Compliance for two-person defence suppliers: where to start
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
You are two people. You have a defence tender in front of you, a list of clauses you do not recognise, and no compliance manager to hand it to. This is the exact situation ComplyTrain is built for. Its AI agents act as a virtual quality team, and the Tender module reads the compliance section of an invitation to tender, flags the gaps against what you already hold, and turns them into actions so you can complete a response without hiring a specialist. This guide suggests one way to approach your first 90 days: what to read, what to write down, and what you can reasonably leave alone until a contract requires it.
Let the tender set your priorities, not the standards catalogue
Do not start by buying a stack of standards. Start with the specific tender or framework you are chasing. Read the compliance section of the invitation to tender line by line. Note every clause that names a standard, a control, or a document you must produce. That list is your scope. Everything outside it is optional for now. The ComplyTrain Tender module does this parsing for you: it extracts each named requirement and marks which ones you can already evidence and which need work.
Most small suppliers find the same three drivers. First, a quality management system, usually expressed as ISO 9001 or an equivalent. Second, information security obligations, often flowed down from the prime contractor rather than the end customer. Third, export control and personnel screening requirements tied to the goods or data involved. Confirm which of these your tender actually asks for before you spend a day on any of them.
Days 1 to 30: write down what you already do
A quality management system is not a binder you buy. It is a written record of how you actually work. In the first month, document your existing process: how you take an order, how you check the work, how you handle a mistake, and who signs off. Two people can do this in short sessions across a fortnight.
Structure that record around ISO 9001 so it maps cleanly to what an assessor or a prime expects. You do not need certification on day one. You need a documented, followed process. Our overview of the standard at /standards/iso-9001 explains the clauses in plain terms and shows which ones a small supplier can satisfy with a single page each.
Days 31 to 60: fix the security basics that tenders check
Primes flow down information security requirements because their own contracts demand it. You will be asked where data lives, who can access it, and how you separate one customer's information from another's. Answer these with facts, not intentions.
If you use a hosted compliance platform, know its architecture. ComplyTrain uses silo-model tenant isolation: a separate schema, a separate Cognito user pool, and a separate storage bucket for each tenant. Data is hosted in the EU, in AWS eu-central-1 (Frankfurt). Being able to state this precisely, rather than gesturing at security in general, is what moves you through a supplier questionnaire.
Days 61 to 90: train the people, then stop
With two of you, training records are short but they must exist. Record who was trained, on what, and when. Cover the topics your tender names: code of conduct, data handling, and any export control briefing your goods require. Keep the evidence in one place so you can produce it on request.
How to avoid over-engineering
The most common failure for a small supplier is building a programme sized for a company ten times larger, then abandoning it within a year. Resist it. Write only the procedures your work actually uses. Do not claim standards you have not been assessed against. A single accurate page beats a fifty-page manual nobody follows, and an auditor will see the difference in minutes.
Review your scope every quarter against live tenders. Add controls when a contract requires them, retire documents that describe work you no longer do, and keep the system small enough that two people can maintain it. See how a lightweight QMS supports this at /product/qms, where the AI agents maintain your documented process as a running record rather than a static binder.
Book a walkthrough with our team to map your next tender's clauses to a plan you can sustain.