Defence Cyber Protection Partnership

Interim process for new contracts

MOD Risk Assessment (RA)

The MOD Project/Delivery Manager needs to complete the Risk Assessment (RA) via the interim process. Please request forms via email to the DCPP Team: ukstratcomdd-cydr-dcpp@mod.gov.uk. Please return forms as Microsoft (preferred) or convert to PDF.

Supplier Assurance Questionnaire (SAQ)

Tenderers must still complete an SAQ to be provided with tender responses. The MOD Project Team will provide the SAQ. On completion, this must be sent to the DCPP Team for a result to be provided. The completed SAQ and result must be included with tender responses, along with a Cyber Implementation Plan (CIP) if appropriate.

Flow down

Whilst the interim process is in place, flow down of the Risk Assessment/Supplier Assurance Questionnaire process to sub-contracts will be required for contracts with a high-risk profile only. All other levels must be completed during a grace period after the new tool goes live.

DEFCON 658

DEFCON 658 will continue to be included in contracts. Cyber Implementation Plans (CIPs) will continue to be needed as usual where SAQs indicate non-compliance (for all Tier 1 SAQs and High flow down).

Thank you for your patience.

For more information, contact the DCPP Team: ukstratcomdd-cydr-dcpp@mod.gov.uk

Additional information

• Preview the Risk Assessment

• Preview the Supplier Assurance Questionnaire

• For more information: Contact us

Def Stan 05-138

This is the Defence Standard defining the controls required for each Cyber Risk Profile (level).

DEFCON 658

This is the contractual Defence Condition that references supply chain cyber security.

Defence Industry Warning, Advice and Reporting Point (WARP)

There is a requirement to report security incidents where MOD data might be involved

Understanding more about the Cyber Security Model

Watch a video explaining the Cyber Security Model

The Cyber Risk Profile is assessed on 6 questions relating to:

• electronic exchange or creation of MOD Identifiable Information

• classification

• personal data

• connectivity to MOD networks

Cyber Essentials underpins the MOD Cyber Risk Profiles. Cyber Essentials is a certification scheme identifying the minimum steps an organisation should take to protect themselves against cyber risk.

The Supplier Assurance Questionnaire is a self-assessment for organisations to demonstrate how they meet our requirements. The online tool allows sample questionnaires to be completed to identify gaps. Where there are differences a Cyber Implementation Plan (CIP) should be completed, particularly if an alternative cyber security standard is used.

Further information on CIPs can be found in:

• Annex D of the Buyer Supplier Guide

• Guidance for Adopting Other Standards

• CE+ Illustrative test specification

News

Def Stan 05-138 v3 Cyber Security for defence suppliers

Contact us

The DCPP Team can be contacted by email on: ukstratcomdd-cydr-dcpp@mod.gov.uk or DCPP LinkedIn Group.

DCPP group on the NCSC’s Cyber Information Sharing Partnership (CISP), register at NCSC’s Cyber Information Sharing Partnership (requires sponsorship).

Recommended links

• Cyber security for defence suppliers (Def Stan 05-138 v3)
• Defence Condition 658 (DEFCON 658)
• Cyber risk profiles (updated July 2020)
• Supplier Assurance Questionnaire (Dec 2019)

Useful links

• Supplier Cyber Protection Service: risk assessment workflow

• Cyber Security Model: cyber risk profiles’ requirements

• Guidance for adopting other standards to meet requirements of Defence Standard 05-138 (PDF, 231 KB, 8 pages)

• DCPP: Cyber Security Model industry buyer and supplier guide

• Defence Cyber Protection Partnership: board level presentation slides

• Defence Cyber Protection Partnership: your questions answered

This unclassified presentation was recorded for internal MOD audiences to raise their awareness of the Cyber Security Model although most of it still applies to industry.

DCPP internal presentation

Other media sources

• LinkedIn Group

• DCPP group on the NCSC’s Cyber Information Sharing Partnership (CISP), register at NCSC’s Cyber Information Sharing Partnership