Cyber Essentials for defence (MOD) suppliers

Defence has the most acronyms of any sector. The short version: Cyber Essentials is the floor, and the MOD wants every supplier at a new baseline by the end of 2026.

The jargon, decoded

• DEFCON 658 is the contract clause that makes cyber security a contractual requirement, and it flows down to subcontractors.
• Def Stan 05-138 is the standard listing the controls required at each risk level.
• The Cyber Security Model (CSM) is the MOD's process for deciding a contract's risk level and checking suppliers meet it.
• Defence Cyber Certification (DCC) launched in May 2025, run with IASME, as an independent way to prove you meet the standard. It has four levels, and every level builds on Cyber Essentials.

What's happening now

• The MOD has asked all industry partners to reach DCC Level 0 by 31 December 2026. Level 0 includes Cyber Essentials for the relevant systems.
• Since March 2026 (Industry Security Notice 2026/02), a valid DCC certificate at the right level can be used as assurance under DEFCON 658.
• DCC isn't yet a universal contract requirement, but the MOD expects to make it one, so treat the deadline as real.
• Higher-risk contracts usually need Cyber Essentials Plus as well.

What a small supplier should do

1. Check your contracts and purchase orders for DEFCON 658 and the risk level assigned.
2. Get Cyber Essentials now if you don't have it. Nothing else in defence works without it.
3. Ask your prime contractor what DCC level they expect from you.
4. Keep the certificate current. It lasts 12 months.