Meet Def Stan 05-138 L0 and bid for MOD work with confidence

Def Stan 05-138 Level 0 is the 'Basic' Cyber Risk Profile in the MOD's Cyber Security Standard for Suppliers, Issue 4. It is the lowest of four profiles and is normally assigned where there is a very low level of assessed cyber risk to a supplier delivering an output. It contains three controls and requires suppliers to demonstrate basic cyber security practices.

Level 0 has three controls. Control 0001 requires Cyber Essentials certification covering the contract scope, maintained for the contract's duration. Control 2314 requires personal data to be processed in compliance with UK GDPR. Control 2500 requires resilience against cyber attack and system failure to be built into the design, operation and management of systems supporting business functions and data.

Not exactly. Issue 4 replaced the five Issue 3 profiles (N/A, Very Low, Low, Moderate and High) with Level 0 to Level 3, and the MOD states the old profiles are not consistent with the new ones. Level 0 is normally assigned for very low assessed cyber risk, but it has its own control set, so suppliers should assess against Issue 4 rather than relying on a previous Very Low result.

Yes. Control 0001 requires the supplier to hold Cyber Essentials certification covering the scope needed for all aspects of the contract and to commit to maintaining it for the contract's duration. Cyber Essentials Plus is not required at Level 0; it becomes a requirement from Level 2. Letting the certificate expire during the contract would leave you out of line with the profile.

You show compliance by completing a Supplier Assurance Questionnaire through the MOD's Supplier Cyber Protection Service against the Level 0 profile in your tender. It is scored automatically. If you cannot meet a control, you submit a Cyber Improvement Plan that becomes part of the contract. You repeat the questionnaire each year on the contract award anniversary, and each control needs documented, auditable evidence.

A supplier that is not compliant must complete a Cyber Improvement Plan explaining when and how it will meet the profile, or why it cannot. The contracting authority considers compliance or the plan during supplier selection, and an agreed plan forms part of the contract. Because the controls are contractual through DEFCON 658, falling short can affect whether you win or keep MOD work.

Level 0 directly requires UK GDPR compliance through control 2314, so existing data protection work counts. It does not require ISO 27001, but an ISO 27001 programme will usually cover the resilience expected by control 2500. Cyber Essentials remains a separate certification you must hold regardless of ISO 27001 status.

Def Stan 05-138 Level 0 is mapped in OneClickComply's control library and available on request. OneClickComply helps you prepare for and maintain Cyber Essentials, generate policies, and collect evidence for UK GDPR and resilience, with controls mapped to higher Def Stan 05-138 levels. OneClickComply does not issue Cyber Essentials certificates or MOD approvals.