DEFCON 658 is the MOD contract clause that sets the terms of the Cyber Security Model. The supplier must meet the Def Stan 05-138 controls for the Cyber Risk Profile assigned to the contract and place the same obligations on its subcontractors. Version 4 has four profiles, Level 0 to Level 3.
This guide sets out what DEFCON 658 asks of a supplier, how the Cyber Security Model works, and what to check in your contract.
Check your contract
Before any preparation work, confirm five things:
- Model version. Is the profile from Cyber Security Model version 4 (Level 0 to Level 3) or the legacy version 3 (Very Low to High)? The two are not consistent with each other.
- Assigned profile. Which Cyber Risk Profile level applies to your contract or subcontract?
- Risk Assessment Reference. Do you have a Risk Assessment Reference (RAR)? You need it to complete your Supplier Assurance Questionnaire.
- Evidence requested. What does the contract, or any Security Aspects Letter, ask you to provide?
- Confirmation. If anything is missing or unclear, ask your prime or buyer in writing. MOD guidance advises suppliers without a version 4 profile or RAR to request both.
How the Cyber Security Model works
MOD delivery teams complete a risk assessment that sets the Cyber Risk Profile, and Def Stan 05-138 lists the controls required for each profile. Under version 4, the authority gives a Risk Assessment Reference and the required profile level at the earliest market engagement, usually in the invitation to tender. For a subcontract, the supplier completes its own risk assessment to set the profile for the tier below. How the four profiles work.
The Supplier Assurance Questionnaire (SAQ)
The SAQ is how a supplier self-assesses against its Cyber Risk Profile. Under version 4 it is completed in the online Supplier Cyber Protection Service and scored automatically, and the supplier is told straight away whether it is compliant. The SAQ is repeated each year on the anniversary of the contract award date, with a one-month window to complete it.
The Cyber Improvement Plan (CIP)
If a supplier is not compliant, it must complete a Cyber Improvement Plan. The plan sets out when the supplier will meet the required level, with timescales, or the reasons it cannot comply. The supplier should include the plan in its tender, and an agreed plan forms part of the contract. Older contracts and the legacy version 3 process use the name Cyber Implementation Plan.
What DEFCON 658 is and why it exists
DEFCON 658 (Cyber) is a standard MOD contract condition. It sets out the contractual terms for the Cyber Security Model (CSM), the MOD's approach to building cyber security into its supply chain.
The authority sets the Cyber Risk Profile for the contract. The supplier must meet the Def Stan 05-138 controls for that profile and self-assess through a Supplier Assurance Questionnaire. The supplier must place equivalent provisions in all relevant subcontracts, and each tier passes them on.
Who DEFCON 658 applies to
DEFCON 658 applies to MOD contracts where cyber risk is identified as a contract-relevant exposure.
The flow-down is where most tier-2 and tier-3 suppliers first encounter the clause. A prime contractor bound by DEFCON 658 will include equivalent terms in its sub-contract with a tier-2 supplier. The tier-2 supplier, if it then sub-contracts work that touches the same risk, will flow the obligation to a tier-3. The chain extends as deep as the supply chain extends.
A tier 3 supplier is bound when its own subcontract includes the DEFCON 658 provisions.
The Cyber Security Model and DEFCON 658
The Cyber Security Model (CSM) is the MOD framework that operationalises cyber risk management across the defence supply chain. DEFCON 658 is the contractual clause; the CSM is the methodology DEFCON 658 implements.
The CSM uses Defence Standard 05-138 (DEFSTAN 05-138) as the technical reference for cyber risk profiling. DEFSTAN 05-138 Issue 4 specifies the cyber controls suppliers are required to achieve at each of the four cyber risk profile levels a contract can be assessed at. DEFCON 658 contractually binds the supplier to assess against, implement against, and evidence against the profile assigned to the contract.
The relationship between DEFCON 658 and the CSM matters because the documentation a supplier produces is judged against the CSM evidence expectations, not against a generic cyber framework.
The risk profile levels, and which version of the model assigned yours
Corrected 2 September 2026. An earlier version of this article described five named risk profiles running from Very Low to Very High. That was wrong, and the correction matters because it changes what a supplier prepares against.
The Cyber Security Model has been through a version change and the two versions do not share a scale.
Cyber Security Model version 3, now legacy, focused on the protection of electronic MOD Identifiable Information. It used Defence Standard 05-138 Issue 3 and had four Cyber Risk Profiles: Very Low, Low, Moderate and High.
Cyber Security Model version 4, which is live, moves the focus from MOD Identifiable Information to organisational security and resilience. It uses Defence Standard 05-138 Issue 4 and has four Cyber Risk Profiles: Level 0, Level 1, Level 2 and Level 3. GOV.UK describes Issue 4 as specifying the cyber controls defence suppliers are required to achieve at each of the four cyber risk profile levels a contract can be assessed at.
There is no Very High profile in either version.
MOD state that existing and new procurements should now use CSMv4, and warn directly that "CSM v3 Cyber Risk Profiles (N/A – High) are not consistent with CSMv4." The named profiles are not the numbered levels under different labels, and a control mapping built against Moderate is not a control mapping against Level 2.
The practical consequence for a tier-2 or tier-3 supplier is a question to ask before any preparation work starts: which version of the model produced the profile in front of me, and when. Under CSMv4 the authority issues a Risk Assessment Reference and a required Cyber Risk Profile level, usually in the invitation to tender, and the supplier self-assesses against it in the Supplier Cyber Protection Service. If you hold a named profile from an older contract and no Risk Assessment Reference, you do not yet have what CSMv4 needs, and the guidance advises requesting both from your delivery team or buyer.
How the levels relate to Defence Cyber Certification is set out in our Defence Cyber Certification glossary entry.
DEFCON 658 versus Def Stan 05-138.
Cyber Essentials and Cyber Essentials Plus
Def Stan 05-138 Issue 4 requires Cyber Essentials certification at every level, Level 0 to Level 3. Cyber Essentials Plus is also required at Levels 2 and 3. In both cases the certificate must cover the scope required for the contract.
Getting ready
Start with the checklist above, then map your current controls against the Def Stan 05-138 controls for your profile. Goldline provides readiness support and consultancy. We do not certify, and certification is carried out by the relevant certification body. A pre-certification readiness audit shows where your gaps are before you complete the SAQ or apply for certification.
Book the free 45-minute diagnostic to scope your DEFCON 658 readiness.