Cyber Security Model
Source: gov.uk (2025-12-03)

Information on the Ministry of Defence Cyber Security Model (CSM), including the standards and guidance for suppliers to meet CSM version 4.

The Cyber Security Model Version 4 is live.

Use the Supplier Cyber Protection Service here. (https://supplier-cyber-protection.service.gov.uk/)

The Cyber Security Model (CSM) is how Defence builds cyber security into its supply chain. It is a risk-based proportionate approach which includes:
- CSM Risk Assessments: Ministry of Defence (MOD) Delivery Teams complete an initial Risk Assessment. This determines a Cyber Risk Profile.
- Cyber Security Standard for Defence Suppliers: Defence Standard 05-138 (https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4) (Def Stan 05-138) lists the cyber security controls required for each Cyber Risk Profile. Suppliers are contractually required to meet Def Stan 05-138 controls.
- Supplier Assurance Questionnaires (SAQ): Suppliers self-assess against the CSM requirements using a Supplier Assurance Questionnaire.
- Flow down: Where suppliers are sub-contracting the supplier will complete a Risk Assessment to generate a new Cyber Risk Profile. The sub-contractor completes the appropriate Supplier Assurance Questionnaire.
If a supplier cannot meet the requirements, (including whether compliance is certified under Defence Cyber Certification (DCC) - see below) they must submit a Cyber Improvement Plan (CIP) detailing when they will meet the required level of compliance, together with associated timescales or reasons why they are unable to comply. The CIP template can be found here. (https://www.gov.uk/government/publications/cyber-improvement-plan-cip)

Defence condition 658 (https://www.gov.uk/government/publications/defence-condition-658-cyber-flow-down) (DEFCON 658) lays out the contractual terms for the Cyber Security Model.

The CSM has been updated:
- Cyber Security Model v3 (CSMv3) (legacy)
- Cyber Security Model v4 (CSMv4)
Existing and new procurements should now use CSMv4. Please see the Industry Security Notice (https://www.gov.uk/government/publications/industry-security-notices-isns) for more information on this transition and existing contracts. If you are in any doubt about which version of the CSM you should be using, please refer to your customer for more guidance. CSM v3 Cyber Risk Profiles (N/A – High) are not consistent with CSMv4.

Cyber Security Model v4 (CSMv4)

CSM version 4 is a significant change to the CSM which supports the MOD’s Cyber Resilience Strategy for Defence (https://www.gov.uk/government/publications/cyber-resilience-strategy-for-defence).

CSMv4:
- changes the CSM focus from “MOD Identifiable Information” to organisational security and resilience
- introduces four new Cyber Risk Profiles: “Level 0”, “Level 1”, “Level 2” and “Level 3”
- uses controls specified in Defence Standard 05-138 Issue 4 (https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4)
- provides a new online Supplier Cyber Protection Service (https://supplier-cyber-protection.service.gov.uk/scps) for completion of new CSM Risk Assessments and SAQs
Video series about changes to the CSM

Cyber Security Model version 4: Overview (https://www.youtube.com/watch?v=3SzYbll26ug)

Cyber Security Model version 4: Risk Assessment (https://www.youtube.com/watch?v=1p2pgN9ntY0)

Cyber Security Model version 4: Supplier Assurance Questionnaire (https://www.youtube.com/watch?v=clQSidRjLGY)

Cyber Security Model version 4: Roles and Responsibilities (https://www.youtube.com/watch?v=yYQYKXsQW44)

Cyber Security Model v4 process
- New opportunity: A Risk Assessment Reference (RAR) number and required Cyber Risk Profile (CRP) Level (Levels 0-3) relevant to a new or existing MOD activity will be provided by the authority at the earliest market engagement, and will usually be found in the invitation to tender.
- Complete a SAQ: If the supplier intends to bid for this opportunity with the MOD, the supplier must use the Supplier Cyber Protection Service and complete a SAQ, self-assessing against the CRP. Please refer to the Supplier Cyber Protection Service demonstration video below for further guidance.
- Supplier Assessment: A SAQ will be automatically scored against the CRP, and the supplier immediately informed if it is compliant.
- Cyber Improvement Plan (CIP): If the supplier is non-compliant, they must complete a CIP. The CIP will form part of the contract document itself. The CIP enables a supplier to commit to improving their cyber resilience and allows a contracting authority to permit a supplier to work towards compliance with the required Cyber Risk Profile Level (Levels 0-3). The supplier should include the CIP as part of their tender. The CIP template can be found here. (https://www.gov.uk/government/publications/cyber-improvement-plan-cip)
- Supplier Selection: The authority will take into consideration supplier compliance (or CIP proposal) in supplier selection.
- Contract Award: Contracts will be agreed between the authority and supplier, which will include any agreed CIP.
- Contract Maintenance: Annually, the supplier will complete a new SAQ on the anniversary of the contract award date, with a window of 1 month after that anniversary for timely completion. This will determine if they remain compliant with the CRP. If the supplier is non-compliant, a CIP will be considered. Please see the Industry Security Notice (https://www.gov.uk/government/publications/industry-security-notices-isns) for more information on this transition and existing contracts.
Flow down guidance for defence suppliers

The information in this guidance is relevant for both MOD personnel (authority) and current/prospect suppliers.

