UK DEF STAN 05-138: Cyber Security for Defence Suppliers

Why does it matter?

A supplier to the MOD is held to the standard by contract, not by choice. DEFCON 658 makes the Def Stan 05-138 controls for the assigned level a contractual requirement, the supplier must review its questionnaire annually, and it must flow the requirement down to subcontractors with their own risk assessment. A supplier that cannot meet the level needs an agreed Cyber Improvement Plan that becomes part of the contract. Because the profile level, not the supplier's own judgment, fixes the minimum controls, evidence has to be ready before bidding, and ISN 2025/07 expects MOD teams to allow realistic remediation time during the first year of operation.

Key benefits include:

• Four levels, one control table

Clause 3 lists every control against Levels 0 to 3, so a supplier can see exactly what its assigned level requires.

• Evidence as a duty

Clause 2.4 requires a documented and implemented control with auditable evidence for each requirement.

• Cyber Essentials built in

Control 0001 requires Cyber Essentials at every level and control 0002 requires Cyber Essentials Plus at Levels 2 and 3.

• Whole-organization view

Clause 1.1 puts the supplier's corporate environment in scope, beyond the information provided for one contract.

• Certification route

ISN 2026/02 lets valid DCC certification at the required level or higher satisfy the control requirement.

How does it work?

The MOD Delivery Team completes a Cyber Security Model risk assessment, which assigns a Cyber Risk Profile and a Risk Assessment Reference number, normally shown in the invitation to tender. The supplier completes the Supplier Assurance Questionnaire in the Supplier Cyber Protection Service, which scores it against the profile and tells the supplier at once whether it is compliant. A non-compliant supplier completes a Cyber Improvement Plan, which forms part of the contract; the MOD weighs compliance or the plan in supplier selection.

During the contract the supplier completes a new questionnaire on the anniversary of the contract award, with a one-month window, to show that it remains compliant. Under ISN 2025/07 that annual review is reinstated for existing DEFCON 658 contracts, and the supplier is notified of its updated profile level and reference under version 4 before the anniversary.

Flow down runs through the supply chain. A supplier that subcontracts completes its own risk assessment to generate a profile level and reference for the subcontractor, who completes the matching questionnaire; each tier repeats the step. On an existing contract, a supplier must first receive its own version 4 level and reference from its customer before it can start flow down. Clause 2.5 requires any control judged inappropriate or impractical to be documented and flagged to the MOD at bidding or as soon as it is identified.

Key Elements

• Cyber Risk Profile levels (clause 2.2)

Level 0 Basic (3 controls), Level 1 Foundational (101), Level 2 Advanced (139) and Level 3 Expert (144), assigned by the CSM risk assessment according to the assessed cyber risk.

• Requirements table (clause 3)

Four-digit control IDs grouped under Objective A managing security risk, B protecting against cyber attack, C detecting cyber security events and D minimizing the impact of incidents.

• Cyber Essentials baseline (controls 0001 and 0002)

Cyber Essentials certification covering the contract scope at all levels; Cyber Essentials Plus at Levels 2 and 3; both maintained for the length of the contract.

• Specific measures

Account lockout after at most ten failed attempts for a minimum of 15 minutes (2214), monthly vulnerability scans (2402) and response plan exercises at least every 12 months (4103).

• DEFCON 658

The contract condition that carries the Cyber Security Model terms, including annual questionnaire review and the flow-down obligations.

• Cyber Improvement Plan

The supplier's commitment, with timescales, to reach the required level where it is not yet compliant.

What does it cover?

Clause 1 sets the scope as the supplier's overarching corporate or enterprise environment: all organizations, systems, processes, procedures and data needed to protect Data and Functions, beyond the information provided for one contracted output. The requirements are a minimum, and individual contracts may require more, for example through a Security Aspects Letter (clause 1.4). ISN 2026/01 adds that the controls apply as a whole-of-organization requirement to business-critical operations across the supplier as a single legal entity, apply to organizations of any size, and are set by the assigned level rather than the supplier's own risk assessment.

What are its objectives?

Def Stan 05-138 exists to give the MOD a proportionate way to strengthen supplier resilience.

Define the minimum cyber controls a supplier needs for each Cyber Risk Profile level.

Protect UK and partner data as it moves through or is generated in the supply chain.

Take a whole-enterprise approach to cyber resilience so the supplier can keep delivering its contracted output.

Make compliance auditable, with documented controls and evidence for every requirement.

Let the MOD match the burden to the assessed risk instead of applying one set of controls to every contract.

Framework in Context

Def Stan 05-138 is one part of the Cyber Security Model, alongside the risk assessment, the Supplier Assurance Questionnaire, DEFCON 658 and flow down. The standard credits the NCSC, NIST SP 800-171 and SP 800-172, MITRE ATT&CK and the DCPP controls working group in its acknowledgements (clause 4), and its Cyber Essentials controls tie it to the UK scheme described at https://www.smartsuite.com/frameworks/uk-cyber-essentials-plus. It is a contractual standard for MOD work and is not a statute or regulation. Issue 4 also removed Issue 3's incident reporting clause because it duplicated DEFCON 658.

Common Framework Mappings

Suppliers map the control table to the frameworks below so that one set of controls and evidence serves MOD contracts, Cyber Essentials, ISO/IEC 27001 and other customers.

Mapped frameworks include:

CIS Controls v8.1

Cyber Essentials

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2

UK CAF v3.1

UK National Cyber Security Strategy

CMMC 2.0