How to become a supplier in the defence supply chain

The Canadian government has announced it will make an unprecedented series of investments in the defence industry. These investments are driven by the need to bolster national sovereignty, address geopolitical challenges and adhere to Canada’s commitments to NATO.

The aim is to increase Canadian military spending to 2% of GDP by 2025-2026 and to 5% by 2035. The 2025 federal budget earmarked some $85 billion over five years for defence, including $9.3 billion in 2025 2026. Over the next 10 years, cumulative spending could exceed $1.2 trillion.

These investments are sure to create business opportunities for Canadian small businesses. More than half (54%) of all expenditures by businesses in the defence supply chain stay in Canada, according to ISED Canada. Increased spending should therefore lead to an increase in orders for these businesses, especially as the government commits to focusing on Canadian suppliers.

In particular, new equipment purchases will open up new opportunities for small businesses in the aerospace, shipbuilding and automobile manufacturing industries. These businesses could also benefit from access to allied nations’ supply chains.

Original equipment manufacturers (OEMs) are already seeing a rise in orders. Their suppliers need to boost their production to meet growing demand. Requirements are also changing, and those that were previously informal are being formalized.

These trends are promising for those interested in entering the industry, particularly at a time when leading industrial companies are seeking to diversify in Canada to better manage this growth.

How to seize opportunities in the defence industry

We’re noticing growing interest in Canada’s defence industry in our daily interactions with entrepreneurs.

However, we also advise caution. Although there may be sizable opportunities, not all businesses are ready to enter this cutting-edge industry.

Defence is a highly regulated field. It calls for specialized certifications and security licences before you can even begin to generate revenue. Requirements for operating in the defence industry generally fall into three categories:

1. Controlled goods and security licences
   Businesses need to register for the Controlled Goods Program to examine, possess or transfer controlled goods in Canada. This program is often one of the first certifications required. You may also need to obtain specialized attestations to comply with various security requirements.
2. Cybersecurity
   Businesses that bid on certain Canadian government defence contracts or that wish to work in the field must now successfully complete the Canadian Program for Cyber Security Certification (CPCSC).
   
   While not all businesses in the supply chain need this certification, you may be asked to meet other cybersecurity requirements.
   
   For example, ISO 27001 can serve as a solid foundation for most businesses, whereas the Cybersecurity Maturity Model Certification 2.0 (CMMC 2.0) is often required for defence contracts in the United States. Without solid cybersecurity structures, your business may struggle to access the industry.
3. Quality control systems
   Defence contracts often have strict quality requirements, enforced through certifications such as ISO 9001, or AS9100 for businesses in the aerospace industry. Suppliers must meet these requirements to avoid being excluded from the industry.

Plan well before diving in

In the defence industry, the requirements imposed on suppliers vary according to the type of contract. Tier 1 suppliers, like OEMs, are generally subject to stricter requirements. Tier 2 suppliers, which manufacture parts or key sub-assemblies used by Tier 1 businesses, and Tier 3 suppliers, which provide raw materials, basic components, or specialized services for Tier 2 and sometimes Tier 1 operations, are subject to less stringent regulations.

You should therefore start with an operational and strategic analysis of your business to get a clear picture as to whether your skills match the industry’s requirements. For example, if you’re an automobile supplier specialized in welding, you likely already work with similar welding standards to those required by the defence industry for Tier 3 suppliers. These will give you a solid foundation.

If you decide to take things further, it’s key that you lay the foundation for operational efficiency, quality management and security. ISO 9001 is the basic standard and is a must, regardless of your sector of activity.

If you haven’t yet found customers, it’s a good idea to prioritize implementing these building blocks before proceeding. Some certifications are expensive, but ISO 9001 and cybersecurity measures are prerequisites, regardless of whether you’re aiming to work in the defence industry.

It’s often more difficult to obtain certifications in the defence industry if you don’t already have customers in the field. As these certifications can be very costly, some businesses opt to only certify a portion of their workshop or IT system.

Regardless of your strategy, it’s crucial to have a thorough understanding of your customers’ requirements and to build a solid foundation in terms of quality and cybersecurity from the start.

The growing importance of information security

Information security is a top priority in the defence industry. 

If you want to start working in this field, you’ll need to analyze your systems to determine your situation and develop an action plan for implementing a cybersecurity structure.

Cybersecurity standards aim to regulate the sharing of information within a company. If an OEM orders a part from you, they must know that access to the plans is secure. Develop a management plan to decide who will have access, how you will manufacture the part, and how you will prevent any leaks, such as printing, photos, or plans, leaving the premises.

For most projects, it’s a question of controlling and securing information according to its risk level.

If you don’t have any contracts, it may be too soon to seek CPCSC certification. However, it might make sense to implement foundational structures. ISO 27001 certification, for example, will help you make headway and prevent major surprises when the time comes to obtain more advanced certifications.

Beware of wasting your resources

We’ve seen clients who had long neglected cybersecurity be forced to spend thousands of dollars updating their systems. This can require changing IT service suppliers, as not all are able to ensure that your systems comply with industry standards.

If they’re aware that a project involves the defence industry, some suppliers will offer oversized systems or inflated assessments. Some consultation firms, which are also resellers, will prioritize their own products over your needs. Calling on an impartial third party, such as BDC, can help avoid this type of situation.

Advanced cybersecurity certifications require more expensive systems, but there are often more affordable solutions. Be sure to take regional variations into account, analyze your needs and develop a roadmap to avoid wasting your resources.

How to find customers in the defence industry

We suggest that you focus on brand recognition. Most business development in the defence sector happens through word of mouth. Many businesses develop gradually based on their products’ reputation.

Maybe you’ve already successfully delivered a small order? Others offer products that are so specialized that industry players have no choice but to do business with them. In either case, you’ll likely need to rapidly obtain your certifications.

Trade shows and industry events are also a key entry point. These can be international events, such as the International Paris Trade Show for the European aerospace industry, but there are others held in Canada. Major OEMs often attend events for steel, aluminum and polymer producers in order to identify suppliers that meet their needs.

Some businesses try to land new contracts through cold calling, but this isn’t effective and should be avoided. Most contracts in the industry are granted through government calls for tenders, but if you’re new to the industry, certification requirements may keep you from participating in them.

Be strategic

New investments in the defence industry will create business opportunities for small and medium-sized enterprises in Canada. To fully take advantage of them, you need to be well organized.

Industry standards are evolving rapidly and becoming increasingly stringent. Meeting them requires time, effort and investment. These costs must be considered when assessing a business opportunity in the defence industry.

If your business has already worked in this field, less effort will be required. However, we’ve noted that the industry is becoming more professional. Stay informed about the latest developments to avoid missing out.

If your business is new to the industry, it’s important to take the proper steps. You can’t manage a defence project with a spreadsheet. Be sure you have sufficient systems and the appropriate production capacity. In the defence industry, every detail counts. There’s zero tolerance for mistakes.

For businesses that are up for the challenge, numerous opportunities will be available. At BDC, we understand small businesses like yours and are here to guide you every step of the way, providing financing, capital and tailored advice.

Feel free to contact us if you think we can provide support or assistance.