What is flow down?

Flow down is how MOD requests prime contractor requirements into lower-tier sub-contractor agreements. Flow down is required from the prime contractor to their sub-contractors and onwards down the sub-contracting tiers to the end of the supply chain. The flow down process allows the MOD to monitor and gain assurance on its supply chain.

Who is responsible for flow down?

Suppliers are responsible for flow down. DEFCON 658 contains the contractual obligations that suppliers must place upon subcontractors.

Flow down for existing contracts

A supplier must first have received a new CSMv4 Cyber Risk Profile level and RAR from their customer to conduct their own activities before initiating flow down to a subcontractor. A demonstration of this can be found in the online service video below.

If you are a supplier and have not yet received a CSMv4 Cyber Risk Profile level or RAR from your delivery team/buyer, you are advised to request these to complete your own SAQ and then initiate your flow down activity.

Flow down example scenario:

A prime contractor, Company A, is bidding on a MOD contract to build military drone parts. Company A expects to hire a sub-contractor, Company B, to help manufacture components, which Company B will sub-contract to Company C.
- Company A completes a CSM Risk Assessment (RA) to determine the Cyber Risk Profile (CRP) level for their sub-contractor(s). This CSM RA completion automatically generates a Risk Assessment Reference (RAR).
- Company A should pass this RAR to Company B to complete a SAQ to determine if they meet compliance with the CRP level required.
- Company B can now commence the onwards flow down, following in Company A’s footsteps by completing a CSM RA to determine the CRP level required for their sub-contract.
- Company C will then complete the relevant SAQ, aiming to meet the CRP level assigned by the CSM RA.
- This process can continue to flow down as seen through the supply chain tiers.
- If either Company B or Company C (sub-contractors) are NOT compliant with the required Def Stan 05-138 controls (per CRP level for the contract) as a result of completing their SAQ, requirements for a CIP must be agreed between parties and visibility of this must be provided to the MOD Delivery team.
Learn how to use the Supplier Cyber Protection Service

The Supplier Cyber Protection Service is a Public Beta. This demonstration video will show you how to use its current functionality. Alongside this, we are also exploring additional features to make CSM v4 even more flexible and user-friendly.

Cyber Security Model version 4: Supplier Cyber Protection Service Demonstration (https://www.youtube.com/watch?v=81_mxr8ZKzg)

Defence Cyber Certification

The Defence Cyber Certification (DCC) has been created in partnership with industry and IASME (https://www.ncsc.gov.uk/organisation/iasme), the scheme’s Certification Authority, as a way of independently evidencing compliance with the Cyber Security Model.

Suppliers should expect to see increasing requirement to hold valid DCC certification for the duration of their contract with the MOD, this will be specified as a condition under tender following launch of the CSM.

Suppliers with a valid DCC certificate are not yet exempt from completing elements of the SAQ through the Supplier Cyber Protection Service (SCPS), which entered public beta on 03 November.

Whilst it is hoped that DCC will be recognised within online tooling in due course, completion of the full SAQ to the required level remains mandatory as part of contractual risk assessment and procurement processes at this point in time.

More information on the Defence Cyber Certification (DCC) (https://iasme.co.uk/defence-cyber-certification/) for the Cyber Security Model v4 (CSMv4).

Related resources for UK suppliers

Defence Supply Chain organisations in the UK are encouraged to sign up for free services provided by the UK National Cyber Security Centre (NCSC):
- Active Cyber Defence and MyNCSC (https://www.ncsc.gov.uk/section/active-cyber-defence/). Registered organisations can access Active Cyber Defence (ACD) tools such as ‘Early Warning’ and keep updated on new capabilities and offerings beneficial to their cyber resilience.
Cyber Security Model v3 (CSMv3)

The content below is for the legacy CSMv3 process.

CSMv3:
- focuses on protection of electronic “MOD Identifiable Information”
- has four Cyber Risk Profiles: “Very Low”, “Low”, “Moderate” and “High”
- uses controls specified in Defence Standard 05-138 Issue 3 (https://www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138)
- annual renewal obligations being paused
- DEFCON 658 (https://www.gov.uk/government/publications/defence-condition-658-cyber-flow-down) is to be included where MOD Identifiable information is passed to a sub-contractor, even though flow down has paused
- requiring submissions through Microsoft Forms (below) or PDF
MS Form for CSMv3:
- Supplier Assurance Questionnaire (https://forms.office.com/pages/responsepage.aspx?id=7WB3vlNZS0iuldChbfoJ5Tia6pS3VU5EuhfRvV-BqYtURTFYMUpPOElZTjNUNDhaVjFLVklJMVpPUi4u&route=shorturl)
The Cyber & Supply Chain Security team will respond by email to Risk Assessments and Supplier Assurance Questionnaires within two working days.

If requirements are not met, the supplier will need to complete a Cyber Implementation Plan (CIP) (https://www.gov.uk/government/publications/cyber-implementation-plan-cip).

Contact

Email: xxx@xxx.xx (mailto:xxx@xxx.xx)

Monday to Friday, 9am to 5pm - excluding bank holidays.