By David Webb, Director at Forensic Control
DEFCON 658 is one of the Ministry of Defence’s standard contract conditions, and it carries the cyber security obligation. It is included in any contract, and any subcontract beneath it, where the supplier will hold, process or transmit MOD identifiable information. The condition does not set the controls itself. It points the supplier to the MOD’s Cyber Security Model, which was reinstated in its fourth version on 3 December 2025, and to the control standard behind it, Defence Standard 05-138 Issue 4.
The model works from a risk assessment carried out by the contracting authority. Each contract is given a cyber risk profile, and the profile sets the control level the supplier has to meet and evidence. The supplier records its position in a Supplier Assurance Questionnaire, which the MOD now requires to be reviewed every year on the anniversary of the contract. The obligation flows down: a prime contractor is responsible for placing the same requirement on any subcontractor that will handle the information.
Having spent 26 years in the armed forces before moving into corporate security, I would read DEFCON 658 as a description of what the MOD will check. The risk profile tells you the level, the standard tells you the controls, and the questionnaire is where you show your work. The quickest way through the first two levels is a certificate the MOD already recognises, and for those levels that certificate is Cyber Essentials.
The cyber condition. Requires you to meet the control level set by your contract's cyber risk profile under the Cyber Security Model and Def Stan 05-138. Cyber Essentials and Defence Cyber Certification are how suppliers satisfy it.
The data protection condition where you process personal data on behalf of the MOD. DEFCON 532A is its counterpart where you do not. Both sit alongside DEFCON 658. A contract that involves MOD personal data will usually carry the data condition and the cyber condition together.
The MOD's own scheme, launched in May 2025 and delivered through IASME certification bodies. Four levels, 0 to 3. Since March 2026 a valid certificate at the right level counts as assured evidence under DEFCON 658.
The MOD has asked all industry partners to achieve Defence Cyber Certification Level 0 by 31 December 2026. Level 0 requires Cyber Essentials on your business critical systems. A supplier holding a DEFCON 658 contract without a certificate has until then to get one.
Defence Cyber Certification has four levels, and each one is built on the IASME scheme. Every level starts with Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus. Level 0 covers three controls and is the floor the MOD has asked every supplier to reach this year. Level 1 adds around a hundred controls from Def Stan 05-138, and Levels 2 and 3 add more again, so a supplier’s DCC level tracks the cyber risk profile of the most demanding contract it holds.
The practical consequence is that a contract with a very low or low profile can usually be evidenced with Cyber Essentials and a Level 0 or Level 1 certificate, and anything above that will ask for Plus as the starting point. The MOD’s matrix in Industry Security Notice 2026/02 sets out which certification level satisfies which control level, and a certificate at a higher level satisfies everything beneath it. Certification is valid for three years with an annual attestation, and the Supplier Assurance Questionnaire still has to be completed and reviewed annually; the certificate is the evidence that goes with it.
Five steps, in the order the MOD will check them.
“A supplier holding and maintaining current, valid, DCC certification at a level equal to, or greater than, the commensurate level to the requirement, is to be considered in satisfaction of the control requirement.”
We are an IASME Certification Body and certify defence suppliers remotely across the UK. We do not assess Defence Cyber Certification ourselves, but every DCC level starts with the Cyber Essentials certificate we do issue. Send us the DEFCON 658 clause and your risk profile and we can discuss what your contract needs.
