Def Stan 05-138 & DCPP Compliance — MOD Supply Chain Cyber Security
Suppliers to the UK Ministry of Defence must meet Def Stan 05-138. Each contract is given a Cyber Risk Profile (Very Low, Low, Moderate or High), and suppliers answer a Supplier Assurance Questionnaire showing they meet the controls for that profile.
Mutex Systems helps defence suppliers and subcontractors understand their profile, close control gaps (often starting from Cyber Essentials Plus) and keep evidence ready for primes and the MOD.
- Category
- Compliance Framework
- Jurisdiction
- United Kingdom
- Issuing Body
- UK Ministry of Defence
- Current Version
- Defence Standard 05-138 (latest issue) with the Cyber Security Model
- Who It's For
- MOD prime contractors and their supply chain, including SMEs and software suppliers.
Core Domains
A Practical Compliance Path
- 01
Profile review
Confirm the Cyber Risk Profile on your contracts and the controls it requires.
- 02
Gap analysis
Assess controls against Def Stan 05-138 for that profile.
- 03
Remediate
Implement missing controls, starting with Cyber Essentials Plus where needed.
- 04
Assure
Complete the Supplier Assurance Questionnaire with evidence.
From Cyber Essentials to higher profiles
Most suppliers start at Very Low or Low, where Cyber Essentials Plus is central. We build from there so higher profiles are reachable without starting again.
- Cyber Essentials Plus readiness
- Control gap analysis per profile
- SAQ evidence pack
Defence controls with evidence ready
grComply tracks Def Stan 05-138 controls for your profile, reuses Cyber Essentials and ISO 27001 evidence, and keeps the SAQ evidence current.
- Controls by Cyber Risk Profile
- Evidence reuse from Cyber Essentials
- Subcontractor assurance tracking
- Audit trail for primes
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About Def Stan 05-138
What is Def Stan 05-138?
The MOD defence standard that sets cyber security controls for suppliers, scaled to the Cyber Risk Profile of each contract.
What is the DCPP?
The Defence Cyber Protection Partnership — a joint MOD and industry initiative behind the Cyber Security Model, Cyber Risk Profiles and the Supplier Assurance Questionnaire.
Do MOD suppliers need Cyber Essentials?
Cyber Essentials is a baseline requirement for most MOD contracts, and higher profiles generally expect Cyber Essentials Plus plus additional controls.
Ready to Start Your Def Stan 05-138 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.