The MOD’s new Cyber Security Model: a shift to operational resilience

The Ministry of Defence’s new Cyber Security Model version 4, or CSMv4, represents a significant change in the way cyber security obligations will apply to MOD suppliers and their supply chains. The previous model was largely focused on protecting MOD data. The new model is much broader. It is designed to ensure that suppliers providing business critical functions to UK defence are resilient enough to continue supplying the MOD in the event of a cyber attack.

For many suppliers, this will mean more than updating IT controls. CSMv4 will require organisations to assess which parts of their business are critical to MOD delivery, obtain appropriate Defence Cyber Certification, flow obligations down to sub-contractors, and take board-level ownership of cyber resilience. The new approach will affect bidding, pricing, contract management and supply chain governance.

From protecting MOD data to organisational resilience

The key change under CSMv4 is the move away from a narrow focus on protecting MOD information. Under the previous CSMv3 regime, suppliers could potentially achieve compliance by placing appropriate controls around systems and teams handling MOD Identifiable Information. That approach did not necessarily address the wider risk that a supplier could be unable to perform its contract because another critical part of its organisation had been disrupted by a cyber incident.

CSMv4 is intended to close that gap. It focuses on the resilience of "business-critical operations which are essential to the sustained operation of the contractor". That phrase is central to understanding the new regime. It means that suppliers will need to look beyond the team directly manufacturing, developing or delivering goods or services to the MOD. Depending on the circumstances, relevant functions could include finance, HR, logistics, facilities, property management, procurement, customer support or any other function that is critical to continued delivery.

This makes CSMv4 an organisation-wide resilience issue, not simply an IT compliance project. Suppliers will need to understand how their businesses operate in practice, identify dependencies, assess cyber risk across those dependencies, and be able to evidence that appropriate controls are in place.

It is also important to distinguish CSMv4 from Security by Design. CSMv4 is concerned with the supplier’s own security and resilience. Security by Design is a separate MOD approach concerned with the security of products, equipment and systems supplied to the MOD. Suppliers may need to consider both, but they address different risks and should not be treated as interchangeable.

The contractual framework: DEFCON 658 and DefStan 05-138

The new contractual mechanism is DEFCON 658 Edition 07/26, which is expected to be incorporated into nearly all new MOD contracts, as well as amended and renewed MOD contracts. It requires suppliers to implement "appropriate technical and operational security measures" and also meet the specific security requirements set out in Defence Standard 05-138. Suppliers can prove their compliance with these obligations by obtaining a Defence Cyber Certification, or DCC.

Prime contractors must conduct risk-assessments on every sub-contractor and in most circumstances will need to flow DEFCON 658 obligations down their supply chains. There is a limited exception that allows a contractor not to flow down the obligations where the sub-contractor cannot agree to the obligations (e.g. because it is subject to conflicting regimes such as ITAR) or where the sub-contractor poses no or low cyber risk. Where the obligations are not flowed down, the prime contractor must document its reasons for that decision.

The new contractual regime is not expected to be applied retrospectively to existing MOD contracts. However, suppliers should not assume that existing arrangements will be unaffected. For higher risk contracts, the MOD may seek to introduce the new requirements through a contract amendment.

Defence Cyber Certification

A major development under CSMv4 is the introduction of Defence Cyber Certification. A DCC is an independently audited certificate confirming that a supplier meets the applicable requirements of DefStan 05-138. Previously, suppliers could contractually commit to meeting the MOD’s cyber standards without necessarily obtaining upfront third-party verification that the relevant controls were operating effectively. In practice, this could leave a gap between contractual obligation and actual implementation, with compliance only being tested periodically through MOD audit activity.

Under the new model, a supplier can engage an accredited body to conduct an audit and, if the DefStan 05-138 requirements are met, can then be awarded a DCC. A DCC will be valid for three years, subject to an annual self-attestation that the relevant security controls remain in place and that there have been no significant changes.

Strictly speaking, DEFCON 658 does not require a supplier to obtain a DCC but a DCC is the only evidence the MOD will accept that the requirements of DefStan 05-138 have been met. The MOD is not required to accept other accreditations (ISO:27001; SOC) as evidence of compliance. This makes obtaining a DCC virtually mandatory, and supplying the MOD without a DCC would be a major commercial risk and also likely undermine any bid for a new contract.

As DEFCON 658 will be flowed down to most sub-contractors then those sub-contractors will also need to obtain a DCC save in exceptional circumstances. This could be particularly arduous for smaller vendors.

Where a supplier or sub-contractor cannot currently meet the applicable DefStan 05-138 requirements (and therefore cannot get a DCC), it may agree a Cyber Improvement Plan with the MOD. A CIP is a contractually binding plan setting out how the supplier will improve its cyber security to the point where it can obtain the required DCC. This gives suppliers a route to continue supplying the MOD while they work towards compliance, provided they deliver the agreed improvements within the required timeframe. This route has been included as the MOD recognises it will take time for suppliers to adapt to the new rules. 

