For many years, the UK Defence sector has increasingly been targeted by sophisticated and hostile cyber threat actors due to its strategic importance, sensitive data, and complex supply chain.  This risk to our National Security is now being further compounded by geo-political factors such as the war in Ukraine, conflict in Gaza, global economic instability, and unpredictable US foreign policy.  As we seek to reduce UK and European dependency on US military and economic influence, there are those who will look to hamper and disrupt our progress. 

The Cyber Security sector here in the UK has long been lobbying for more comprehensive and mandatory regulatory controls, not only for organisations and their supply chains delivering critical goods and services, but also for the managed IT and security service providers that claim to protect them.  Not for the first time in our country’s history, it feels like the UK Defence sector is now at the tip of the spear in terms of making this required change happen. 

To address persistent vulnerabilities in supplier assurance and cyber risk management, the Ministry of Defence (MOD) has released Def Stan 05-138 Issue 4, supported by the newly introduced Defence Cyber Certification (DCC).  For those organisations working in adjacent CNI sectors across Europe, this is in addition to the NIS2 Directive being implemented across the EU, and the Cyber Security & Resilience Bill currently moving through approvals here in the UK. 

Together, these initiatives mark a transformative shift in how cyber resilience is built across the Defence supply chain, offering a structured, risk-based, and independently verifiable approach that strengthens national security while easing compliance ambiguity for suppliers.  The UK Defence sector is a high-value target for adversaries seeking strategic gain or disruption, and the vast supply chain is especially vulnerable, often seen as the path of least resistance due to: 

• Inconsistent security maturity among suppliers;
• Trusted relationships that can be exploited;
• Direct or indirect access to classified or sensitive data.
   

Managing cyber risk in the Defence supply chain has historically faced several obstacles such as: 

• Ambiguity in standards: Previous iterations of Def Stan 05-138, particularly Issue 3, lacked clarity and consistency;
• Cumbersome supplier assurance processes: Often duplicated across contracts and difficult to navigate;
• Lack of certification: No standardised external mechanism to validate supplier cyber posture, leading to inconsistent interpretation and implementation. 
   

Improvements in DEF STAN 05-138 

Issue 4 of Def Stan 05-138 introduces a significantly improved framework for managing cyber security in the supply chain. 

• Risk-based Cyber Risk Profiles (CRPs):  A new model defines four levels of cyber assurance based on the sensitivity of data and system criticality:
  • L0 – Basic
  • L1 – Foundational
  • L2 – Advanced
  • L3 – Expert
• Whole-organisation security scope:  Security obligations extend beyond project-specific systems to the entire organisation, recognising that threats can emerge from any part of a supplier’s operations.
• CAF alignment and integration with Cyber Essentials:  The new standard aligns with the National Cyber Security Centre’s Cyber Assessment Framework (CAF), adopting its four core objectives (A-D).  CRP levels dictate whether Cyber Essentials or Cyber Essentials Plus is required.
• Framework mapping:  Def Stan 05-138 Issue 4 maps to common industry frameworks to reduce duplication and support suppliers in leveraging existing certifications and controls. 
   

Introduction of the Defence Cyber Certification (DCC) 

A transformative feature of the new approach is the introduction of the UK Defence Cyber Certification (DCC), a long-needed mechanism to validate supplier cyber security maturity across contracts. 

The DCC directly addresses prior gaps in the assurance model, creating a foundation for consistent and scalable risk management across the Defence ecosystem.  With supply chains as extensive as BAE Systems for example, which works with over 20,000 suppliers, prioritisation is essential. Defence organisations must focus their assurance efforts on suppliers who: 

• Have access to sensitive data, technology, or personnel
• Operate under deeply trusted commercial relationships
• Are critical to the delivery of Defence missions 
   

The introduction of Def Stan 05-138 Issue 4 and the UK Defence Cyber Certification marks a significant evolution in how the UK MOD manages cyber security risk in its supply chain. This new, risk-based, and certifiable framework offers clarity, scalability, and consistency, helping protect national security interests while reducing compliance burdens for suppliers. 

As cyber threats continue to evolve, these changes ensure that the Defence sector can rely on a secure, resilient, and trusted supply chain. 

Why is the UK Cyber Security and Resilience Bill important? 

Finally, the forthcoming Cyber Security and Resilience Bill will place much more stringent requirements on cyber security service providers to sectors associated with critical public services.  It is important now to prepare by checking the accreditations, credibility, and capability of the providers you appoint in preparation for a more regulated operating environment. 

As organisations in the Defence sector seek to meet the new required level of security and resilience controls contained within the Def Stan and strive for the appropriate level of certification, they will seek external advice, consultancy, and services from the IT and Cyber Security sector.  The new Cyber Security and Resilience Bill brings outsourced managed service providers into scope as they hold digitally trusted and privileged access to clients’ infrastructure and data. 

As we have seen with high profile breaches over the last few years, the initial attack vector can come from the very companies claiming to be the protectors.  These companies (including CYSIAM) must be regulated, accountable, and acutely aware of the risk that they themselves pose to their clients’ resilience. 

How can CYSIAM Help? 

CYSIAM provides practical support to suppliers seeking to align with Def Stan 05-138 and DCC requirements by providing: 

• 24x7/365 UK-based Managed Security Services that meet CAF Objectives C and D for CRP Levels 2 and 3;
• Fully security-vetted consultancy and implementation assistance for CAF Objectives A and B, plus Cyber Essentials and Cyber essentials Plus. 
   

By partnering with CYSIAM, UK Defence suppliers can ensure timely, efficient, and fully compliant adoption of the new UK Defence cyber security standards. 

CYSIAM is a NCSC and CREST accredited service provider, ISO27001 and IASME certified for information security, and a Full Member of the globally recognised Forum of Incident Response and Security Teams (FIRST).  The company is also JOSCAR-certified and in 2022 was awarded the Gold Award by the UK MOD Employer Recognition Scheme (ERS).