Prepare for Def Stan 05-138 L3 with every Expert control evidenced

Def Stan 05-138 Level 3, or 'Expert', is the highest Cyber Risk Profile in Defence Standard 05-138 Issue 4. It lists 144 cyber security controls that MOD suppliers must have documented, implemented and evidenced when a contract is assessed as carrying a substantial level of cyber risk. It expects expert capabilities built on defence in depth to protect against new and evolving threats.

Level 3 has 144 controls against 139 at Level 2 'Advanced'. It adds six controls that apply only at Level 3: threat intelligence capabilities (1204), automated management of system accounts (2209), automated detection of misconfigurations and unauthorised components (2415), integrity verification tools (2425), continuous monitoring of security controls (3102) and resilient networking for equipment (4202). Control 3101 is replaced by its continuous version, 3102.

Any MOD supplier or subcontractor whose contract has been given a Level 3 Cyber Risk Profile through the Cyber Security Model Risk Assessment must meet it. The required level and a Risk Assessment Reference are usually provided in the invitation to tender. Primes pass the requirement to subcontractors through DEFCON 658 flow down, and each tier completes its own assessment.

Yes. Control 0002 requires Cyber Essentials Plus certification covering the scope of the contract, maintained for its duration, at Levels 2 and 3. Control 0001 also requires Cyber Essentials, which applies at every level. Cyber Essentials Plus is only the starting point, as the other 142 Level 3 controls go well beyond its five technical themes.

You submit a Cyber Improvement Plan. The MOD's guidance says a non-compliant supplier must set out when it will reach the required level, or why it cannot. The plan forms part of the contract and the authority considers it during supplier selection. The standard also requires suppliers to document and flag to the Authority any control they consider inappropriate or impractical.

You complete a Supplier Assurance Questionnaire on the MOD's Supplier Cyber Protection Service, which scores it against the Level 3 profile, and repeat it every year on the contract anniversary. The standard requires auditable evidence for each control. Defence Cyber Certification, run with IASME, offers independent evidence, though the MOD says the full SAQ is still required.

They overlap heavily but are not interchangeable. ISO 27001 certification will help with many Level 3 controls, such as risk management, access control and incident response, but Level 3 sets specific technical expectations, such as account lockout thresholds, threat intelligence and continuous control monitoring. The MOD assesses Def Stan 05-138 through its own questionnaire, not ISO 27001 certificates.

Def Stan 05-138 Level 3 is mapped in OneClickComply's control library and is available on request. Once enabled, its controls draw on the same evidence, policies and monitoring you use for Cyber Essentials Plus and ISO 27001. Our in-house audit team can help with SAQ answers and Cyber Improvement Plans. OneClickComply does not certify suppliers or guarantee MOD compliance.