Skip to main content
Compliance 101

What is DEFCON 658?

A plain-English guide to DEFCON 658, the UK MOD cyber flow-down condition: what it does, the public 2017/2022 edition, and how DCC evidences compliance.

Quick answer

DEFCON 658 is the MOD contract condition that flows cyber requirements down the supply chain. Here is the edition caveat, the recent notices and how DCC fits.

DEFCON 658 (Defence Condition 658, published on GOV.UK as “Defence condition 658: cyber (flow-down)”) is the standard contract condition the UK Ministry of Defence (MOD) uses to put cyber security requirements on suppliers and push them down the supply chain. If a UK defence contract or subcontract contains it, the supplier is expected to meet the cyber requirement the MOD sets for that contract. This guide explains the condition in plain English and what the MOD has said about it recently. Contract wording varies, so always read the condition in your own contract.

Last reviewed: 6 November 2026. Sources accessed: 6 November 2026. Notices on this topic changed several times in the last year, so check the sources at the end.

What DEFCON 658 does

The public GOV.UK page describes the condition as applying to suppliers down the supply chain. Its published outline covers definitions, the obligations of the Authority and the contractor, management of subcontractors, records and audit, and general provisions. In practice the condition works with the Def Stan 05-138 standard and the Cyber Security Model (CSM): the MOD assigns a Cyber Risk Profile level and a Risk Assessment Reference (RAR) for the work, and the supplier must meet the controls for that level.

Flow-down is the part that surprises smaller firms. GOV.UK guidance says suppliers are responsible for flow-down, and for an existing contract, a supplier needs a new CSM version 4 level and RAR from its customer before it starts flowing requirements down. In the CSM flow-down example, the prime passes the RAR to the subcontractor, who completes the Supplier Assurance Questionnaire (SAQ) against the assigned level.

The public text requires the contractor to comply with Def Stan 05-138 or, where applicable, an agreed improvement plan, and to repeat the SAQ at least once a year.

The edition caveat

The public GOV.UK copy of DEFCON 658 is labelled “Edition 10/17 12/22”. It was first published in October 2017 and last updated in December 2022. That is the 2017/2022 edition. It is not necessarily the wording in a recent contract.

ISN 2026/01, issued on 30 March 2026, refers to an update to the related DEFCON 658. We could not find an updated edition on GOV.UK, so that update is not publicly visible. Do not assume it matches the public text, and ask the buyer which edition your contract uses. Note that this guide cannot describe the content of an update it cannot see.

What recent notices changed

Three Industry Security Notices matter. Each is short and worth reading in full.

  • ISN 2025/07 (26 November 2025). It reinstated the Cyber Security Model process in support of DEFCON 658 and withdrew the interim arrangements. From 00:01 GMT on 3 December 2025, new risk assessments and the Supplier Assurance Questionnaires (SAQs) issued for them must use the GOV.UK tooling. It also reinstated the annual SAQ review for existing contracts, on the contract anniversary.
  • ISN 2026/01 (30 March 2026). It gives interim covering text for Def Stan 05-138 Issue 4 and clarifies scope. The standard applies across the supplier as one legal entity, to its business-critical operations.
  • ISN 2026/02 (30 March 2026). It covers the use of Defence Cyber Certification (DCC) as assurance under DEFCON 658.

Be careful with the numbers. ISN 2026/01 is the scope clarification and ISN 2026/02 is the DCC acceptance notice, and they are often swapped.

How DCC evidences the requirement

DCC is the certification scheme for Def Stan 05-138 Issue 4. DCC does not replace DEFCON 658. The condition is still the contractual route. What DCC changes is how a supplier can show it has met the control requirement.

ISN 2026/02 says a supplier holding and maintaining a current, valid DCC certificate at the required level or higher may submit it as evidence, and buyers are told to treat it as satisfying the Def Stan 05-138 control requirement under DEFCON 658. A certificate at a higher level covers the lower ones. The notice applies to MOD contracts and subcontracts where compliance with Def Stan 05-138 is required. Our Defence Cyber Certification guide explains levels and how assessment works.

An open question on the SAQ

The picture is not fully settled. GOV.UK’s Cyber Security Model page said, when last updated in March 2026, that suppliers with a valid DCC certificate are not yet exempt from completing elements of the SAQ. ISN 2026/02, issued later that month, tells buyers to accept DCC for the control requirement. Public guidance does not say how these fit for a certificate holder. Treat it as an open question, and ask the buyer or the MOD’s Directorate of Cyber Defence and Risk, then keep the answer on file.

How an MSP or vCISO helps

  1. Find the contract wording. Ask which edition of the condition applies and which level and RAR the contract assigns.
  2. Map the chain. List subcontractors and check what flows down to each, and who holds the level and RAR.
  3. Diarise the SAQ. Put the annual review on the contract anniversary into the calendar.
  4. Prepare evidence. A gap assessment against the assigned level shows what to fix first.
  5. Choose the assurance route. Either answer the questionnaire, or pursue DCC at the level needed, and agree it with the buyer.

For help packaging this work as a recurring service, see our guide to launching a vCISO service.

Common mistakes

  • Assuming the public text is the current contract text. The public copy is the 2017/2022 edition, and a later update exists that is not publicly visible.
  • Swapping the notice numbers. ISN 2026/01 clarifies scope. ISN 2026/02 covers DCC.
  • Treating DCC as a replacement. DCC does not replace DEFCON 658, the Cyber Security Model or the SAQ process.
  • Forgetting the anniversary review. The annual SAQ review was reinstated by ISN 2025/07.
  • Starting flow-down too early. On an existing contract, the supplier needs its CSMv4 level and RAR from the customer first.

Where GetCybr fits

GetCybr is a platform for MSPs and vCISOs to run assessments, risks, evidence and reporting for many clients. It does not currently provide a DEFCON 658, Def Stan 05-138 or DCC framework. Its Custom frameworks capability lets a practice define its own control set and track owners and evidence against it, and you can see how other frameworks are covered on the frameworks page. More practice-building guidance is in our insights.

Sources

Need a deeper answer?

Book a demo to see how GetCybr handles frameworks, evidence, and client reporting in practice.

Book a DemoBecome a Partner