# What is DEFCON 658, and what does it ask of MOD suppliers? If an MOD contract or subcontract carries DEFCON 658, your firm has cyber security steps to take, and they come round each year. The Assurance Desk. Published 27 October 2026. Last checked 27 October 2026. **The short answer.** DEFCON 658 sets the contract terms for the Cyber Security Model of the UK Ministry of Defence (MOD). It applies to all suppliers down the supply chain ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model) and [GOV.UK, Defence condition 658: cyber (flow-down)](https://www.gov.uk/government/publications/defence-condition-658-cyber-flow-down), checked 27 October 2026). ## What is DEFCON 658? DEFCON 658, short for Defence condition 658, lays out the contract terms for the MOD's Cyber Security Model ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). Under the model, an MOD delivery team first assesses the risk of a contract. That assessment sets a Cyber Risk Profile ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). The profile decides which controls a supplier must meet. Defence Standard 05-138, known as Def Stan 05-138, lists the controls for each profile, and suppliers are contractually required to meet them ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). The clause itself has sections on the authority's obligations, the contractor's obligations, management of sub-contractors, records and audit ([GOV.UK, Defence condition 658: cyber (flow-down)](https://www.gov.uk/government/publications/defence-condition-658-cyber-flow-down), checked 27 October 2026). ## Who does DEFCON 658 apply to? DEFCON 658 applies to all suppliers down the supply chain, so a firm that makes parts for a prime can carry it too ([GOV.UK, Defence condition 658: cyber (flow-down)](https://www.gov.uk/government/publications/defence-condition-658-cyber-flow-down), checked 27 October 2026). Each supplier is responsible for this flow down. DEFCON 658 holds the obligations that a supplier must place on its sub-contractors ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). Def Stan 05-138 Issue 4 covers all MOD procurements, MOD suppliers and their subcontract suppliers ([GOV.UK, Cyber security for defence suppliers (Def Stan 05-138, Issue 4)](https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4), checked 27 October 2026). ## What does a supplier have to do? A supplier first needs its Cyber Risk Profile level. The MOD gives it at the earliest market engagement, and it is usually in the invitation to tender ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). To bid, a supplier completes the Supplier Assurance Questionnaire on the MOD's Supplier Cyber Protection Service, and assesses itself against that level ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). The service scores the questionnaire automatically and tells the supplier at once whether it complies ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). A supplier that does not comply must complete a Cyber Improvement Plan. The plan becomes part of the contract ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). The work comes round again. Each year, the supplier completes a new questionnaire on the anniversary of the contract award. It has a window of 1 month after that date ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). **The DEFCON 658 steps for a supplier** 1. Find your level: The required Cyber Risk Profile level is usually in the invitation to tender. 2. Answer the questionnaire: Complete the Supplier Assurance Questionnaire on the Supplier Cyber Protection Service. 3. Get your result: The service scores the answers and says at once whether you comply. 4. Plan any gaps: If you do not comply, complete a Cyber Improvement Plan. It becomes part of the contract. 5. Flow it down: Place the same obligations on your sub-contractors. 6. Repeat each year: Complete a new questionnaire on the anniversary of the contract award, within a window of 1 month. What a supplier does under the Cyber Security Model, from the tender to the yearly check. Source: GOV.UK, Cyber Security Model, https://www.gov.uk/guidance/cyber-security-model (checked 27 October 2026) ## What is Def Stan 05-138? Def Stan 05-138 is the defence standard that sets the cyber controls a supplier must achieve at each Cyber Risk Profile level ([GOV.UK, Cyber security for defence suppliers (Def Stan 05-138, Issue 4)](https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4), checked 27 October 2026). Version 4 of the Cyber Security Model brings four Cyber Risk Profiles, Level 0 to Level 3. It uses the controls in Def Stan 05-138 Issue 4 ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). GOV.UK first published Def Stan 05-138 Issue 4 on 23 May 2024, and last updated it on 3 December 2025 ([GOV.UK, Cyber security for defence suppliers (Def Stan 05-138, Issue 4)](https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4), checked 27 October 2026). ## What is Defence Cyber Certification? Defence Cyber Certification, or DCC, is an organisation-wide cyber security certification. It gives assurance of a supplier's cyber resilience ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). It comes in four levels, Levels 0 to 3, so a firm can certify at a level that suits its risk ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). IASME's network of assured Certification Bodies delivers the scheme. A certificate needs an annual attestation and a full recertification every three years ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). Any organisation can apply, at any level and at any time ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). DCC requires the right level of Cyber Essentials, or Cyber Essentials Plus, for business critical systems ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). Cyber Essentials is the minimum standard of cyber security that the UK Government recommends for organisations of all sizes. It is built on five technical controls against the most common internet based threats ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 27 October 2026). Cyber Essentials Plus goes further, with independent testing that the controls work in practice ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 27 October 2026). On 31 March 2026, the MOD added a new notice. Its title is 'Use of Defence Cyber Certification (DCC) as assurance of control requirements under DEFCON 658' ([GOV.UK, Industry Security Notice (ISN)](https://www.gov.uk/government/publications/industry-security-notices-isns), checked 