Meet Def Stan 05-138 Level 2 controls with evidence ready for MOD

Level 2 is the 'Advanced' Cyber Risk Profile in Def Stan 05-138 Issue 4, the MOD's Cyber Security Standard for Suppliers. It contains 139 controls and is normally assigned where there is a high level of assessed cyber risk to a supplier delivering a contracted output. It requires advanced cyber security oversight and planning, driving robust organisational and cyber practices, and each control needs auditable evidence.

No. Issue 4, dated 14 May 2024, replaced the five Issue 3 profiles (N/A, Very Low, Low, Moderate and High) with Levels 0 to 3 and introduced new controls at each level. MOD guidance states the CSM v3 profiles are not consistent with CSM v4, so a supplier previously assessed as Moderate should not assume it meets Level 2 without checking against the Issue 4 control table.

The MOD Delivery Team completes a CSM Risk Assessment, which produces a Risk Assessment Reference (RAR) and a Cyber Risk Profile level. This is normally provided at early market engagement and found in the invitation to tender. If you are a subcontractor, your prime runs its own Risk Assessment and passes you the RAR and the level you must meet.

Level 2 has 139 controls against Level 1's 101: it adds 41 controls, and three broad Level 1 controls on data security, resilience preparation and backups give way to more specific ones. Additions include Cyber Essentials Plus, board direction and senior decision-making for security, assurance of internal controls, automated asset inventory, multi-factor authentication, privileged user and device management, data loss prevention, protection of data in transit and at rest, log security and triage, threat-focused training, exfiltration tests and tested response and recovery plans.

Yes. Control 0002 requires Cyber Essentials Plus certification covering the scope required for all aspects of the contract, maintained for the contract's duration. Cyber Essentials (control 0001) is required at every level, while Cyber Essentials Plus applies at Levels 2 and 3. Cyber Essentials Plus alone is not enough: the remaining Level 2 controls must also be met.

You submit a Cyber Improvement Plan (CIP) with your tender, setting out when you will meet the required level and the timescales, or why a control cannot be met. The authority considers compliance or the CIP proposal when selecting suppliers, and any agreed CIP becomes part of the contract. Controls deemed inappropriate must be documented and flagged to the Authority.

They overlap heavily but are not interchangeable. ISO 27001 is a certifiable management system standard, while Def Stan 05-138 Level 2 lists specific controls the MOD expects, such as Cyber Essentials Plus, annual penetration testing and personnel vetting policies. An ISO 27001 programme provides much of the governance, risk and evidence base, but each Level 2 control still needs to be checked and evidenced.

Def Stan 05-138 is mapped in OneClickComply's control library and available on request rather than live as a standard framework today. Once enabled, Level 2 controls are tracked alongside frameworks such as Cyber Essentials Plus and ISO 27001, with automated evidence collection, policy generation and continuous monitoring. OneClickComply does not issue MOD approvals or certify compliance.