GovWire

Guidance: Defence Cyber Protection Partnership

Ministry Of Defence

May 23
15:20 2024

Defence Standard 05-138 issue 4 has now been released. Please refer to ISN 2024/02 which identifies that Issue 4 is for information only.

Defence Standard 05-138 issue 3 remains in use.

Supplier Cyber Protection Service - Interim process

Current Status

The Octavian Supplier Cyber Protection Service was switched off in June 2021. We are currently on an interim process until the replacement tool is ready to go live.

Cyber Security Model process

The interim process offers a choice to complete Risk Assessments (RAs) and Supplier Assurance Questionnaires (SAQs) via either MS Forms or PDF.

The MS Forms links are:

The PDFs, if not provided by the Contracting Delivery team can be requested from the DCPP team at: ukstratcomdd-cydr-dcpp@mod.gov.uk.

The DCPP team are working to a 2-day turnaround time. We do welcome emails if you think a response has not been provided in this time.

Supplier Assurance Questionnaires (SAQs) in the tender process

When completing the SAQ, please include the Risk Assessment Reference (RAR). This should be provided by the MOD Delivery Team or other related competition publication.

For competition bids, unless otherwise stated, you will need to submit to the MOD Delivery team:

  • A copy of your SAQ. MS Forms submissions can be saved via the Print option and sending to PDF, rather than a specified printer; and
  • Our response email.
  • If our response email says, Not met, you will also need to submit a Cyber Implementation Plan (CIP) to the Contracting Delivery team. Guidance for this can be found on the Cyber Implementation Plan (CIP) page. Some competition processes such as DASA may post alternative CIP instructions.
    Please do not send CIPs to the DCPP team as these need to be considered against the specific project requirements.
  • If the Cyber Risk Profile is HIGH, DCPP will send out the necessary flow down instructions.

Supplier Assurance Questionnaires (SAQs) in the interim process: upcoming change

The SAQ used in the interim process is due to change in 2023.

You can preview the draft SAQ in advance of this change:

Supplier Assurance Questionnaire - preview of 2023 update (PDF, 206 KB, 20 pages)

Supplier Assurance Questionnaire - preview of 2023 update (ODT, 41 KB)

Please contact ukstratcomdd-cydr-dcpp@mod.gov.uk if you have any queries about the draft SAQ.

DEFCON 658

Please note, as per this Industry Security Notice

  • Annual renewals have been paused.
  • Flow downs are also paused unless the Cyber Risk Profile (CRP) is HIGH. If this is the case and your CRP is HIGH, then you should proceed with your flow down submissions.

Future Tool

The new tool is currently undergoing testing. Suppliers/bidders will be informed by the MOD Delivery team at a point where roll out of the tool can start. There is currently no release date.

Additional information

Def Stan 05-138

This is the Defence Standard defining the controls required for each Cyber Risk Profile (level).

DEFCON 658

This is the contractual Defence Condition that references supply chain cyber security.

Defence Industry Warning, Advice and Reporting Point (WARP)

There is a requirement to report security incidents where MOD data might be involved

Understanding more about the Cyber Security Model

Watch a video explaining the Cyber Security Model

The Cyber Risk Profile is assessed on 6 questions relating to:

Cyber Essentials underpins the MOD Cyber Risk Profiles. Cyber Essentials is a certification scheme identifying the minimum steps an organisation should take to protect themselves against cyber risk.

The Supplier Assurance Questionnaire is a self-assessment for organ

Related Articles

Comments

  1. We don't have any comments for this article yet. Why not join in and start a discussion.

Write a Comment

Your name:
Your email:
Comments:

Post my comment

Recent Comments

Follow Us on Twitter

Share This


Enjoyed this? Why not share it with others if you've found it useful by using one of the tools below: