UK DEF STAN 05-138 — Cyber Security for Defence Systems

UK DEF STAN 05-138 establishes minimum cyber security requirements for defence systems procured by the UK Ministry of Defence (MOD). It is used to ensure that suppliers address cyber risks throughout the lifecycle of MOD systems, from concept through disposal. The standard focuses on protecting sensitive information and maintaining operational capability.

Yes, UK DEF STAN 05-138 is mandatory for all relevant MOD contracts involving defence systems and equipment. Suppliers must demonstrate compliance as part of the procurement process, and ongoing adherence is regularly monitored by MOD accreditation authorities.

The scope of UK DEF STAN 05-138 covers all defence systems, including ICT, operational technology, and components that process, store, or transmit MOD information. It applies to both new projects and modifications to existing systems, regardless of whether systems are developed in-house or sourced from third parties.

The standard requires suppliers to perform cyber risk assessments, implement technical and procedural controls, manage supply chain security, and produce key artifacts such as Cyber Security Management Plans (CSMPs) and Security Cases. Emphasis is placed on demonstrating proactive risk management and documenting compliance throughout system development.

Implementation begins with a cyber risk assessment to identify threats and vulnerabilities. Organizations must then develop a CSMP outlining mitigation strategies, apply technical controls, ensure secure system design, and provide traceable evidence throughout the system lifecycle. Regular reviews and updates are required as threats and system scopes evolve.

UK DEF STAN 05-138 aligns with MOD and wider UK Government policies, and is often used alongside standards such as ISO 27001 and NIST SP 800-53. However, it specifies requirements tailored for MOD operational environments and the unique nature of defence systems, providing more detailed guidance than some general-purpose frameworks.

Organizations must regularly review cyber risks, update security documentation, and conduct periodic audits to verify control effectiveness. Continual improvement processes should be in place to address new vulnerabilities, and any significant changes to systems require reassessment against the standard’s requirements.

SmartSuite can help organizations manage UK DEF STAN 05-138 compliance by enabling risk tracking, managing cyber controls, and automating evidence collection for audits. The platform facilitates documentation of key artifacts such as CSMPs, supports workflow automation for compliance tasks, and provides robust reporting to demonstrate MOD audit readiness and ongoing compliance.