Def Stan 05-138
Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk. It is applied through the contract condition DEFCON 658, which flows down to subcontractors. Issue 4 requires Cyber Essentials at every cyber risk profile level from 0 to 3, and Cyber Essentials Plus at Levels 2 and 3.
- Term
- Def Stan 05-138
- Also known as
- Defence Standard 05-138, DEFCON 658, Cyber Security for Defence Suppliers
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term Def Stan 05-138 mean in Cyber Essentials?
Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk.
How does Def Stan 05-138 apply to Cyber Essentials?
In plain terms
It is the MOD's rulebook for suppliers' security. Each contract is given a cyber risk profile level from 0 to 3, and the higher the level, the more the supplier has to show: 3 controls at Level 0, rising to 144 at Level 3. Cyber Essentials is the first control at every level.
How it relates to Cyber Essentials
The MOD's Cyber Security Model puts its supply chain requirements in a contract condition, DEFCON 658, and this defence standard. Issue 4, dated 14 May 2024, replaced the old very low to high profiles with Levels 0 to 3. Control 0001 requires Cyber Essentials at all four levels and control 0002 requires Cyber Essentials Plus at Levels 2 and 3, each covering the scope needed for all aspects of the contract. Defence Cyber Certification, delivered by IASME, certifies suppliers against the same levels, and ISN 2026/02 tells buyers to accept it as evidence. Suppliers set a level for each subcontract under DEFCON 658, so a small subcontractor can be asked for Cyber Essentials without ever dealing with the MOD directly.
At A1.10 you can select "required for government contract" as a reason for applying, and A1.10.2 then asks for the contracting organisation and contract number. Neither the NCSC requirements nor the question set name Def Stan 05-138.
Common mistakes
Assuming Cyber Essentials alone satisfies every defence contract. At Level 0 it is one of three controls and at Level 3 one of 144, so the cyber risk profile level in your invitation to tender decides what else you need. Control counts and controls 0001 and 0002 re-checked against the Def Stan 05-138 Issue 4 PDF on 3 November 2026.
See Cyber Essentials for MOD and defence suppliers, PPN 014 and Cyber Essentials Plus.
Related terms
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- DSPT (Data Security and Protection Toolkit)The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
- EvidenceEvidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.
- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
Frequently asked questions
Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk.
In the 2026 Danzell question set, Def Stan 05-138 comes up at A1.10, A1.10.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.