Cyber Essentials for MOD and defence suppliers

Do MOD suppliers need Cyber Essentials?

Yes, on any contract carrying DEFCON 658. Def Stan 05-138 Issue 4 requires Cyber Essentials at every cyber risk profile level from 0 to 3, and Cyber Essentials Plus at Levels 2 and 3.

The Ministry of Defence treats its supply chain as part of its attack surface. Suppliers hold design data, logistics information, personnel details and contract terms that an adversary would value. Cyber Essentials gives the MOD a verifiable baseline: five technical controls, a fixed standard and a certificate on a public register that a contracting officer can check.

The MOD's supply chain cyber requirements sit in the Cyber Security Model. The contract condition DEFCON 658 sets the contractual terms, an MOD risk assessment assigns each contract a cyber risk profile level, and Def Stan 05-138 Issue 4 (14 May 2024) lists the controls for each level. From 3 December 2025, new risk assessments use Cyber Security Model version 4 under ISN 2025/07, and the MOD's guidance says existing and new procurements should now use it. Version 4 replaced the older profiles (very low, low, moderate and high), and the standard no longer refers to MOD identifiable information: the focus is now the supplier's organisational security and resilience.

Checked against the MOD Cyber Security Model guidance (last updated 6 March 2026), Def Stan 05-138 Issue 4 and ISNs 2025/07, 2026/01 and 2026/02 on 3 November 2026.

What is the risk profile and how does it change what you need?

The MOD delivery team completes a risk assessment for each new or existing activity, which produces a Risk Assessment Reference and a cyber risk profile level, usually stated in the invitation to tender. Def Stan 05-138 Issue 4 sets the controls for each level:

To bid, the supplier completes a Supplier Assurance Questionnaire through the MOD's Supplier Cyber Protection Service, which scores it against the level. A supplier that falls short submits a Cyber Improvement Plan with its tender, and the agreed plan becomes part of the contract. Every year on the contract's anniversary the supplier completes a new questionnaire.

The practical effect for a supplier is that the same five technical controls underpin every level. Getting Cyber Essentials in place, and being able to pass the Plus audit, is the foundation for whatever else the level asks for.

Do defence suppliers need Cyber Essentials or Cyber Essentials Plus?

The cyber risk profile level decides it: Cyber Essentials at Levels 0 and 1, Cyber Essentials Plus at Levels 2 and 3. Where a supplier delivers several contracts at different levels, the March 2026 clarification of Def Stan 05-138 says it should hold the highest level required. IASME requires the Plus audit within three months of the Cyber Essentials certification, on the same scope, so plan both together.

Where does Defence Cyber Certification fit?

Defence Cyber Certification (DCC) is the MOD's certification scheme against Def Stan 05-138, delivered through IASME's Certification Bodies since May 2025, with annual attestation and full recertification every three years. ISN 2026/02 (30 March 2026) tells buyers to accept a current DCC certificate at or above the contract's level as meeting the Def Stan 05-138 controls under DEFCON 658. Every DCC level builds on Cyber Essentials, with Plus at Levels 2 and 3.

In May 2026 the MOD's Director of Cyber Defence and Risk asked all industry partners to achieve DCC Level 0 by 31 December 2026, which includes Cyber Essentials for all applicable business-critical systems in scope. The MOD's guidance still says a DCC certificate does not yet exempt suppliers from completing the full Supplier Assurance Questionnaire.

What scope does the MOD expect?

Def Stan 05-138 Issue 4 applies to the supplier's overarching corporate or enterprise environment, not only the systems that hold contract information. The interim covering text published with ISN 2026/01 describes the requirements as whole of organisation, applied to business-critical operations across the supplier as a single legal entity. The Cyber Essentials control itself requires a certificate covering the scope needed for all aspects of the contract.

Question A2.1 asks whether the assessment covers the whole organisation or a part of it. For defence work, whole-organisation scope is the safe answer. If you certify a sub-set, the boundary must be defined by business unit, network and location, it must be technically segregated by a firewall or VLAN, and the Plus assessor will verify the segregation before testing begins. A sub-set that excludes the people delivering the MOD contract will not satisfy the prime.

How do primes and the MOD verify?

Through the Supplier Assurance Questionnaire in the Supplier Cyber Protection Service, which is scored against the contract's level, and through the IASME certificate register, which shows the certificate's scope, level and expiry. Make sure the legal entity on the certificate matches the entity contracting with the prime. Group structures with multiple legal entities can list them in A1.6 and A1.6.1 so that one Cyber Essentials certificate covers the group.

What should a defence supplier prepare?

The Supplier Assurance Questionnaire is completed again every year on the anniversary of contract award, so keep the Cyber Essentials renewal date ahead of that anniversary.

How long does it take and what does it cost?

With Precursor, Cyber Essentials takes one to two weeks and is from £1,500 + VAT with the IASME fee included. Plus takes two to five weeks depending on device count and is from £3,000 + VAT with Cyber Essentials included. Budget more time than that for remediation on any estate with legacy engineering systems, because moving them into a segregated sub-set or replacing them is the slow part, not the assessment.