Def Stan 05-138

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-03-30 ISN 2026/01 publishes temporary replacement text for the scope narrative of Def Stan 05-138 Issue 4; ISN 2026/02 accepts Defence Cyber Certification as evidence of its controls
2. 2025-12-03 Cyber Security Model v4 takes effect: new risk assessments and SAQs must use the gov.uk tooling, and interim measures are revoked (ISN 2025/07)
3. 2024-05-23 Def Stan 05-138 Issue 4 is published on gov.uk

1. 2024-05-14
   Def Stan 05-138 Issue 4 Major versionCurrent

   Substantive update replacing the five Cyber Risk Profiles (N/A, Very Low, Low, Moderate, High) with four (Level 0 to Level 3) and introducing new control requirements at each level. source

   More

   • Scope is now the supplier's overarching corporate or enterprise environment, not only the information provided for the contract.
   • The incident reporting clause was removed because it duplicated DEFCON 658.
   • Annex B, "MOD Identifiable Information", was removed and the term is no longer used.
2. —
   Def Stan 05-138 Issue 3 Major version

   The previous issue, with five Cyber Risk Profiles (N/A, Very Low, Low, Moderate, High) and an annex on MOD Identifiable Information. source

Every MOD supplier and subcontractor on an MOD contract, at the Cyber Risk Profile level the contract's risk assessment assigns.

Who

All MOD procurements, MOD suppliers and their subcontract suppliers which have a relationship to one or more MOD contracts. source

Scope

The supplier's overarching corporate or enterprise environment; the controls are a minimum, and contracts may require more. source

Levels

Level 0 "Basic" (3 controls), Level 1 "Foundational" (101), Level 2 "Advanced" (139) and Level 3 "Expert" (144). source

Cyber Essentials

Every level requires Cyber Essentials certification covering the contract scope; Levels 2 and 3 also require Cyber Essentials Plus. source

Flow down

Suppliers flow the requirements down to subcontractors under DEFCON 658, running their own risk assessment to set each subcontract's Cyber Risk Profile. source

Suppliers self-assess in a Supplier Assurance Questionnaire, repeated each contract anniversary; Defence Cyber Certification can be used as evidence.

Risk assessment

The MOD delivery team completes a CSM risk assessment, which sets the contract's Cyber Risk Profile and a Risk Assessment Reference. source

SAQ

Suppliers complete a Supplier Assurance Questionnaire in the Supplier Cyber Protection Service, scored automatically against the profile. source

Cyber Improvement Plan

A non-compliant supplier submits a Cyber Improvement Plan with timescales; an agreed plan becomes part of the contract. source

Annual review

A new SAQ is completed each year on the contract award anniversary, with one month to complete it. source

Defence Cyber Certification

Valid DCC certification at a level equal to or above the required profile is to be accepted as satisfying the Def Stan 05-138 control requirement. source

Evidence

For each control the supplier must have a documented and implemented control with auditable evidence. source

A contractual requirement under DEFCON 658: compliance or an agreed improvement plan is weighed in supplier selection and written into the contract.

Contractual

Suppliers are contractually required to meet Def Stan 05-138 controls; DEFCON 658 lays out the contractual terms for the Cyber Security Model. source

Supplier selection

The authority takes supplier compliance, or the proposed Cyber Improvement Plan, into consideration in supplier selection. source

First year

MOD project teams are expected to take account of the enhanced requirements during the standard's first year of operation (calendar year 2026) when setting remediation timescales. source

1. Standard Defence Standard 05-138 Issue 4 — Cyber Security Standard for Suppliers (PDF)
2. Guidance Cyber Security Model (gov.uk guidance)
3. Guidance ISN 2025/07: Implementation of CSM (v4)
4. Guidance ISN 2026/01: Update to Def Stan 05-138 (Issue 4) covering narrative
5. Guidance ISN 2026/02: Use of Defence Cyber Certification under DEFCON 658

1. Cyber Essentials

   The UK government certification that every Def Stan 05-138 level requires; the defence standard adds controls on top of it.

2. CMMC

   The US Department of Defense's contractor cybersecurity program, rather than the UK MOD's Cyber Security Model.

3. NISPOM

   US rules for contractors handling classified information, rather than UK cyber controls for MOD suppliers.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Def Stan 05-138 (RSS)