Cyber Security Model

The Cyber Security Model (CSM) is how Defence builds cyber security into its supply chain. It is a risk-based proportionate approach which includes:

• CSM Risk Assessments: MODMinistry of Defence (MOD) Delivery Teams complete an initial Risk Assessment. Assessment. This This determines a Cyber Risk Profile.
• Cyber Security Standard for Defence Suppliers: Defence Standard 05-138 (Def Stan 05-138) lists the cyber security controls required for each Cyber Risk Profile. Suppliers are contractually required to meet DefenceDef StandardStan 05-138 controls.
• Supplier Assurance Questionnaires:Questionnaires (SAQ): Suppliers self-assess against the CSM requirements using a Supplier Assurance Questionnaire.
• Flow down: Where suppliers are sub-contracting the supplier will complete a Risk Assessment to generate a new Cyber Risk Profile.  The sub-contractor completes the appropriate Supplier Assurance Questionnaire.

If a supplier cannot meet the requirements, (including whether compliance is certified under Defence Cyber Certification (DCC) - see below) they must submit a Cyber Implementation/ImprovementImprovement Plan (CIP).(CIP) detailing when they will meet the required level of compliance, together with associated timescales or reasons why they are unable to comply. The CIP template can be found here.

Defence Conditioncondition 658 (DEFCON(DEFCON 658)658) lays out the contractual terms for the Cyber Security Model.

ThereThe are two versions of the CSM inhas usebeen for procurements:updated:

• Cyber Security Model v3 (CSMv3) (current)(legacy)
• Cyber Security Model v4 (CSMv4) (under development)(current)

Existing and new procurements should continuenow to use CSMv3CSMv4. untilPlease CSMv4see isthe rolledIndustry out. WeSecurity willNotice communicate2025/04 transitionalfor arrangementsmore ininformation dueon course.this transition and existing contracts. CSM v3 Cyber Risk Profiles (N/A – High) are not consistent with CSMv4.

Cyber Security Model v3v4 (CSMv3)(CSMv4)

CSMv3:CSM version 4 is a significant change to the CSM which supports the MOD’s Cyber Resilience Strategy for Defence.

CSMv4:

• focuseschanges onthe protectionCSM offocus electronicfrom “MOD Identifiable Information” to organisational security and resilience
• hasintroduces four new Cyber Risk Profiles: “Very“Level Low”,0”, “Low”,“Level “Moderate”1”, “Level 2” and “High”“Level 3”
• uses controls specified in Defence Standard 05-138 Issue 34
• hasprovides operateda sincenew Juneonline 2021Supplier usingCyber anProtection InterimService Processfor ascompletion perof Industrynew CSM Risk Assessments and SAQs

Cyber Security NoticeModel 2021/05version 4: Overview.

Cyber ThisSecurity includes:

Model version 4: Risk Assessment

Cyber Security Model version 4: Supplier Assurance Questionnaire

Cyber Security Model version 4: Roles and Responsibilities

Cyber Security Model v4 process

1. flowNew downopportunity: obligationsA beingRisk pausedAssessment forReference a(RAR) number and required Cyber Risk Profile of(CRP) “VeryLevel Low”,(Levels “Low”0-3) relevant to a new or existing MOD activity will be provided by the authority at the earliest market engagement, and “Moderate”
2. annualwill renewalusually obligationsbe beingfound pausedin the invitation to tender.
3. DEFCONComplete 658a isSAQ: If the supplier intends to bebid includedfor wherethis MODopportunity Identifiablewith informationthe isMOD, passedthe tosupplier must use the Supplier Cyber Protection Service and complete a sub-contractor,SAQ, evenself-assessing thoughagainst flowthe downCRP. hasPlease paused
4. requiringrefer submissionsto throughthe MicrosoftSupplier FormsCyber (below)Protection orService PDF

MSdemonstration Formsvideo below for CSMv3:

• MOD Riskfurther Assessmentguidance.
• Supplier AssuranceAssessment: Questionnaire
• IndustryA RiskSAQ Assessment

Thewill Cyberbe &automatically Supplyscored Chainagainst Securitythe teamCRP, willand respondthe bysupplier emailimmediately toinformed Riskif Assessmentsit andis Suppliercompliant.