What is DEFCON 658, and what does it ask of MOD suppliers?

What is DEFCON 658?

DEFCON 658, short for Defence condition 658, lays out the contract terms for the MOD's Cyber Security Model.

Under the model, an MOD delivery team first assesses the risk of a contract. That assessment sets a Cyber Risk Profile.

The profile decides which controls a supplier must meet. Defence Standard 05-138, known as Def Stan 05-138, lists the controls for each profile, and suppliers are contractually required to meet them.

The clause itself has sections on the authority's obligations, the contractor's obligations, management of sub-contractors, records and audit.

Who does DEFCON 658 apply to?

DEFCON 658 applies to all suppliers down the supply chain, so a firm that makes parts for a prime can carry it too.

Each supplier is responsible for this flow down. DEFCON 658 holds the obligations that a supplier must place on its sub-contractors.

Def Stan 05-138 Issue 4 covers all MOD procurements, MOD suppliers and their subcontract suppliers.

What does a supplier have to do?

A supplier first needs its Cyber Risk Profile level. The MOD gives it at the earliest market engagement, and it is usually in the invitation to tender.

To bid, a supplier completes the Supplier Assurance Questionnaire on the MOD's Supplier Cyber Protection Service, and assesses itself against that level.

The service scores the questionnaire automatically and tells the supplier at once whether it complies.

A supplier that does not comply must complete a Cyber Improvement Plan. The plan becomes part of the contract.

The work comes round again. Each year, the supplier completes a new questionnaire on the anniversary of the contract award. It has a window of 1 month after that date.

What is Def Stan 05-138?

Def Stan 05-138 is the defence standard that sets the cyber controls a supplier must achieve at each Cyber Risk Profile level.

Version 4 of the Cyber Security Model brings four Cyber Risk Profiles, Level 0 to Level 3. It uses the controls in Def Stan 05-138 Issue 4.

GOV.UK first published Def Stan 05-138 Issue 4 on 23 May 2024, and last updated it on 3 December 2025.

What is Defence Cyber Certification?

Defence Cyber Certification, or DCC, is an organisation-wide cyber security certification. It gives assurance of a supplier's cyber resilience.

It comes in four levels, Levels 0 to 3, so a firm can certify at a level that suits its risk.

IASME's network of assured Certification Bodies delivers the scheme. A certificate needs an annual attestation and a full recertification every three years.

Any organisation can apply, at any level and at any time.

DCC requires the right level of Cyber Essentials, or Cyber Essentials Plus, for business critical systems.

Cyber Essentials is the minimum standard of cyber security that the UK Government recommends for organisations of all sizes. It is built on five technical controls against the most common internet based threats.

Cyber Essentials Plus goes further, with independent testing that the controls work in practice.

On 31 March 2026, the MOD added a new notice. Its title is 'Use of Defence Cyber Certification (DCC) as assurance of control requirements under DEFCON 658'.

GOV.UK also says that suppliers with a valid DCC certificate must still complete parts of the questionnaire on the Supplier Cyber Protection Service.

What has the MOD asked for by 31 December 2026?

Eleanor Fairford is the MOD's Director of Cyber Defence and Risk. She has asked all industry partners to achieve DCC Level 0 by 31 December 2026.

Level 0 includes Cyber Essentials for all applicable business-critical systems within scope.

The date is a request to industry partners. GOV.UK also says suppliers should expect DCC to be required more and more. Tenders will set it as a condition, for the length of an MOD contract.

Where a higher level is needed lower in the supply chain, the MOD wants it scheduled for after 31 December 2026.

Lockheed Martin received the first DCC Level 3 certification. James Shortle, its EMEA Information Security Officer, advises a sub-contractor to discuss with its prime which level to aim for. In his view, not every supplier will need Level 3, or indeed Level 2.

He also suggests using Level 0 to check how you read the controls, and gathering evidence early. Level 3 has over 300 requirements, and each needs several evidence examples.

What to do

1. Find the Cyber Risk Profile level for your contract. It is usually in the invitation to tender.
2. Complete the Supplier Assurance Questionnaire on the Supplier Cyber Protection Service.
3. If you do not meet the level, complete a Cyber Improvement Plan.
4. Place the same obligations on your sub-contractors.
5. Note the anniversary of the contract award date, because a new questionnaire is due each year.
6. Check that you hold Cyber Essentials, which DCC Level 0 includes.

Common questions

Is DCC Level 0 compulsory by 31 December 2026?

It is a request. The MOD has asked all industry partners to achieve DCC Level 0 by 31 December 2026. GOV.UK says suppliers should expect DCC to be set as a condition in tenders.

Does a DCC certificate replace the questionnaire?

Not yet. GOV.UK says that suppliers with a valid DCC certificate must still complete parts of the questionnaire.

What happens if we do not meet our Cyber Risk Profile level?

You complete a Cyber Improvement Plan, and the plan becomes part of the contract.

How often do we complete the questionnaire?

Each year, on the anniversary of the contract award date. There is a window of 1 month after that date.

Where next

• Seeking ISO 42001 certification
• How much is Cyber Essentials, and what does it ask?
• Cyber Essentials Plus: what does the technical test add?
• What is supplier assurance, and what do buyers check?
• Customer security questionnaires: what they ask and how to answer

This is an independent editorial guide, not legal advice.