Defence Cyber Protection Partnership

Supplier Cyber Protection PartnershipService (DCPP)- Interim process

Current Status

The Octavian Supplier Cyber Protection Service was switched off in June 2021. We are currently on an interim process until the replacement tool is ready to go live.

Cyber Security Model process

The interim process offers a jointchoice Ministryto ofcomplete DefenceRisk (MOD)Assessments (RAs) and industrySupplier initiativeAssurance toQuestionnaires improve(SAQs) thevia protectioneither ofMS Forms or PDF.

The MS Forms links are:

• MOD Risk Assessment
• Supplier Assurance Questionnaire (SAQ)
• Industry Risk Assessment

The PDFs, if not provided by the defenceContracting supplyDelivery chainteam can be requested from the cyberDCPP threat.team at: ukstratcomdd-cydr-dcpp@mod.gov.uk.

The DCPP reportsteam intoare working to a 2-day turnaround time. We do welcome emails if you think a response has not been provided in this time.

Supplier Assurance Questionnaires (SAQs) in the Defencetender Suppliers’process

When Forum.completing the SAQ, please include the Risk Assessment Reference (RAR). This should be provided by the MOD Delivery Team or other related competition publication.

TheFor membershipcompetition ofbids, unless otherwise stated, you will need to submit to the DCPPMOD includes:Delivery team:

• UKA Ministrycopy of Defenceyour (MOD)SAQ. MS Forms submissions can be saved via the Print option and sending to PDF, rather than a specified printer; and
• NationalOur response email.
• If our response email says, “Not met”, you will also need to submit a Cyber SecurityImplementation CentrePlan (NCSC)(CIP) to the Contracting Delivery team. Guidance for this can be found on the Cyber Implementation Plan (CIP) page. Some competition processes such as DASA may post alternative CIP instructions.
  Please do not send CIPs to the DCPP team as these need to be considered against the specific project requirements.
• DepartmentIf forthe Science,Cyber InnovationRisk andProfile Technologyis HIGH, DCPP will send out the necessary flow down instructions.

Supplier Assurance Questionnaire - preview of 2023 update (PDF, 206 KB, 20 pages)

Supplier Assurance Questionnaire - preview of 2023 update (ODT, 41 KB)

Please contact ukstratcomdd-cydr-dcpp@mod.gov.uk if you have any queries about the draft SAQ.

DEFCON 658

Please note, as per this Industry Security Notice

• Annual renewals have been paused.
• ADSFlow (adowns UKare tradealso associationpaused representingunless smallthe Cyber Risk Profile (CRP) is HIGH. If this is the case and mediumyour enterprisesCRP inis HIGH, then you should proceed with your flow down submissions.

Additional information

• Preview the Risk Assessment

• Specified

  Preview Defencethe primeSupplier suppliersAssurance Questionnaire

• For more information: Contact us

Def Stan 05-138

This is the Defence Standard defining the controls required for each Cyber Risk Profile (level).

DEFCON 658

This is the contractual Defence Condition that references supply chain cyber security.

Defence Industry Warning, Advice and Reporting Point (WARP)

There is a requirement to report security incidents where MOD data might be involved

FurtherUnderstanding informationmore about the Cyber Security Model

Watch a video explaining the Cyber Security Model

The Cyber Risk Profile is assessed on 6 questions relating to:

• electronic exchange or creation of MOD Identifiable Information

• classification

• personal data

• connectivity to MOD networks

Cyber Essentials underpins the MOD Cyber Risk Profiles. Cyber Essentials is a certification scheme identifying the minimum steps an organisation should take to protect themselves against cyber risk.

The Supplier Assurance Questionnaire is a self-assessment for organisations to demonstrate how they meet our requirements. The online tool allows sample questionnaires to be completed to identify gaps. Where there are differences a Cyber SecurityImplementation ModelPlan (CIP) should be completed, particularly if an alternative cyber security standard is used.

Further information on CIPs can be found in:

• Annex D of the Buyer Supplier Guide

• Secure

  Guidance byfor Design portalAdopting Other Standards

• CE+ Illustrative test specification

QueriesNews

Email:Def Stan 05-138 v3 Cyber Security for defence suppliers

Contact us

The DCPP Team can be contacted by email on: ukstratcomdd-cydr-dcpp@mod.gov.uk or DCPP LinkedIn Group.

ResponsesDCPP willgroup normallyon bethe providedNCSC’s withinCyber twoInformation workingSharing days.Partnership (CISP), register at NCSC’s Cyber Information Sharing Partnership (requires sponsorship).

Recommended links

• Cyber security for defence suppliers (Def Stan 05-138 v3)
• Defence Condition 658 (DEFCON 658)
• Cyber risk profiles (updated July 2020)
• Supplier Assurance Questionnaire (Dec 2019)