AEGIS takes you to the Cyber Risk Profile your contracts require — DCC Level 0 through 3 — and keeps you there. A hardened, managed Microsoft 365 environment. OFFICIAL-SENSITIVE handling, documentation included. And the consulting to close the DefStan 05-138 gap and get you through Defence Cyber Certification. Built so a busy founder can focus on winning contracts, not fighting compliance.
DCC Levels 0 to 3//OFFICIAL-SENSITIVE handling//Managed Microsoft 365 security//You own your tenant//Level 0 intro offer until 30 Sep 26//DCC Levels 0 to 3//OFFICIAL-SENSITIVE handling//Managed Microsoft 365 security//You own your tenant//Level 0 intro offer until 30 Sep 26//
// Operational security first. Evidence as the output.
WHAT AEGIS IS.
AEGIS is an operational cyber security service. We bring your environment up to defence standard, we protect it, and we produce the evidence that proves it. In that order.
The order matters. A gap report doesn't make you secure, and a certificate doesn't stop an intrusion. Defence suppliers are live targets for criminal and state-backed actors, so the security has to be real first — identity, email and endpoints hardened, threats detected and answered around the clock.
Because the environment is genuinely built to the standard, the evidence comes out of it. That is the difference between an assessment you can pass and a documentation exercise bolted onto an environment that never met the bar.
01 — Harden and protect
Hardened, managed, and yours.
Hardening of identity, email and endpoints, plus active threat detection and response. Built by us, protected by us, owned by you. The tenant is yours, not ours, and it stays yours if you ever walk away. Delivered on MIDAS, our managed Microsoft 365 security service.
02 — Handle OFFICIAL-SENSITIVE
The controls and the paperwork.
Sensitivity labelling, data loss prevention and label-based encryption, configured to handle OFFICIAL-SENSITIVE. Then the part everyone underestimates: the Secure by Design documentation. Risk assessment, staff handling policy, data protection screening and sign-off pack, all pre-built. You name a risk owner and sign.
03 — Evidence and certify
The route to the certificate.
Consulting to close the gap against Defence Standard 05-138 at your required level, and to get you assessment-ready for Defence Cyber Certification. DCC is awarded by an IASME-approved certification body, not by us. Our job is to make sure you pass.
// Sized to your Cyber Risk Profile
WHICH LEVEL DO YOU NEED?
You don't choose your level — your contract does. The MOD assigns a Cyber Risk Profile to each contract and states it in the invitation to tender. If you're subcontracting, your prime flows it down to you. AEGIS is delivered at all four.
0
Basic
Very low assessed cyber risk.
Cyber Essentials, UK GDPR evidence, and resilient networks — working backups and a tested recovery plan. Deliberately achievable for small companies.
101 DefStan 05-138 controls. Where a real security programme starts: network monitoring alongside risk management, defined responsibilities and policy.
Priced on scope
2
Advanced
High assessed risk.
139 controls, and Cyber Essentials Plus replaces standard Cyber Essentials. More demanding requirements across planning, oversight and technical assurance.
Priced on scope
3
Expert
The most critical contracted outputs.
144 controls and a full defence-in-depth approach. Expert capability, evidenced end to end.
Priced on scope
Where non-Microsoft 365 systems are in scope — on-premises infrastructure, a LAN site, a standalone application — we add ATLAS, our monitoring service for those sources. That's a question about your estate, not about your level.
The Ministry of Defence has asked its supply chain to be DCC Level 0 certified by 31 December 2026. The requirement flows down — primes will demand it of every company they buy from. And that supply chain increasingly handles OFFICIAL-SENSITIVE information that must be managed in line with Government Security Classification guidance and MOD policy.
We have built AEGIS — a single, managed solution that handles everything: the technology, the policies, the processes and the documentation. You focus on the business. We get you secure and certified, and keep you compliant and defended.
DCC isn't optional positioning any more. Hold Level 0 early and you're the supplier that's already cleared to bid. Leave it late and you're the one explaining to a delivery team or prime why you're not.
Not compliance theatre
The threat is real. So is the security.
