Meet Def Stan 05-138 L1 controls and pass your MOD SAQ with confidence

Def Stan 05-138 Level 1 is the 'Foundational' Cyber Risk Profile in Issue 4 of the MOD's Cyber Security Standard for Suppliers. It is normally assigned where a contract carries a low to moderate level of assessed cyber risk, and it requires 101 controls, each documented, implemented and backed by auditable evidence. The standard describes it as demonstrating a comprehensive cyber security programme with good practices.

Level 1 sits between them. Level 0 'Basic' has only 3 controls: Cyber Essentials, UK GDPR compliance and resilient networks and systems. Level 1 adds 98 more, covering governance, risk, physical security, access control, encryption, monitoring and incident handling, for 101 in total. Level 2 'Advanced' has 139 controls and requires Cyber Essentials Plus, board-level direction, MFA for critical systems and tested recovery plans.

Level 1 requires Cyber Essentials certification (control 0001) covering the scope of the contract, maintained for the contract's duration. Cyber Essentials Plus (control 0002) is only required at Level 2 and Level 3. Many Level 1 controls go well beyond Cyber Essentials, so holding the certificate alone does not make a supplier Level 1 compliant.

The MOD delivery team completes a CSM Risk Assessment and gives you a Risk Assessment Reference and a Cyber Risk Profile level, usually in the invitation to tender. If you are a subcontractor, your prime contractor completes its own risk assessment to set your profile through flow-down. If you have not received a level, the MOD advises asking your customer for it.

Suppliers complete a Supplier Assurance Questionnaire on the MOD's Supplier Cyber Protection Service, self-assessing against the Level 1 controls. The questionnaire is scored automatically and renewed annually on the contract award anniversary. The Defence Cyber Certification scheme, run with IASME as Certification Authority, offers independent evidence of compliance, and the MOD says suppliers should expect it to be increasingly required in tenders.

You must submit a Cyber Improvement Plan with your tender, setting out when you will meet the required controls and the timescales, or why you cannot. The plan forms part of the contract, and the MOD considers compliance or the proposed plan when selecting suppliers. Controls you consider inappropriate for your circumstances must be documented and flagged to the Authority.

They overlap but are not interchangeable. Many Level 1 controls, such as risk assessment, access control, cryptography, supplier management and incident handling, align with ISO 27001 Annex A, so an existing ISMS gives you a strong head start. However, Level 1 also has specific technical requirements, such as account lockout after at most ten failed attempts, and ISO 27001 certification does not replace the SAQ.

Yes, on request. The Def Stan 05-138 Level 1 controls are mapped in OneClickComply's control library and available on request, rather than being a standard framework enabled by default. Once enabled, you get automated evidence collection, policy generation and continuous monitoring against the 101 controls, with the Cyber Essentials, ISO 27001 and UK GDPR overlaps mapped so evidence is reused.