MoD – Def Stan Level 2 - Parava Security Solutions

Def Stan 05-138 Cyber Security Profile Level-2

MoD DSC Model (CSMv4), Cyber Security Profile Level-2

Def Stan 05-138 Level 2 (Advanced) is part of the UK Ministry of Defence’s Cyber Security Model (CSM), designed for suppliers assessed as presenting a high level of cyber risk when delivering contracted outputs. It requires organisations to demonstrate advanced cyber security oversight, planning and management, supported by robust organisational and technical security practices. Level 2 comprises 139 cyber security controls, covering four key objectives: managing security risks, protecting against cyber attacks, detecting cyber security events, and minimising the impact of security incidents.

The requirements extend beyond the protection of MOD information to encompass the supplier’s entire corporate environment, including its people, systems, processes, infrastructure and supply chain. Key requirements include board-level security accountability, formal risk management, automated asset management, multi-factor authentication, privileged access management, encryption, vulnerability management, annual penetration testing, network segmentation and secure system configurations. Level 2 also places greater emphasis on security assurance, requiring organisations to monitor control effectiveness, maintain comprehensive audit logs, proactively identify malicious activity and demonstrate tested incident response and recovery capabilities. Recovery plans must be tested at least annually.

Organisations must have documented and implemented controls supported by auditable evidence. Level 2 therefore represents a significant step beyond foundational cyber security, requiring a proactive, risk-led approach to protecting defence supply chains, sensitive information and business operations.

Def Stan 05-138 Level 2 (‘Advanced’) – 139 controls (98 Level 0, Level 1 controls plus and additional 41 Level 2 Controls)

