Industry Security Notice (ISN)

Updated 'Requirement for defence suppliers to report all security incidents affecting defence-related classified material to the UK MOD'.

Updated: ISN 2023/17, Arrangements for the handling and transmission of classified and protected information concerning the Canadian Surface Combatant Frigate and UK Type 26 Frigate, replacing ISN 2022/03. Removed: ISN 2023/16, Arrangements for the handling and transmission of defence classified information concerning the Australian Hunter Class Frigate and UK Type 26 Frigate (superseded by new ISN); ISN 2021/04, Industry personnel security assurance (superseded by existing policy); and ISN 2018/06, Australia-UK security arrangement: arrangements for the handling and transmission of defence classified information (superseded by new ISN).

'Security Aspects Letters and Contractual Security Conditions' updated.

Added: Security Aspects Letters and Contractual Security Conditions.

Added: 'Changes to the MOD Form 680 process to incorporate US ITAR'.

Added 'UK-Australia arrangements for the handling and transmission of Defence Classified Information'.

Added 'Cloud security control requirements for handling Official MOD Information'.

Updated 'Security Aspects Letters and Contractual Security Conditions'.

Updated The National Security Act 2023 and annex A, Security Aspects Letters and Contractual Security Conditions and Subcontracting or Collaborating on Classified UK MOD Programmes.

Added: Advance publication of DEFSTAN 05-138 (Issue 4).

Added: The National Security Act 2023.

Added 'Arrangements for the Handling and Transmission of Classified and Protected Information Concerning the Canadian Surface Combatant Frigate and UK Type 26 Frigate' and 'Arrangements for the Handling and Transmission of Defence Classified Information Concerning the Australian Hunter Class Frigate and UK Type 26 Frigate'.

Removed 'Definition of MOD Identifiable Information', superseded by existing policy.

Removed 'Definition of MOD Identifiable Information'.

Added 'Retention of documents following conclusion/termination of a UK MOD contract'.

Added 'Network Gas Supply Emergency (NGSE) Priority Listing Category B application for Defence Industry'.

Updated 'Security Aspects Letters and Contractual Security Conditions'.

Added: 'Requirement for defence contractors to report all security incidents affecting defence-related classified material to the MOD' ISN 2023/11, and 'Security Aspects Letters and Contractual Security Conditions' ISN 2023/12.

Removal of ISNs: 2022/07, superseded by 2023/05. 2020/06, superseded by existing policy. 2017/03, superseded by 2023/05. 2017/01, superseded by 2023/10. 2016/04, no longer current. 2016/03, no longer current. 2015/04, no longer current. 2015/02, superseded by existing policy. 2015/01, superseded by existing policy. 2011/04, superseded by existing policy. 2011/01, superseded by 2022/06. 2010/03, superseded by existing policy. 2010/01, superseded by existing policy.

Added: Arrangements for the registration and assurance of supplier systems processing MOD information.

Updated 'Secure by Design Requirements'.

Updated 'Security Aspects Letters and Contractual Security Conditions'.

Added: 'Publication of revised Government Security Classifications Policy'

Updated: Subcontracting or Collaborating on Classified UK MOD Programmes

Added: 'Requirement for defence contractors to report all security incidents affecting defence-related classified material to the MOD', ISN 2023/05.

Added: ISN 2023/04 Electronic Movement of OFFICIAL-SENSITIVE MOD Identifiable Information.

'Control and procedures for effective system patching and update' updated.

Added 'MOD Facility Security Clearance (FSC) policy and guidance for UK Defence contractors and MOD Contracting Authorities'.

Updated ISN 2023/01 'Security Aspects Letters and Contractual Security Conditions'.

'Security Aspects Letters and Contractual Security Conditions' added.

Added 'Control and procedures for effective system patching and update'.

'Ongoing Personnel Security Requirements for Defence Contractors – Aftercare Responsibilities' updated.

'Ongoing personnel security requirements for defence contractors - aftercare responsibilities' updated.

'Electronic Movement of OFFICIAL-SENSITIVE MOD Information' updated.

Updated Electronic Movement of OFFICIAL-SENSITIVE MOD Information.

Updated 'Clarification on requirements for remote working with MOD material'.

Updated ISN Clarification on requirements for remote working with MOD material.

Added: Industry Security Notice: Requirement to report security incidents affecting MOD material to the MOD. Removed: ISN 2011/07 (Incident Reporting).

