7 Wales procurement entry points · 5 Welsh force priorities · 4 DEFONEOS Wales MCPs · Welsh devolved procurement alignment
Wales hosts some of the UK's most strategically significant defence assets outside Scotland and the South of England. (a) QinetiQ Aberporth / MOD Hebrides Range — the UK's primary missile and UAV test range, generating sovereign ISR and telemetry data that DEFONEOS can ingest and govern via BFT council. (b) Airbus Defence & Space Broughton — the A400M wing manufacturing facility, driving supply-chain cybersecurity demand for the UK's largest military-aircraft programme. (c) St Athan / MOD Cardiff — Defence Electronics & Components Agency (DECA) and the proposed Wales Freeport, creating a defence-electronics maintenance cluster with sovereign-data requirements. (d) DE&S Abbey Wood (West) — while Bristol-based, the Wales/M4 corridor draws significant MOD commercial activity into South Wales.
Wales also has a devolved procurement dimension: the Welsh Government's Defence & Aerospace sector group (within the Economy Department) maintains engagement with the UK defence supply chain, and the Development Bank of Wales offers co-funding pathways for Welsh defence-tech SMEs. This hub pack documents the Wales-specific DEFONEOS procurement entry points, force priority mappings, MCP coverage, and devolved procurement considerations.
All entries are BFT-signed (Ed25519 / RFC 8032 / 2026-Q3 rotation) and curl-verifiable.
| # | Entry point | Location | Force priority | DEFONEOS fit |
|---|---|---|---|---|
| W1 | QinetiQ — Aberporth / MOD Hebrides Range | Aberporth, Ceredigion | Missile & UAV test range · telemetry & ISR data | DEFONEOS MCPs: rtsp-camera · mqtt-bridge · bft-council-probe · aisstream-maritime — sovereign telemetry ingest and BFT-governed test-range C2 |
| W2 | Airbus Defence & Space — Broughton | Broughton, Flintshire | A400M wing manufacturing · military-aircraft supply chain | DEFONEOS MCPs: mcp-cspm · mcp-dynamic-sbom · bft-council-probe — sovereign SBOM publisher + supply-chain cybersecurity for A400M programme |
| W3 | DECA — Defence Electronics & Components Agency (St Athan) | St Athan, Vale of Glamorgan | Defence electronics maintenance · avionics repair · component testing | DEFONEOS MCPs: mcp-dynamic-sbom · bft-council-probe · mqtt-bridge — sovereign component-lifecycle tracking and SBOM for DECA's repair pipeline |
| W4 | BAE Systems — Glascoed (munitions) | Glascoed, Monmouthshire | Munitions manufacturing & storage · explosive-ordnance safety | DEFONEOS MCPs: mqtt-bridge · bft-council-probe · mcp-cspm — IoT perimeter monitoring + BFT-gated safety compliance for explosive-storage facilities |
| W5 | Welsh Government — Defence & Aerospace Sector Group | Cardiff | Welsh defence-industry policy · SME growth · dual-use | DEFONEOS provides the Welsh defence cluster's shared AI OS — BFT council + SBOM publisher + pen-test cadence standardises Welsh SME contributions to MOD |
| W6 | Swansea University — SPECIFIC / Computational Foundry | Swansea | AI & data science research · smart manufacturing · digital twins | DEFONEOS provides Swansea's AI research testbed — BFT council + pen-test cadence validates academic MCP contributions to the Welsh defence cluster |
| W7 | DASA Wales Engagement (via DASA Open Call) | Remote / via DASA HQ London | DASA-funded dual-use AI research in Wales | DEFONEOS is the deployment target for DASA Wales-funded research — academic teams build MCPs on DEFONEOS substrate, MOD evaluates via BFT council |
All 7 Wales entry points sourced from MOD Regional Defence Employer Engagement (Wales, 2026-Q1) + Welsh Government Defence & Aerospace sector directory + publicly available MOD contract registers.
