UK MoD compliance requirements

UK Ministry of Defence supplier compliance is an umbrella label for the security conditions written into MOD contracts.

The core cyber element is the Cyber Security Model (CSM): DEFCON 658 is the contract condition that obliges a supplier to meet the cyber controls in Defence Standard 05-138 at the Cyber Risk Profile (Very Low, Low, Moderate, or High, numbered 0 to 3 in the current issue) that the MOD assigns to the contract, and to flow the same obligations down to subcontractors.

Suppliers demonstrate compliance through a Supplier Assurance Questionnaire on the MOD's Supplier Cyber Protection Service portal, renewed annually and whenever the contract changes.

The MOD has also introduced Defence Cyber Certification (DCC) with IASME as delivery partner, a certification aligned to Def Stan 05-138 that suppliers are increasingly expected to hold for the life of the contract (verify current rollout status).

Around the cyber core sit the other MOD conditions: DEFCON 659A and the Security Aspects Letter for classified work, the Industry Security Notices and JSP 440 rules for handling classified information, List X facility security clearance for holding SECRET material on site, Baseline Personnel Security Standard and national security vetting for staff, and Def Stan 05-135 and related quality standards.

In writing, a supplier needs the completed Supplier Assurance Questionnaire and evidence for each Def Stan 05-138 control at its risk profile (Cyber Essentials or Cyber Essentials Plus is the baseline at the lower profiles, with governance, asset management, access, monitoring, incident response, and supply chain controls added as the profile rises), a cyber implementation plan for any gaps, flow-down records for subcontractors, incident reporting procedures that meet the MOD's notification requirements, and where classified work is involved the security aspects letter, facility security documentation, and personnel clearance records.