27 October 2026). GOV.UK also says that suppliers with a valid DCC certificate must still complete parts of the questionnaire on the Supplier Cyber Protection Service ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). ## What has the MOD asked for by 31 December 2026? Eleanor Fairford is the MOD's Director of Cyber Defence and Risk. She has asked all industry partners to achieve DCC Level 0 by 31 December 2026 ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). Level 0 includes Cyber Essentials for all applicable business-critical systems within scope ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). The date is a request to industry partners. GOV.UK also says suppliers should expect DCC to be required more and more. Tenders will set it as a condition, for the length of an MOD contract ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). Where a higher level is needed lower in the supply chain, the MOD wants it scheduled for after 31 December 2026 ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). Lockheed Martin received the first DCC Level 3 certification. James Shortle, its EMEA Information Security Officer, advises a sub-contractor to discuss with its prime which level to aim for. In his view, not every supplier will need Level 3, or indeed Level 2 ([defencedigital.blog.gov.uk, Building cyber resilience in the UK one step at a time, Digital and Data](https://defencedigital.blog.gov.uk/2026/07/13/building-cyber-resilience-in-the-uk-one-step-at-a-time/), checked 27 October 2026). He also suggests using Level 0 to check how you read the controls, and gathering evidence early. Level 3 has over 300 requirements, and each needs several evidence examples ([defencedigital.blog.gov.uk, Building cyber resilience in the UK one step at a time, Digital and Data](https://defencedigital.blog.gov.uk/2026/07/13/building-cyber-resilience-in-the-uk-one-step-at-a-time/), checked 27 October 2026). **DEFCON 658 and DCC: the key dates** - 23 May 2024, UK: GOV.UK first publishes Def Stan 05-138 Issue 4. - 27 November 2025, UK: The MOD adds its notice on putting version 4 of the Cyber Security Model in place. - 31 March 2026, UK: The MOD adds its notice on using DCC as assurance under DEFCON 658. - 31 December 2026, UK: The date by which the MOD has asked industry partners to achieve DCC Level 0. Dates from GOV.UK and the MOD's Digital and Data blog. The last date is a request to industry partners, not a date in the clause itself. Source: GOV.UK, Cyber security for defence suppliers (Def Stan 05-138, Issue 4), https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4 (checked 27 October 2026); GOV.UK, Industry Security Notice (ISN), https://www.gov.uk/government/publications/industry-security-notices-isns (checked 27 October 2026); defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data, https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/ (checked 27 October 2026) ## What to do 1. Find the Cyber Risk Profile level for your contract. It is usually in the invitation to tender ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). 2. Complete the Supplier Assurance Questionnaire on the Supplier Cyber Protection Service ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). 3. If you do not meet the level, complete a Cyber Improvement Plan ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). 4. Place the same obligations on your sub-contractors ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). 5. Note the anniversary of the contract award date, because a new questionnaire is due each year ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). 6. Check that you hold Cyber Essentials, which DCC Level 0 includes ([defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). ## Common questions ### Is DCC Level 0 compulsory by 31 December 2026? It is a request. The MOD has asked all industry partners to achieve DCC Level 0 by 31 December 2026. GOV.UK says suppliers should expect DCC to be set as a condition in tenders ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model) and [defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data](https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/), checked 27 October 2026). ### Does a DCC certificate replace the questionnaire? Not yet. GOV.UK says that suppliers with a valid DCC certificate must still complete parts of the questionnaire ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). ### What happens if we do not meet our Cyber Risk Profile level? You complete a Cyber Improvement Plan, and the plan becomes part of the contract ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). ### How often do we complete the questionnaire? Each year, on the anniversary of the contract award date. There is a window of 1 month after that date ([GOV.UK, Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model), checked 27 October 2026). ## Where next - [Seeking ISO 42001 certification](https://theassurancedesk.com/best/certification-seeking.md) - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md) - [Cyber Essentials Plus: what does the technical test add?](https://theassurancedesk.com/guides/cyber-essentials-plus-technical-test.md) - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md) - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md) ## Sources - GOV.UK, Cyber Security Model: https://www.gov.uk/guidance/cyber-security-model (checked 27 October 2026) - GOV.UK, Defence condition 658: cyber (flow-down): https://www.gov.uk/government/publications/defence-condition-658-cyber-flow-down (checked 27 October 2026) - GOV.UK, Cyber security for defence suppliers (Def Stan 05-138, Issue 4): https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4 (checked 27 October 2026) - defencedigital.blog.gov.uk, One Year of Defence Cyber Certification: Building Stronger Cyber Resilience Together, Digital and Data: https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/ (checked 27 October 2026) - NCSC, Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/overview (checked 27 October 2026) - GOV.UK, Industry Security Notice (ISN): https://www.gov.uk/government/publications/industry-security-notices-isns (checked 27 October 2026) - defencedigital.blog.gov.uk, Building cyber resilience in the UK one step at a time, Digital and Data: https://defencedigital.blog.gov.uk/2026/07/13/building-cyber-resilience-in-the-uk-one-step-at-a-time/ (checked 27 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.