Reading the profile correctly is the front-gate decision for the entire cyber compliance work that follows. A supplier that prepares against the wrong profile, or against the wrong version of the model, wastes effort on controls the contract does not require or arrives at review with evidence the prime cannot accept.
This guide explains the four Cyber Risk Profiles in Def Stan 05-138 Issue 4, how a profile is set, and what to check before you prepare evidence.
The four Cyber Risk Profiles
Def Stan 05-138 Issue 4 is the MOD's cyber security standard for suppliers. It sets four Cyber Risk Profiles, Level 0 to Level 3, and the controls a supplier must have at each one. A Cyber Security Model risk assessment sets the profile for a contract. Under the contract condition DEFCON 658, suppliers must meet the controls for their profile. For each control, the standard asks for a documented and implemented control with auditable evidence.
How the levels compare (from Def Stan 05-138 Issue 4)
| Level | Name | Controls | Normally assigned where assessed cyber risk is | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|---|---|---|
| Level 0 | Basic | 3 | very low | Required | Not required |
| Level 1 | Foundational | 101 | low to moderate | Required | Not required |
| Level 2 | Advanced | 139 | high | Required | Required |
| Level 3 | Expert | 144 | substantial | Required | Required |
The number of controls rises at each level. A few Level 1 controls are replaced by stronger versions at higher levels.
A note on version 3 profile names
The legacy Cyber Security Model version 3 used named profiles: Very Low, Low, Moderate and High. MOD guidance states: "CSM v3 Cyber Risk Profiles (N/A – High) are not consistent with CSMv4." A Moderate profile is not the same as Level 2, so evidence mapped to a version 3 profile does not carry across. Existing and new procurements should now use version 4.
What DEF STAN 05-138 is
DEF STAN 05-138 is the Defence Standard that specifies the MOD framework for cyber risk profiling and control expectations across the defence supply chain. It is published on behalf of the MOD by UK Defence Standardization (DStan) and is available on GOV.UK. Issue 4 is the current issue. It is the standard behind Cyber Security Model version 4. Issue 3, behind version 3, is legacy. Checked on GOV.UK on 28 October 2026.
DEF STAN 05-138 functions as the technical reference behind DEFCON 658. Where DEFCON 658 is the contractual clause that obliges the supplier to perform cyber risk assessment and implement controls, DEF STAN 05-138 specifies the methodology, the risk profile structure, and the control expectations the supplier must satisfy. The two work together. DEFCON 658 is the mechanism. DEF STAN 05-138 is the method.
Cyber Security Model version 4 has four Cyber Risk Profiles: Level 0, Level 1, Level 2 and Level 3. Version 3 used named profiles: Very Low, Low, Moderate and High. Contracts let under version 3 can still carry those names.
For a subcontract, the contractor completes a Cyber Security Model risk assessment to set the profile and generate a Risk Assessment Reference.
For UK defence supply chain SMEs, the practical implication is that DEF STAN 05-138 is the technical reference the supplier needs to satisfy through documentation, not merely a reference the prime applies internally.
The four Cyber Risk Profiles and who assigns them
The profile assigned to a contract is determined by an assessment of the cyber risk associated with the contract scope. The MOD authority sets the profile for a contract it lets, usually stating it in the invitation to tender. A contractor sets the profile for each subcontract.
The evidence a supplier needs depends on the contract and on the Cyber Risk Profile the prime assigns, so read the contract and ask the prime in writing.
The relationship to DCC (Defence Cyber Certification)
DCC (Defence Cyber Certification) is the MOD scheme. DCC has four levels, 0 to 3. For the first step, see scoping DCC Level 0. The Defence Cyber Certification page explains what the MOD has asked for and the three Level 0 controls.
The relationship to Cyber Essentials Plus and ISO 27001
DEF STAN 05-138 is the framework. Cyber Essentials Plus and ISO 27001 are evidence frameworks that can contribute to satisfying it.
Cyber Essentials Plus is the technical control baseline.
ISO 27001 is the information security management system standard. It evidences that the supplier has a documented, operating and audited management system covering information security across the organisation.
The contract and the prime state which evidence the assigned profile requires.
Check your contract and organise your evidence
- Confirm which version of the model produced your profile, and which level applies.
- Get the Risk Assessment Reference. You need it to complete your Supplier Assurance Questionnaire in the Supplier Cyber Protection Service.
- If you have a version 3 profile or no reference, ask your buyer or prime for a version 4 profile level and reference, as MOD guidance advises.
- List each control for your level, record who owns it, and keep the evidence that shows it is in place.
- Check that your Cyber Essentials (and, at Levels 2 and 3, Cyber Essentials Plus) certificate covers the scope your contract needs.
Def Stan 05-138: what UK defence suppliers need to know. For help choosing support, see how to choose an ISO 27001 consultant.
Book the free 45-minute diagnostic to scope your DEF STAN 05-138 readiness.