Removed as the content contained within all of these ISNs has been superseded by new policy and guidance: Update to the Defence Cyber Protection Partnership’s (DCPP) Risk Assessment and Supplier Assurance Questionnaires, Introduction of Verify to the cyber security model and risk management guidance, Requirement to report security incidents affecting MOD material to the MOD, Defence industry WARP CANNEL state notification, MOD basic grade messaging (email) address routing changes, MOD implementation of cyber essentials scheme, Government security classification scheme: update, Government Security Classification Scheme, Government Security Classification Scheme (updated April 2014), Industry Supplier Guidance on DEFCON 658 (Flow - Down) – Amended.

Added ISN Electronic Movement of OFFICIAL-SENSITIVE MOD Information and ISN Subcontracting or Collaborating on Classified UK MOD Programmes.

Added Industry Security Notice: Defence Industry WARP Change of Ownership and Contact Details.

Added National Security Vetting and Social Networking Sites ISN 2022/06.

Addition of 'Release of JSP 440 to Industry'.

Added: Secure by Design Requirements.

Added ISN 2022/04: Design Requirements.

Added: Arrangements for the Handling and Transmission of Classified and Protected Information Concerning the Canadian Surface Combatant Frigate and UK Type 26 Frigate.

Added: Business Continuity and Resilience

Added: Personnel Security Requirements – Aftercare Responsibilities Related to Providing Accommodation to Foreign Nationals.

Added: Industry Supplier Guidance on DEFCON 658 (Flow - Down) – Amended.

Addition of: Cyber Security Model – Interim Process in support of DEFCON 658.

Addition of: Industry Personnel Security Assurance.

Updated: ISN Encryption Of MODII At Rest.

Added: Compliance with Cyber Security Requirements from Other Nations and Encryption Of MODII At Rest.

Added: Advice on completing the 2021 United Kingdom Census.

Added: Exchange of Classified Information with the European Union.

Addition of: Canada/UK industrial security arrangement - Arrangements for the Handling and Transmission of Classified and Protected Information.

Addition of: ISN Supplier Guidance on renewal of the Supplier Assurance Questionnaire under DEFCON 658 (Cyber).

Addition of: List V - Industry Personnel Security Assurance.

Addition of: Encryption Of MODII At Rest.

Industry security notice regarding cyber security model and cyber essentials plus certification during COVID-19 isolation added.

Added the Clarification on requirements for remote working with MOD material, ISN 2020/01.

Added Update to the Defence Cyber Protection Partnership’s (DCPP) Risk Assessment and Supplier Assurance Questionnaires.

Updated Australia-UK security arrangement: Arrangements for the handling and transmission of defence classified information which has been amended.

Added: Australia-UK Security Arrangement: Arrangements for the Handling and Transmission of Defence Classified Information

Added Ongoing personnel security requirements for defence contractors - Aftercare responsibilities.

Updated Interpretation of US DFARS clauses in relation to CDI and cyber reporting.

Added Interpretation of US DFARS Clauses in relation to CDI and Cyber Reporting (ISN 2018/04).

Added Introduction of Verify to the Cyber Security Model and Risk Management Guidance.

Added Encryption of removable storage media holding MOD data ISN.

Added ISN 01/18 DART – Risk Balance Case Process.

Added Release of UK OFFICIAL-SENSITIVE and equivalent third party classified material to foreign non-government recipients.

Added Encryption of removable storage media holding MOD data.

Added ISN 03/2017: Requirement to report security incidents affecting MOD material to the MOD

Added Industry supplier guidance on DEFCON 658 (ISN 2017/06) that replaces an earlier version of the guide (ISN 2017/05).

Added Industry supplier guidance on DEFCON 658 (flow-down) ISN 2017/05.

Added industry supplier guidance on DEFCON 658 (cyber).

Added ISN 2017/02 Defence industry WARP CANNEL state notification

Added MOD ICT security accreditation and the defence assurance risk tool (DART).

Updated: Definition of MOD Identifiable Information

Added: Definition of MOD Identifiable Information

Added ISN 2016/04 key email address changes for the Ministry of Defence

Added new ISN 2016/03.

Added new Industry security notice ISN 2016/02.

Added ISN 2016/01.

Added ISN 2015/05.

Added new ISN 2015/04.

Removed out of date notices.

Added ISN 2015/03: Guidance on Security Technology at OFFICIAL.

Added ISN 2015/02: Introduction of the electronic private venture security grading and exhibition clearance processes on SPIRE.

Replaced ISN 2015-01 Marking of MOD Commercial Information with amended version.

Added ISN 2015/01: Marking of MOD commercial information.

Added new ISN 2014/06

Added ISN 2014/05.

Added ISN 2014/04: Farnborough International Air Show 2014: exhibition clearances

Replaced Government Security Classification Scheme with the updated April 2014 file.

Removed 2011/03 which was superseded by 2014/03. Added 2014/02 and 2014/03.

Added ISN 2014/01: Government Security Classification Scheme

First published.