Meet Def Stan 05-138 cyber controls for every MOD contract

Def Stan 05-138 is the UK Ministry of Defence's Cyber Security Standard for Suppliers. It lists the minimum cyber security controls a defence supplier must have in place, grouped into Cyber Risk Profiles. Issue 4, dated 14 May 2024, contains 148 controls across four levels, from Level 0 (Basic) to Level 3 (Expert). The standard applies to the supplier's whole organisation, not only the systems used for one contract.

Suppliers and subcontractors working on MOD contracts that include DEFCON 658 must comply with Def Stan 05-138. The MOD runs a Cyber Security Model risk assessment for each contract, which assigns a Cyber Risk Profile. The supplier must then meet the controls for that profile and confirm this through a Supplier Assurance Questionnaire. Prime contractors also flow the requirements down to their own subcontractors.

Issue 4 has four Cyber Risk Profiles. Level 0 (Basic) has 3 controls for very low risk. Level 1 (Foundational) has 101 controls for low to moderate risk. Level 2 (Advanced) has 139 controls for high risk. Level 3 (Expert) has 144 controls for substantial risk. Issue 4 replaced the five Issue 3 profiles of N/A, Very Low, Low, Moderate and High.

Yes. Issue 4 was published in May 2024 for information only under ISN 2024/02. Industry Security Notice 2025/07 withdrew that arrangement and reinstated the Cyber Security Model process from 3 December 2025. New risk assessments now use the Issue 4 levels, and suppliers on existing DEFCON 658 contracts are told their updated Cyber Risk Profile before their contract's anniversary review.

Cyber Essentials is built into Def Stan 05-138. Control 0001 requires Cyber Essentials certification covering the contract scope at every level, and control 0002 requires Cyber Essentials Plus at Levels 2 and 3. Cyber Essentials alone is not enough above Level 0, because Levels 1 to 3 add controls on governance, risk management, monitoring, incident response and resilience.

Def Stan 05-138 and ISO 27001 overlap heavily but are not interchangeable. ISO 27001 is a certifiable management system standard, while Def Stan 05-138 is a fixed list of MOD control requirements tied to a contract's risk level. An ISO 27001 programme gives you much of the policy, risk and access control evidence Def Stan asks for, but you still need to check each Def Stan control for your level.

The supplier must document it and tell the MOD. Clause 2.5 says that where a control is inappropriate or impractical in specific circumstances, the supplier documents this and flags it to the Authority when bidding, or immediately if it arises during the contract. Gaps are typically handled through a remediation plan agreed with the MOD, and failing to meet requirements can affect your ability to win or keep contracts.

Yes, on request. Def Stan 05-138 is mapped in OneClickComply's control library and available on request rather than as a live self-serve framework. Once enabled, you can work towards your assigned Cyber Risk Profile using automated evidence collection, AutoComplete policies, continuous monitoring and expert support from our in-house audit team, reusing evidence from Cyber Essentials and ISO 27001.