Defence suppliers are live targets — from cyber criminals to nation states. A badge on your website stops none of it. AEGIS includes proactive hardening and configuration to make you a hard target, and continuous monitoring ready to respond if something does get through.
We don't tell. We do.
Hands on keyboards — not a gap report.
Most providers hand you a gap report and leave the hard work to you. We handle the technology, policies, processes and documentation — you review and sign off, we deliver. Your Microsoft 365 environment hardened to defence standard, defended from day one.
// AEGIS Level 0 — technology, documentation and certification. One price.
THE LEVEL 0 PACKAGE.
At Level 0 we sell AEGIS as a single fixed-price package, all-in and fully managed, for organisations of up to 10 users entering the UK defence supply chain. Everything below is in it — including the Microsoft licences and the certification body's fee, the two costs that usually arrive as a surprise.
Levels 1 to 3 are the same three components, scoped and priced against your contract rather than packaged.
01
Managed Microsoft 365 Security
Nova Blue MIDAS Micro+ — hardening of identity, email and endpoints, plus active threat detection and response. Built by us, protected by us, owned by you.
IdentityEmailEndpointMonitoring
02
Cyber Essentials Certification
Full readiness, technical controls, evidence pack and certification. Certifying body fee included.
Cyber EssentialsFee included
03
DCC Level 0 Certification
Assessed against Defence Standard 05-138 — technical controls, policy documentation and certifying body fee all included.
DefStan 05-138DCC Level 0Fee included
04
OFFICIAL-SENSITIVE Handling
Information handling framework aligned to Government Security Classification guidance and MOD policy — so your team can receive, process and store classified information legally, safely and securely.
GSC alignedMOD policy
05
Microsoft 365 Licences
Microsoft 365 Business Premium + Defender and Purview Suite — every user licensed, configured and managed.
Business PremiumDefenderPurview
06
Optional: Hardware Packages
Laptops or laptop + phone — fully secured and enrolled before delivery. Bring your own devices, or let us supply. From £1,850.
From £1,850Pre-secured
// AEGIS Level 0 — choose your plan
ONE PRICE. FULLY MANAGED.
Technology, documentation and certification in a single package, for organisations of up to 10 users. Levels 1 to 3 are scoped and priced against your contract — tell us your level and we'll come back with a number.
Introductory pricing
A LIMITED NUMBER OF PLACES, OPEN UNTIL 30 SEP 2026.
The prices below are introductory. They apply to a limited number of Level 0 places and close at the end of September. AEGIS itself continues after that date — it is the pricing that is time-limited, not the service.
--
Days
--
Hours
--
Minutes
--
Seconds
Option A
£2,400 up front
+ £185 /user / month
Lower ongoing monthly cost. Ideal if you can invest up front to set up your secured, certified environment.
Option B No up-front cost
£0 up front
£420 / month (incl. one user) + £185 / additional user / month
Spread the cost. Get secure and certified with nothing to pay up front.
+
Optional add-on — Hardware from £1,850
Laptop-only or laptop + phone, fully secured and enrolled before delivery.
All-in. One price, fully managed · Organisations of up to 10 users · Subject to a 12-month contract · All prices exclude VAT
Already further along? If you're already in the market but need to go further — better security or a higher level of compliance — we can help.
Tell us you're interested — we'll confirm eligibility, agree a start date, and get moving. No obligation.
We confirm eligibility
A quick check that AEGIS is the right fit for your team size and stage — built for organisations of up to 10 users entering the defence supply chain.
We agree a start date
A clear plan and timeline to get you secured, certified and bid-ready — well ahead of the 31 December 2026 DCC deadline.
We get moving
Hands on keyboards from day one. We handle the technology, policies, processes and documentation — you review and sign off.
Why Nova Blue
Decades of experience in defence and national security, at the highest levels of both the public and private sectors. Let us manage the cyber security so you can build your business.
Register Your Interest
// Limited places · Open until 30 Sep 26
// Interest registered
WE'LL BE IN TOUCH WITHIN 24 HOURS.
One of our defence cyber specialists will confirm your eligibility and agree a start date to get AEGIS moving.
We use cookies to understand how visitors use our site and to improve your experience. You can accept or decline non-essential cookies. See our Privacy Policy for details.
