Your MOD tender came with a Cyber Risk Profile. Here's how to answer it.
Since 3 December 2025, new DEFCON 658 risk assessments run on CSM v4. We help you answer the Supplier Assurance Questionnaire, agree a Cyber Improvement Plan where you fall short, and pass the requirements down your supply chain.
Want independent proof of your controls as well? We're an IASME-licensed Defence Cyber Certification body.
Talk through your questionnaire
Four steps between the tender and the contract.
Step 01
Risk assessment
The MOD assesses the contract and gives you a Risk Assessment Reference and a Cyber Risk Profile, Level 0 to 3, at the earliest market engagement; you'll usually find both in the invitation to tender. For a subcontract, your customer runs the assessment.
Step 02
Supplier Assurance Questionnaire
You self-assess against DEF STAN 05-138 Issue 4 for that level in the MOD's Supplier Cyber Protection Service. It is scored automatically, and you see straight away whether you are compliant.
Step 03
Cyber Improvement Plan
If you are not compliant, you submit a Cyber Improvement Plan with the tender: your commitment to reach the required level. An agreed plan becomes part of the contract.
Step 04
Award, then every year
The MOD weighs your compliance or your plan when it selects suppliers. Once the contract is live, you complete a new questionnaire each year on its anniversary.
The parts of CSM v4 that take the time.
Questionnaire preparation
We work through the questionnaire with you before you submit, so every answer is accurate and backed by evidence. Between anniversaries, we keep that evidence current for the annual return.
Cyber Improvement Plans
If you are short of the level, we turn the gaps into a plan with owners and dates you can commit to, because an agreed plan becomes part of your contract.
Supply chain flow-down
If you subcontract, DEFCON 658 goes down your supply chain. We help you complete a risk assessment for each subcontract, collect the questionnaires and agree any plans, with visibility for the MOD delivery team.
Defence Cyber Certification
MOD buyers accept a valid DCC certificate at or above your level as evidence of the controls, though the questionnaire is still mandatory for now. We can prepare you and certify you.
What changed with CSM v4
From a reference number to a signed contract.
Answer the CSM v4 Supplier Assurance Questionnaire for your Cyber Risk Profile, agree a Cyber Improvement Plan where you fall short, and flow DEFCON 658 down your supply chain.
Got a Risk Assessment Reference? Let's answer it properly.
Send the reference and level from your tender, and your submission date. We'll show you where you stand against the questionnaire and whether you need a Cyber Improvement Plan.