There is a reason the DoD did not adopt a risk-based approach to CMMC.

← Back to Blog

There is a reason the DoD did not adopt a risk-based approach to CMMC. For full organisation compliance to over 101 controls takes well over 18 months and is a significant cost when applied to all data types.

On the 3rd November 2025, the UK Government published guidance through the Cyber Security IT Cybersecurity Model on how the Defence builds cyber security into its supply chain. A program that has many similarities and differences to the US DoD CMMC program, which becomes effective on the 10th November 2025.

The UK model introduces four Cyber Risk Profiles: “Level 0”, “Level 1”, “Level 2”, and “Level 3. That applies to all MoD Contracts and Annual reviews, setting standards for all suppliers. It focuses on the whole organisation, rather than a specific product or service, and compliance with Def Stan 05-138 across all products and services delivered in support of a contract. Enforced by MoD contracts and required to bid for contracts, and evidenced by compliance with Def Stan 05-138. Once approved, the supplier is contracted.

It is positive to see the MoD taking steps to secure the UK DIB.

A few observations: The MoD model appears to focus on whole-organisation cyber compliance; the DoD model is specifically on data types FCI and CUI. The MoD model looks to be subjective about control evaluation, artefacts, and assurance. The DoD model is specific about data, controls, artifacts, and compliance assurance. Both require flow-down.

For those contractors that supply the MoD and DoD, you have to follow two cybersecurity processes. Both of which are required for contract award. Both require assurance and approval following different mechanisms.

One wonders how an organisation complies with both the DoD and MoD requirements; can reciprocity be agreed?

For those interested in reviewing the controls matrix for Def Stan 05-138, here it is. https://lnkd.in/eQB_jYH6

The MoD video is here. https://lnkd.in/e5Je9Pr6

https://lnkd.in/eqEuEAcC

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7393227828290531328