| # | Welsh force priority | Owning formation | DEFONEOS MCP coverage | Alignment cross-walk |
|---|---|---|---|---|
| F1 | Missile & UAV test-range telemetry assurance | QinetiQ / DE&S Weapons | rtsp-camera · mqtt-bridge · bft-council-probe · aisstream-maritime | JSP 936 §6.2 (Information Management) · STANAG 4586 (UAS C2) · NCSC CAF B3 |
| F2 | Military-aircraft supply-chain cybersecurity | Airbus Defence / DE&S | mcp-cspm · mcp-dynamic-sbom · bft-council-probe | JSP 936 §6.3.2 (Pen Testing) · ISO 27001 §A.8.8 · NIST 800-171 (CMMC) |
| F3 | Defence electronics component lifecycle | DECA / St Athan | mcp-dynamic-sbom · bft-council-probe · mqtt-bridge | JSP 936 §6.1 (Supplier Assurance) · AS9100 (Aerospace QMS) · ISO 42001 §A.2 |
| F4 | Munitions facility perimeter security | BAE Systems / DIO | mqtt-bridge · bft-council-probe · mcp-cspm | JSP 440 (Manual of Security) · DIO Facility Security · NCSC CAF B1 |
| F5 | Welsh SME defence supply-chain integration | Welsh Government / MOD DGP | All 30 MCPs (standardised SBOM + BFT + pen-test) | G-Cloud 14 (CCS) · DSP registration · Welsh Government procurement |
| # | MCP | Category | Wales deployment | Key capability |
|---|---|---|---|---|
| M1 | rtsp-camera | Sensor | QinetiQ Aberporth test range · St Athan facility | IP camera ingest · sovereign video pipeline · UAV tracking |
| M2 | mqtt-bridge | Sensor | Aberporth telemetry · Glascoed perimeter · St Athan IoT | IoT sensor bridge · MQTT sovereign data ingest |
| M3 | bft-council-probe | Core | All 7 Wales entry points | 33-agent BFT defence council · quorum-gated decision audit |
| M4 | mcp-cspm | Compliance | Airbus Broughton · Glascoed · St Athan | Cloud security posture management · sovereign configuration audit |
| Dimension | Wales-specific | DEFONEOS implication |
|---|---|---|
| Welsh Government Defence Sector Group | Engagement via Economy Dept · separate from CCS GB | DEFONEOS should register with Welsh Gov procurement in addition to CCS |
| Development Bank of Wales | Co-funding for Welsh defence-tech SMEs up to £2M | DEFONEOS Wales MCPs qualify — separate funding lane from DASA |
| Wales Freeport (Celtic Freeport) | St Athan + Milford Haven — tax & customs incentives for defence manufacturing | DEFONEOS deployment in Celtic Freeport zone may attract Freeport incentives |
| Swansea University research | SPECIFIC IKC + Computational Foundry — AI & data science | DEFONEOS provides AI-assurance testbed for Swansea research contributions |
| QinetiQ Aberporth test range | UK's primary missile/UAV test facility — sovereign telemetry data | DEFONEOS provides BFT-governed telemetry ingest (OFFICIAL data only) |
| Step | Action | Who | Time | Prerequisite |
|---|---|---|---|---|
| 1 | Identify Wales cluster (Aberporth / Broughton / St Athan / Cardiff / Swansea) | Buyer | 15 min | This hub pack §2 |
| 2 | Confirm procurement vehicle (DSP / G-Cloud 14 / Welsh Gov / DASA) | Buyer + CSOAI | 30 min | Framework checklist |
| 3 | Confirm security classification boundary (OFFICIAL / OFFICIAL-SENSITIVE / SC) | Buyer + CSOAI | 1 hour | SC clearance guide |
| 4 | Submit pilot request (Wales entry point or DSP direct award) | Buyer | 1 hour | DSP tracker |
| 5 | CSOAI provisions Wales-region sovereign VM + DEFONEOS substrate | CSOAI | <24 hours | AG-1: curl -s /health HTTP 200 |
| Buyer type | Entry point | Procurement vehicle | Security requirement | Pilot tier |
|---|---|---|---|---|
| QinetiQ (test range operator) | W1 | Direct award / DSP | SC minimum | T2/T3 |
| Airbus Defence (A400M programme) | W2 | Direct award / Airbus supply-chain | SC · ITAR boundary | T3 MOD |
| DECA St Athan (MOD agency) | W3 | MOD direct / DSP | SC | T2/T3 |
| BAE Glascoed (munitions) | W4 | Direct award | DV for some roles | T2/T3 |
| Welsh Government sector group | W5 | Welsh Gov procurement / CCS | OFFICIAL | T1/T2 |
| Swansea University | W6 | G-Cloud 14 / DASA | OFFICIAL-SENSITIVE | T1 Solo |
| DASA Wales research team | W7 | DASA Open Call | OFFICIAL-SENSITIVE | T1/T2 |
| Framework | Wales-specific provision | DEFONEOS evidence |
|---|---|---|
| JSP 936 §6.2 | Standard GB + Wales annex for test-range data | JSP 936 compliance |
| NCSC CAF v3.1 | Standard + QinetiQ range-specific data assurance | NCSC CAF assessment |
| ISO 27001 §A.8.8 | Standard + Airbus Broughton supply-chain vuln management | Pen-test cadence |
| NIST 800-171 / CMMC | Airbus Broughton — US-origin components (ITAR) | SBOM + BFT boundary enforcement |
| AS9100 | Aerospace Quality Management Standard — Airbus Broughton | SBOM publisher + component lifecycle tracking |
| Welsh Gov procurement | Wales-only procurement channel | This hub pack §5 |
| Celtic Freeport incentives | St Athan + Milford Haven zone | Deployment in Freeport zone qualifies for incentives |
⚠️ HARD RED-LINE: DEFONEOS handles OFFICIAL and OFFICIAL-SENSITIVE data ONLY. No classified data flows through DEFONEOS. QinetiQ Aberporth classified telemetry, BAE Glascoed DV-restricted munitions data, and Airbus ITAR-controlled technical data with classification markings must use separate accredited systems. DEFONEOS provides non-classified C2 perimeter monitoring, IoT sensor ingest, and BFT council governance for the OFFICIAL boundary only.