Def Stan 05-138 Level 2 (‘Advanced’) – Additional Level 2 Controls

ControlID	Control Name	Control Requirement
0002	Cyber Essentials Plus	The Supplier shall have Cyber Essentials Plus certification that covers the scope required for all aspects of the contract and commit to maintaining this for the duration of the contract.
1101	Board direction	The Supplier shall have effective organisational security management led at board level and articulated clearly in corresponding policies.
1103	Decision-making	The Supplier shall have senior-level accountability for the security of networks and information systems, and delegates decision-making authority appropriately and effectively. Risks to network and information systems that protect all Data are considered in the context of other organisational risks.
1201	Risk management process	The Supplier shall have effective internal processes for managing risks (to the security of network and information systems that protect all Data) and communicating associated activities and solutions.
1205	Assurance	The Supplier shall gain validation for the effectiveness of the security of their technology, people, and processes in support of its Functions and which store and/or process Data.
1206	Internal controls assurance	The Supplier shall monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. Any identified deficiencies should be recorded, reported to leadership, and mitigated within agreed timeframes.
1301	Automated asset inventory	The Supplier shall employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of data, people, systems and supporting infrastructure used to support business Functions and protect Data.
2101	Policy and process	The Supplier shall implement security policies and processes that demonstrate the continuing security benefits to Functions and Data.
2201	Access control – multi-factor	The Supplier shall implement multi-factor authentication (MFA) mechanisms to control access to critical or sensitive systems, and organisational operations. Factors can include: i) Something you know (e.g. password/personal identification number (PIN)) ii) Something you have (e.g. cryptographic identification device, token) iii) Something you are (e.g. biometric).
2202	Device management	The Supplier shall fully understand and trust the devices that are used to access the network and information systems that support Functions and process Data.
2203	Privileged user management	The Supplier shall closely manage privileged user access and actions to networks and information systems supporting Functions and that protect Data.
2208	Identity and Access	The Supplier shall closely manage and maintain identity and access control for users/admins, devices and systems accessing their networks and information systems supporting business Functions and protecting all Data.
2212	Automated password	The Supplier shall employ automated mechanisms for the generation, protection, storage, rotation, transmission, cryptographic protection and management of passwords for staff and systems.
2216	Privilege failure handling	The Supplier shall prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
2301	Understanding data	The Supplier shall have a good understanding and classification of the data important to the operation of Functions and protection of Data, including where it is stored, where it travels, the application of protective markings to media. The Supplier shall understand how unauthorised access, modification or availability of data would adversely impact the organisation. This shall apply to data released to third parties including those important to the operation of Functions and protection of all Data.
2302	Data in transit	The Supplier shall protect and control data in transit, including the use of encryption where appropriate, for data important to the operation of the Functions and all Data. This includes the transfer of data to third parties.
2308	Stored data	The Supplier shall appropriately protect the confidentiality of soft and hard copies of data being stored for all Functions.
2309	Mobile data	The Supplier shall protect, such as through encryption, data important to the operation of Functions and all Data on mobile devices.
2313	Media/equipment sanitisation	The Supplier shall appropriately sanitise before reuse and / or disposal the devices, equipment, and removable storage media & devices holding data important to the operation of business Functions and that protect all Data.
2320	Data Loss Prevention (DLP)	The Supplier shall implement and maintain appropriate tooling to monitor and restrict the access and use of: i) Removable storage media and devices ii) External websites iii) Email
2406	Privacy warning notices – prior to	The Supplier shall ensure that mechanisms are in place to ensure users accept appropriate warning notices prior to information system access. At a minimum users must be warned that: i) Use of the information system is monitored, recorded and subject to audit ii) Unauthorised usage of the information system is prohibited iii) Unauthorised usage of the information system use is subject to criminal and civil penalties iv) In continuing, the user affirms consent to monitoring and recording of their activities
2416	Shared system resources	The supplier shall prevent unauthorised and unintended information transfer via shared system resources (e.g. registers, cache memory, main memory, hard disks).
2424	Implement audit for stored	The Supplier shall ensure administrator credentials are stored through an approved and secured storage mechanism (process/location/tools etc.) and quarterly audits are performed to ensure the control is consistently applied and functions appropriately.
2430	External system connection review	The Supplier shall promptly remove or disable unnecessary firewall rules when they are no longer required or fulfil no business need.
2503	Resilience preparation with testing	The Supplier shall develop recovery plans for all systems that deliver Functions and protect Data. Recovery plans must also be tested at least annually with any deficiencies being recorded, risk assessed and resolved within defined timelines.
2505	Resilient backups	The Supplier shall hold accessible and secured current backups of data and information needed to recover operation of their Functions and protect Data. Backup procedures and media shall include: i) Appropriate encryption technology ii) Integrity validation iii) Secure offsite storage supporting availability requirements iv) Regular backup recovery testing.
2506	Physical transport of backups	The Supplier shall protect the physical movement of media containing Data in transit using the following methodologies: i) Store backup media within a secured and locked container prior to transport. ii) Utilise a certified backup courier to transport backup drives/tapes. iii) Maintain a full chain of custody record. iv) Ensure that tracking information is recorded for all drives being transported. v) Implement appropriate cryptographic mechanisms to protect confidentiality.
2601	Cyber security culture	The Supplier shall develop and maintain a positive cyber security culture which encourages employees to make information security part of their day-to-day activities and incentivises them for doing so.
2602	Cyber security training	The Supplier shall ensure that people who support the operation of Functions and protection of Data are appropriately trained in cyber security. The Supplier shall conduct awareness training at least every 12 months to recognise and respond to the following topics: i) Social engineering and phishing ii) Advanced persistent threats iii) Suspected breaches iv) Suspicious behaviours. A range of approaches to cyber security training, awareness and communications shall be employed and the Supplier shall update the training every 12 months or when there are significant changes to the threat.
2605	Annual threat focused training	The Supplier shall conduct practical exercises in awareness training for their organisation that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.
3103	Securing logs	The Supplier shall hold logging data securely and grant read access only to accounts with business needs. The Supplier shall protect audit tools from unauthorised access, modification and deletion. Logging data shall be retained and protected from deletion to a documented retention period, after which it shall be deleted.
3104	Security event triage	The Supplier shall provide evidence from their monitoring tool of security incidents to verify the reliability of identified and triggered alerts for triage.
3105	Identifying security incidents	The Supplier shall contextualise alerts with knowledge of the threat and their systems, and engage Incident Response when an incident (confirmed or otherwise) is identified.
3106	Monitoring tools and skills	The Supplier shall ensure that monitoring staff skills, tools and roles, including any that are outsourced, reflect governance and reporting requirements, expected threats and the complexities of the network or system data they need to use. Monitoring staff have contextual knowledge of the Functions and requirements for the protection of Data.
3110	Monitor alerts/advisories and vulnerabilities	The Supplier shall monitor system security alerts and advisories and take action in response.
3202	Proactive attack discovery	The Supplier shall implement reasonable and proportionate measures to detect malicious activity affecting, or with the potential to affect, the operation of Functions and protection of Data.
4101	Response plan	The Supplier shall have an up-to-date incident response plan that is grounded in a thorough risk assessment that takes account of business Functions and protection of Data and covers a range of incident scenarios.
4102	Response and recovery	The Supplier shall have the capability to enact their incident response plan, including effective limitation of impact on the operation of Functions and protection of Data. During an incident, the Supplier shall enact processes and capabilities to provide access to information sources on which to base their response decisions to coordinate incident handling activities with contingency planning activities.
4103	Testing and exercising	The Supplier shall carry out exercises to test response plans at least every 12 months, using past incidents that affected their (and other’s) organisation, and scenarios that draw on threat intelligence and risk assessments.
4105	Exfiltration tests	The Supplier shall conduct data exfiltration tests at the network boundaries at least every 12 months. These tests must be conducted against both authorised and covert channels.
4201	Business Continuity Risk	The Supplier shall perform Business Continuity Risk Assessments to determine relevant risks, threats, and likelihood & impact of a service outage or Data Breach. The Supplier shall record the output of these Risk Assessments within a risk register along with the required controls and/or procedures to mitigate or remove the risk and/or threat.