Check your readiness

Cyber Essentials for defence suppliers

Sector guide · mandated

Who asks defence suppliers for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.

Get a fixed-price quoteCheck your readiness
Updated 4 November 2026
Key facts
Mandated by
Ministry of Defence; Defence Cyber Certification (DCC); Prime contractors (flow-down)
Common fails
A6.4AUTO-FAILA2.2.2A7.6
Typical scope
Segregated project networks, Engineering workstations, Test rigs on unsupported systems
Cyber Essentials
From £1,500, 1 to 2 weeks, IASME fee included
Cyber Essentials Plus
From £3,000, 2 to 5 weeks
Short answer

Contracts carrying DEFCON 658 apply Def Stan 05-138 Issue 4, which requires Cyber Essentials at every cyber risk profile level (0 to 3) and Cyber Essentials Plus at Levels 2 and 3. Defence Cyber Certification, delivered with IASME, is accepted as evidence, and the MoD has asked all industry partners to reach DCC Level 0 by 31 December 2026.

Requirements

Do defence suppliers need Cyber Essentials?

Yes, where the work falls under one of these requirements. Ministry of Defence, Defence Cyber Certification (DCC) and Prime contractors (flow-down) require or expect Cyber Essentials; each source is listed below with the date it was checked.

  • Ministry of Defence

    Source checked

    DEFCON 658 and Def Stan 05-138 Issue 4 require suppliers to meet the controls for the contract's cyber risk profile level: Cyber Essentials (control 0001) at Levels 0 to 3, Cyber Essentials Plus (control 0002) at Levels 2 and 3, each covering the scope needed for all aspects of the contract (checked 3 November 2026).

    Source: MoD, Cyber Security Model and Def Stan 05-138 Issue 4

  • Defence Cyber Certification (DCC)

    Source checked

    Certifies suppliers against Def Stan 05-138 at Levels 0 to 3, delivered with IASME since May 2025. ISN 2026/02 (30 March 2026) tells buyers to accept DCC at a level equal to or greater than the contract's, and in May 2026 the MoD asked all industry partners to reach Level 0 by 31 December 2026 (checked 3 November 2026).

    Source: MoD, ISN 2026/02

  • Prime contractors (flow-down)

    Source checked

    DEFCON 658 contains the obligations suppliers must place on their subcontractors. The prime completes a risk assessment for each subcontract, which sets the subcontractor's level, and the subcontractor completes its own Supplier Assurance Questionnaire (checked 3 November 2026).

    Source: MoD, Cyber Security Model guidance: flow down

Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.

Level

Do defence suppliers need Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials at Levels 0 and 1; Cyber Essentials Plus as well at Levels 2 and 3. Under the March 2026 covering text to Def Stan 05-138 (ISN 2026/01), a supplier delivering contracts at different levels maintains certification at the highest one.

Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.

Preparation

What should defence suppliers gather before starting?

Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.

  • The Risk Assessment Reference and cyber risk profile level for each contract or subcontract, usually in the invitation to tender.
  • The legal entity named on the contract, so the certificate matches it (A1.1, A1.6).
  • A network diagram showing any segregated project network and how it is separated (A2.2.1, A2.2.2).
  • Engineering, CAD and test-rig machines with their operating systems and update arrangements (A6.4, A6.7).
  • The file-transfer or collaboration platforms used with the prime, with MFA status (A2.9, A7.17).
Scope

What scope problems do defence suppliers bring?

Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.

Segregated project networks

Defence work is often done on a separate network. A partial scope needs the segregation documented and may not satisfy a prime, since ISN 2026/01 applies Def Stan 05-138 to the business-critical operations of the whole legal entity.

A2.2.1A2.2.2

Engineering workstations

CAD and simulation machines held back from updates to protect licences or tool certification.

A6.4AUTO-FAILA6.4.2

Test rigs on unsupported systems

Bench equipment on old Windows must be in a sub-set with no internet access.

A6.7
Common failures

Which questions do defence suppliers commonly fail?

Questions defence suppliers commonly fail include A6.4AUTO-FAIL, A2.2.2 and A7.6. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.

QuestionWhy it failsFix
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Engineering workstations held back from updates are a common finding in the defence supply chain.Put them in their own update ring with a deadline inside 14 days, and test licence compatibility in advance.
A2.2.2Where one or more sub-sets have been created, please describe how this has been achieved.Sub-sets are declared but the segregation cannot be described.Document the firewall or VLAN that separates the sub-set in A2.2.2 and list the equipment used to create it in A2.5.1.
A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts.Engineers use admin accounts for daily work.Separate accounts, and use privilege elevation tooling for installs.
How assessors check this
Assessors read the notes fields for these questions first. A yes with no mechanism described is the answer most likely to come back for clarification.
FAQ

Frequently asked questions

The contract's cyber risk profile level decides it. Under Def Stan 05-138 Issue 4, Cyber Essentials is required at every level from 0 to 3, and Cyber Essentials Plus is also required at Levels 2 and 3. The full control set grows from 3 controls at Level 0 to 144 at Level 3. The MoD or your prime states the level, usually in the invitation to tender.

No. Every DCC level includes the Cyber Essentials control, and Levels 2 and 3 include Plus. ISN 2026/02 lets buyers accept a DCC certificate at or above the contract's level as evidence of the Def Stan 05-138 controls, and the MoD guidance says DCC holders still complete the Supplier Assurance Questionnaire.

It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.

Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.

Related pages

Sources
Certification with Precursor

Get certified at a fixed price

Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.

Get a fixed-price quoteCheck your readiness
  • IASME Certification Body
  • CREST accredited
  • UK offices in Leeds, Newcastle, London and Edinburgh