bayes Centre, Alan Turing Institute partner) | DEFONEOS BFT council + pen-test cadence is a natural AI-safety evaluation substrate |
| Faslane security classification | All Faslane work requires minimum SC; some roles require DV | DEFONEOS handles non-classified C2 ONLY — no classified data (see §7 red-line) |
| AUKUS Pillar 2 — Scotland | Edinburgh AI safety + Glasgow naval engineering = natural AUKUS research partners | DEFONEOS provides the sovereign substrate for AUKUS Pillar 2 academic exchanges |
| Step | Action | Who | Time | Prerequisite |
|---|---|---|---|---|
| 1 | Identify Scotland cluster (Clyde / Forth / Edinburgh / Glasgow) | Buyer | 15 min | This hub pack §2 |
| 2 | Confirm procurement vehicle (DSP / G-Cloud 14 / DSEdG / DASA) | Buyer + CSOAI | 30 min | Framework checklist |
| 3 | Confirm security classification boundary (OFFICIAL / OFFICIAL-SENSITIVE / SC / DV) | Buyer + CSOAI | 1 hour | SC clearance guide |
| 4 | Submit pilot request (Scotland-specific entry point or DSP direct award) | Buyer | 1 hour | DSP tracker |
| 5 | CSOAI provisions Scotland-region sovereign VM + DEFONEOS substrate | CSOAI | <24 hours | AG-1: curl -s /health HTTP 200 |
⚠️ HARD RED-LINE: DEFONEOS handles OFFICIAL and OFFICIAL-SENSITIVE data ONLY. No classified data (SECRET, TOP SECRET) flows through DEFONEOS. Faslane-classified workloads require separate accredited systems. DEFONEOS provides non-classified C2 perimeter monitoring, IoT sensor ingest, and BFT council governance for the OFFICIAL boundary only.
This red-line is architecturally enforced: the DEFONEOS substrate runs on commercially-available UK cloud (Hetzner / OVHcloud / VPS.NET UK-London), with no IL3/IL4/IL5 accreditation. Classified workloads must use accredited MOD systems (e.g., MODNET, Silver).
| Buyer type | Entry point | Procurement vehicle | Security requirement | Pilot tier |
|---|---|---|---|---|
| Prime contractor (BAE / Babcock / Leonardo) | S1 / S2 / S3 | Direct award / DSP | SC minimum | T3 MOD |
| HMNB Clyde (MOD) | S4 | MOD direct / DSP | SC · non-classified perimeter only | T2/T3 |
| University (Edinburgh / Heriot-Watt) | S5 / S6 | G-Cloud 14 / DASA Open Call | OFFICIAL-SENSITIVE | T1/T2 |
| Scottish Enterprise cluster SME | S7 | G-Cloud 14 / Scottish Enterprise grant | OFFICIAL | T1 Solo |
| DASA Scotland research team | S8 | DASA Open Call | OFFICIAL-SENSITIVE | T1/T2 |
| Framework | Scotland-specific provision | DEFONEOS evidence |
|---|---|---|
| JSP 936 §6.2 | Standard GB + Scotland annex for classified perimeter | JSP 936 compliance |
| NCSC CAF v3.1 | Standard + Scotland-specific NCSC guidance for naval platforms | NCSC CAF assessment |
| ISO 27001 §A.8.8 | Standard + Leonardo Edinburgh ITAR-specific vuln management | Pen-test cadence |
| EU AI Act Art 6 / Art 50 | Standard + Edinburgh AI Safety Institute evaluation alignment | System card |
| Scottish Enterprise DSEdG | Scotland-only procurement channel | This hub pack §5 |
| AUKUS Pillar 2 | Edinburgh AI + Glasgow naval = dual Pillar 2 partners | AUKUS explainer |
| ITAR §120.6 | Leonardo Edinburgh — US-origin defence articles in Scotland | SBOM + BFT boundary enforcement |