Quick answer
Def Stan 05-138 Issue 4 sets the minimum cyber controls for UK defence suppliers at four levels. Here is what it says, who it covers and how DCC assures it.
Defence Standard 05-138, often written Def Stan 05-138 or DEFSTAN 05-138, is the UK Ministry of Defence (MOD) standard that sets the minimum cyber security controls for organisations supplying defence. The current edition is Issue 4, published in May 2024. It replaced Issue 3. If a UK MOD contract or tender names it, usually through DEFCON 658, it applies to you and your subcontractors.
Last reviewed: 6 November 2026. Sources accessed: 6 November 2026. The scheme around this standard changes often, so check the sources at the end for newer notices.
What Def Stan 05-138 is
Issue 4 defines the Cyber Risk Profile (CRP) levels produced by the MOD’s Cyber Security Model (CSM), and the minimum controls a supplier needs at each level. Its revision note says it moves from five old profiles (N/A, Very Low, Low, Moderate and High) to four levels, Level 0 to Level 3, and introduces new control requirements at each one.
The standard is deliberately broad. Its scope is the supplier’s wider corporate or enterprise environment, not only the information handed over for one contract. It describes its requirements as a minimum, and an individual contract can ask for more, for example through a Security Aspects Letter. It also says it does not reduce or remove any other contractual or legal requirement.
Who it applies to
MOD Industry Security Notices say the standard applies to suppliers on contracts where the MOD is a contracting party, and to their subcontracts, where compliance with the standard is required. In practice a supplier meets it because a contract or tender names it, usually through DEFCON 658, the contract condition that flows the cyber requirement down the supply chain.
The four levels
The standard describes the four levels as follows. Control counts come from clause 2.2 of Issue 4.
| Level | Name | Controls | Assigned where assessed risk is | Cyber Essentials |
|---|---|---|---|---|
| Level 0 | Basic | 3 | very low | Cyber Essentials |
| Level 1 | Foundational | 101 | low to moderate | Cyber Essentials |
| Level 2 | Advanced | 139 | high | Cyber Essentials Plus |
| Level 3 | Expert | 144 | substantial | Cyber Essentials Plus |
Three points are easy to miss:
- Level 0 is small but specific. Its three controls are Cyber Essentials covering the contract scope, UK GDPR compliance, and resilient networks and systems.
- Cyber Essentials Plus starts at Level 2. Levels 0 and 1 need Cyber Essentials. Levels 2 and 3 need Cyber Essentials Plus. Our Cyber Essentials guide explains the difference.
- There is no one-to-one mapping from the old profiles. The MOD’s gov.uk guidance says the older CSM v3 profiles (N/A to High) are not consistent with Levels 0 to 3, so do not translate a legacy label into a level yourself.
What changed in Issue 4
Compared with Issue 3, the headline changes are the move from five profiles to four levels and new control requirements at each level. The link to certification comes later: ISN 2026/01 (30 March 2026) says compliance with Issue 4 is further assured through DCC, and it supplies interim replacement covering text that clarifies scope. That text says the requirements apply across the supplier as a single legal entity, to its business-critical operations, and that the level assigned through the CSM sets the minimum controls, not the supplier’s own internal risk assessment.
How Defence Cyber Certification fits
Defence Cyber Certification (DCC) is the certification scheme that assures compliance with this standard. DCC does not replace Def Stan 05-138. The standard still defines the controls, and a DCC certificate is independent evidence that a supplier meets them at a stated level.
ISN 2026/02 tells MOD buyers to treat a current, valid DCC certificate at the required level or higher as satisfying the Def Stan 05-138 control requirement under DEFCON 658. A higher level covers the lower ones, so Level 3 is accepted for Levels 0, 1 and 2. Certification applies only to the entity assessed, not automatically to a wider corporate group. Our Defence Cyber Certification guide covers the rest.
How the CSM assigns the level
The CSM assigns the level. A buyer runs a risk assessment, which produces a Risk Assessment Reference (RAR) and a level, and the supplier answers a Supplier Assurance Questionnaire (SAQ) against it. A supplier that cannot meet a requirement submits a Cyber Improvement Plan (CIP). How DCC evidence and the SAQ fit together is still unclear in public guidance; see DEFCON 658.
How an MSP or vCISO helps
- Confirm the level and the legal entity. Ask the client for the assigned level and RAR, and check which legal entity holds the contract.
- Scope business-critical operations. The scope is the supplier’s critical operations, not just the contract data.
- Baseline against the controls. A gap assessment against the level shows what is missing.
- Build the evidence. Each control needs a documented, implemented control with auditable evidence. See control mapping and the policies guide.
- Decide the route. A certification body assesses against the standard, and a CIP is the contractual route while gaps close.
Our guide to packaging services shows how a practice can turn work like this into a recurring offer.
Common mistakes
- Treating DCC as a replacement for the standard. DCC does not replace Def Stan 05-138 or DEFCON 658. It assures compliance with the standard.
- Using the old profile names. The five Issue 3 profiles do not map to the four Issue 4 levels.
- Assuming a level from self-assessment. The level comes from the CSM, not from the supplier’s own view of its risk.
- Reading the standard as contract-only. Its scope covers the wider organisation’s business-critical operations.
- Assuming one certificate covers a group. Certification applies to the assessed entity unless a group arrangement is approved.
- Quoting control counts from memory. Check clause 2.2 and Table 1 of the current issue.
Where GetCybr fits
GetCybr is a platform for MSPs and vCISOs to run assessments, risks, evidence and reporting for many clients. It does not currently include a built-in Def Stan 05-138 or DCC framework, so it does not generate this standard’s controls for you. The Custom frameworks capability lets a practice define its own control set and track owners and evidence against it. You can see how other frameworks are covered on the frameworks page, and read more practice-building guidance in our insights.
Sources
This guide paraphrases the standard and the MOD notices around it. The standard itself is Crown copyright, so read the source document before relying on any summary, including this one.
- UK Defence Standardization, Def Stan 05-138 Issue 4: Cyber security for defence suppliers, Crown copyright 2024. Source for the revision note, the supersession of Issue 3, clause 2.2 levels and control counts, and Table 1.
- Ministry of Defence, ISN 2026/01, 30 March 2026. Source for the scope clarification, the entity rule and the level-assignment rule.
- Ministry of Defence, ISN 2026/02, 30 March 2026. Source for DCC acceptance under DEFCON 658 and the higher-level rule.
- GOV.UK, Cyber Security Model guidance. Source for CSM version 4, the RAR, the CIP and the SAQ wording.
Need a deeper answer?
Book a demo to see how GetCybr handles frameworks, evidence, and client reporting in practice.