DefStan 05-138: Technical controls and cyber risk levels

The technical security controls under CSMv4 are set out in DefStan 05-138. The applicable controls depend on the sensitivity and importance of the goods and services being supplied. There are four levels: Level 0, Level 1, Level 2 and Level 3. At one end of the spectrum, a low-risk supplier (e.g. ordinary cleaning products) may fall within Level 0. At the other end, highly sensitive or critical supply, such as nuclear-related material or systems, will fall within Level 3.

Level 0 primarily requires Cyber Essentials certification and compliance with the GDPR, which most organisations should be able to readily achieve. Levels 1 to 3 layer on additional controls, with the most demanding level involving an extensive set of up to 148 controls needing to be met. Some of those controls are much more prescriptive than what are found in ISO:27001 or similar security frameworks.

The MOD will specify the required DCC level in its requests for proposals and then state that level in its contracts. Suppliers will be able to bid for opportunities above their current DCC level, but they should expect to include a proposed Cyber Improvement Plan explaining how they will reach the required level if successful.

Scoping the breadth of these obligations and the applicable DCC level will be commercially important. CSMv4 potentially applies to a wide range of business critical functions involved in supporting UK defence. Suppliers will therefore need to identify which parts of their organisation and supply chain are genuinely in scope and which can properly be de-scoped. For example, subsidiaries or departments that are not involved in manufacturing or delivering goods or services to the MOD may, depending on the facts, fall outside scope. Also, it may be that a prime contractor has high DCC level, but some of its sub-contractors supplying lower risk components may only need a lower DCC level. These scoping decisions will materially affect the cost and complexity of compliance.

Commercial implications for suppliers

The cost of compliance, including the cost of obtaining and maintaining a DCC, will sit with suppliers. Some suppliers may absorb that cost. Others may seek to build it into contract pricing, particularly where compliance requires material changes to systems, processes or supply chain management. Suppliers operating across multiple MOD contracts may be able to spread the cost more easily than those with a smaller MOD footprint.

Existing certifications such as ISO:27001, Cyber Essentials Plus, and SOC reports are likely to overlap with DefStan 05-138 and the DCC process. However, they are not a substitute for a DCC and so careful planning will be needed to avoid duplicative effort in obtaining parallel certifications. As explained above, it is unlikely that the MOD will accept alternative accreditations in place of DCC certification for prime contractors or higher-risk suppliers. Alternative accreditations may however be relevant in exceptional cases for minor, low-risk sub-contractors as justification for not flowing down DEFCON 658 obligations or requiring a sub-contractor to obtain a DCC.

For Level 3 suppliers, there is an additional point to factor into contract pricing and incident response planning. They will be required under DEFCON 658 to engage an NCSC accredited cyber incident response company in the event of a cyber incident, and to pay for that support. This should be considered at the bid stage, not only after an incident occurs.

The comparison with the US Cybersecurity Maturity Model Certification regime is also relevant for international defence suppliers. CSMv4 can be seen as the UK equivalent of the US Cybersecurity Maturity Model Certification in that both regimes seek to raise cyber standards across defence supply chains. The two regimes are broadly aligned in policy terms, although US standards continue to evolve. Suppliers operating in both UK and US defence markets should consider whether they can build a single compliance programme that addresses both regimes as far as possible, while recognising that certification requirements will remain distinct.

Practical steps suppliers should take now

1. Brief senior management.

CSMv4 is not just an IT issue. It requires organisation-wide resilience planning, budget allocation, training, and incident response preparation. Boards and senior management should be briefed on the changes and, if not already in place, establish a governance structure that has senior oversight of cyber security decisions across the organisation.

2. Map business critical functions supporting MOD delivery.

Identify which parts of the organisation are critical to supplying the MOD. This should include operational teams, but also supporting functions such as finance, HR, logistics, facilities, procurement and key technology platforms. Clear scoping will be essential to controlling cost and avoiding over-compliance, as well as ensuring that smaller but vital parts of an organisation are not missed.

3. Assess current maturity against DefStan 05-138.
Undertake a gap analysis against the likely applicable DCC level. Existing certifications such as ISO 27001, Cyber Essentials or SOC reports may help, but they should be mapped specifically against the DefStan 05-138 requirements. Where there are gaps, draw up a remediation roadmap with realistic but clear timelines that could feed into a Cyber Improvement Plan.

4. Prepare for Defence Cyber Certification.
Identify the DCC level likely to apply to existing and future MOD opportunities, understand the audit process, start to gather evidence of compliance, and build certification timelines into bid planning. Where appropriate, it might be useful to engage a specialist security consultant to help with this process.

5. Review supply chain contracting and governance.
Prime contractors should put in place a process to risk assess every sub-contractor, determine which obligations need to be flowed down, document any exceptional decisions not to flow down, and update sub-contract terms to reflect DEFCON 658 requirements.

6. Assess the financial costs and build new commercial models
Assess the financial cost of any security upgrades and ongoing compliance. Use that data to update commercial pricing models and determine a pricing strategy for if, and how, to build those costs into future bids and proposals.