What is Defence Standard 05-138 and which controls does it require?

Defence Standard 05-138 (DefStan 05-138) is the MOD's standard defining the cyber security controls that defence suppliers must implement. Issue 4, which underpins Cyber Security Model v4, sets out four tiers of controls corresponding to the four Cyber Risk Profiles: Cyber Essentials plus basic resilience at Level 0, rising to 101 controls at Level 1, 139 at Level 2, and 144 at Level 3. There are 148 controls in total, but no single level contains all of them, because some are replaced by more comprehensive controls higher up.

If CSM v4 is the framework that decides how much assurance your contract needs, DefStan 05-138 is the document that tells you what to actually build.

How the levels break down

Level 0 (Basic). For very low risk contracts. Three controls: Cyber Essentials, UK GDPR compliance (documented policies and Data Protection Impact Assessments), and resilient networks and systems (assessing how resilient you need to be, then building it in). No long control list; this level is deliberately achievable for small suppliers, but all three controls must be fully met.

Level 1 (Foundational). 101 controls. This is where a real security programme starts: alongside technical controls such as network monitoring, you need policy and governance controls covering risk management, roles and responsibilities, and organisational process.

Level 2 (Advanced). 139 controls, and Cyber Essentials Plus becomes the prerequisite rather than standard Cyber Essentials. Expect more demanding requirements across planning, oversight, and technical assurance.

Level 3 (Expert). 144 controls for the most critical contracted outputs, requiring a full defence-in-depth approach. Level 3 is currently assessed only through a combined Level 2 and 3 assessment of 145 controls: hit the Level 3 pass mark and you certify at Level 3; hit only the Level 2 mark and you certify at Level 2.

The pass marks differ by level. Levels 0 and 3 require every control to be fully met. Levels 1 and 2 require at least 80% of the available points in each objective, with no control scoring zero.

What kind of controls are they?

The standard deliberately covers the whole organisation, not just IT. Controls span technical measures (monitoring, hardening, access management), governance (risk management, policy, accountability), and operational resilience. Cyber Essentials forms the core at every level, which is why holding a valid CE certificate is the universal starting point.

The important cultural point in Issue 4 is evidence. Assessors want proof that controls operate day to day, not a policy library written the week before assessment. A monitoring control means logs someone actually reviews. A risk management control means a register that gets updated when the business changes.

The standard was finalised in May 2024, so some of its examples have dated. IASME's guidance is explicit that the examples are not the requirement: assessors judge whether you meet the intent of each control, and following current NCSC and NPSA good practice will often meet or exceed it. You are not expected to weaken your security to answer a question written for older technology. If you use passkeys, you do not roll back to passwords to satisfy a password question, and you do not install a VPN you have no business need for.

How do I know which level applies to me?

You do not choose it; the contract does. The MOD assigns a Cyber Risk Profile to each contract and communicates it in the invitation to tender. If you are a subcontractor, your prime contractor conducts the risk assessment and flows the requirement down to you.

Most SMEs entering the supply chain will encounter Level 0 or Level 1 first.

How does DefStan 05-138 relate to DCC?

Directly. Defence Cyber Certification, administered by IASME, certifies against the DefStan 05-138 controls at the corresponding level. The controls are identical; DCC is simply the independent evidence that you meet them.

Achieve the controls once, certify once, and the certificate covers all your contracts at that level for three years with annual attestation.

Where do most suppliers get stuck?

Two places.

First, underestimating the jump from Level 0 to Level 1. Going from three requirements to 101 controls is a step change that needs a programme, not a weekend.

Second, treating the standard as a paperwork exercise. The gap between documented and lived controls is precisely what independent assessment is designed to find. Since October 2026 assessors can move any control score up or down by a point using professional judgement, and the Applicant Guide's own example of marking down is a policy that exists but is not followed.

What changed in the October 2026 Applicant Guide?

IASME published version 2.2 of the DCC Applicant Guide in October 2026. No controls or questions were added or removed, and four questions were reworded. Most of the change is new guidance on how to meet controls, and much of it is helpful: Zero Trust and Conditional Access accepted as a modern alternative to traditional device management, proportionate asset inventories, and clearer allowances for operational technology.

Five controls tighten in practice:

• Vulnerability management (Level 1 and above). Remediate as soon as practicable, not routinely within 14 days.
• Visitor access (Level 1 and above). If you have no visitors or no premises, discuss it with your assessor rather than just noting it.
• Physical transport of backups (Levels 2 and 3). A documented policy is needed even if you never move backup media.
• Data loss prevention (Levels 2 and 3). AI tools are named as an exfiltration channel to consider, and policy alone is not enough.
• Continuous monitoring (Level 3). Monitoring and correlation must run 24/7/365, though not necessarily through a staffed security operations centre.

If you are mid-assessment, re-check your answers to those controls before you submit.