Operationalizing cybersecurity controls in defence procurement contracts: An empirical study and governance integration model

In the context of accelerating digitalization, defence supply chains have become structurally dependent on interconnected information systems, increasing their exposure to systemic cyber risks. This study examines how cybersecurity control objectives are operationalized within defence procurement contracts of the Slovenian Armed Forces, conceptualizing contracts as enforceable governance instruments for supply chain security. A structured content analysis of 368 publicly available defence procurement contracts reveals significant asymmetry: only 4.3% contain explicit information security clauses and 4.6% address malware protection, while 67% focus primarily on personnel security vetting. The findings indicate limited contractual embedding of technical cybersecurity controls across procurement categories. To address this structural gap, the paper introduces the Contractual Cybersecurity Integration Model (CCIM), a governance translation architecture that converts standardized cybersecurity control objectives into enforceable contractual clauses supported by monitoring and sanctioning mechanisms. The model is organized around seven safeguard domains and is formally aligned with NIST SP 800-53 Rev.5, NIST CSF 2.0, ISO/IEC 27001:2022, and the NIS2 Directive. Rather than proposing new technical standards, CCIM operationalizes existing control families within procurement lifecycle phases. The study contributes a contract-embedded implementation model for defence supply chain cybersecurity, bridging the gap between technical security frameworks and legally enforceable procurement practice. The results are particularly relevant for digitally dependent defence organizations operating under resource constraints in comparable NATO and EU regulatory contexts.