Guidance

Cyber security for defence suppliers (Def Stan 05-138, Issue 3)

This defence standard specifies the measures that defence suppliers are required to achieve at each of the 5 levels of cyber risk that a contract can be assessed as carrying.

• From: Ministry of Defence
• Published: 17 October 2017
• Last updated: 3 December 2025
  Show all updates

  1. 3 December 2025

     Updates to highlight that this guidance is now archived and where to find the latest guidance.

  2. 3 November 2025

     Updated details on DEFSTAN 05-138, Issue 3.

  3. 1 July 2021

     Added Issue 3 of DEFSTAN 05-138.

  4. 17 October 2017

     First published.

Documents

[ARCHIVED] Defence Standard 05-138, Issue 3: cyber security for defence suppliers

Ref: DEFSTAN 05-138, Issue 3

PDF, 205 KB, 21 pages

Details

This defence standard (DEFSTAN 05-138 Issue 3) is applicable to Ministry of Defence (MOD) procurements subject to Cyber Security Model Version 3 only, MOD suppliers and their subcontract suppliers, which have a relationship to one or more MOD contracts. Please see the guidance for the latest defence standard.