Cyber Security Model (Issue 4)

Stage 1

MOD Contracting – This is essentially the procurement stage where a suitable supplier is identified through a commercial tendering process to provide/deliver a Product, Service or Solution (PSS) MOD has a need for. As part of this process, a risk assessment is undertaken (A Risk Assessment Reference (RAR) number is generated) which identifies a Cyber Risk Profile (CRP) level, as detailed in DEFCON 658. There are 4 levels – 0, 1, 2 or 3 and with each level are a set of security controls which the successful bidder MUST apply to their corporate network systems to reduce the Cyber risk, they may otherwise pose to MOD.

To demonstrate their conformance to the identified CRP level for the contract, the Tier 1 Prime supplier MUST complete a Supplier Assurance Questionnaire and where they are unable to demonstrate conformance, a Cyber Improvement Plan must be submitted for the contracting authorities review and acceptance. Provided the SAQ and CIP are accepted, contract award can take place.

Stage 2

Classified information i.e. OFFICIAL, OFFICIAL-SENSITIVE, SECRET and TOP SECRET is dealt with slightly differently from a policy perspective, although some of the controls to secure Classified information may be achieved through implementation of DefStan 05-138 controls. However, be aware additional controls may be required.

Instructions and guidance for securing and managing Classified information are contained in the Security Aspects Letter (SAL) related to the contract as well as Defence Conditions (DEFCONs). For OFFICIAL-SENSITIVE information, DEFCON 660 applies and for SECRET information, DEFCON 659A applies.

If in doubt, discuss this with the Senior Responsible Owner (SRO) for the contract.

Stage 3

Apply DefStan 05-138 controls – DefStan 05-138 (issue 4) details the security controls which must be applied to a suppliers corporate network environment for each of the four CRP levels.

Stage 4

Need to sub-contract – It is likely, a decision to sub-contract will need to be made to fill gaps in the Prime contractors delivery capability. If there is no need to sub-contract then delivery may commence.

Stage 5

Sub-contracting – Where a need to sub-contract has been identified, the Prime Contractor will need to undertake their own risk assessment and generate a Risk Assessment Reference (RAR) for their sub-contractors to use when their sub-contractors come to complete their own Supplier Assurance Questionnaires (Stage 5). The risk assessment undertaken by the Prime contractor will produce a CRP Level that sub-contractors must conform to.

Stage 6

SAQ and CIP completion – Sub-contractors receive their CRP Level for the contract from the Prime Contractor. Sub-Contractors are required to complete their own SAQ and where applicable complete their own CIP for the areas they are non conformant with.

Stage 7

Review of SAQ and CIP Responses – The Prime contractor reviews the Sub-Contractors SAQ and CIP responses and provided these are accepted, contracts are awarded to the Sub-Contractors. DefStan 05-138 issue 4 controls, relevant to the delegated CRP level, are then applied to the Sub-Contractors network infrastructure.

Note - These controls are separate to any Secure by Design controls which may need to be applied to the PSS components they are contracted to deliver. Secure by Design is a separate assurance process.

Stage 8

Review of SAQ and CIP Responses – The Prime contractor reviews the Sub-Contractors SAQ and CIP responses and provided these are accepted, contracts are awarded to the Sub-Contractors. DefStan 05-138 issue 4 controls, relevant to the delegated CRP level, are then applied to the Sub-Contractors network infrastructure.

Note - These controls are separate to any Secure by Design controls which may need to be applied to the PSS components they are contracted to deliver. Secure by Design is a separate assurance process.

Stage 9

Do Sub-Contractors need to Sub-Contract – In some instances, Sub-Contractors may need to Sub-Contract parts of the manufacturing/production process.

If no further Sub-Contracting is required, proceed to delivery (Stage 14)

Stage 10

Further Sub-Contracting – Where the Sub-Contractor requires to undertake further Sub-Contracting, they must undertake their own Cyber Security Model Risk Assessment to identify a CRP Level for their own Sub-Contractors.

Stage 11

SAQ and CIP completion – Sub-contractors receive their CRP Level for the contract from the Tier 2 Sub-Contractor. Sub-Contractors are required to complete their own SAQ and where applicable complete their own CIP for the areas they are non conformant with.

Stage 12

Review of SAQ and CIP Responses – The Tier 2 Sub-Contractor reviews the Sub-Contractors SAQ and CIP responses and provided these are accepted, contracts are awarded to the Sub-Contractors.

Stage 13

Review of SAQ and CIP Responses – The Tier 2 Sub-Contractor reviews the Sub-Contractors SAQ and CIP responses and provided these are accepted, contracts are awarded to the Sub-Contractors.

Stage 14

Security Controls applied - DefStan 05-138 issue 4 controls, relevant to the delegated CRP level, are then applied to the Sub-Contractors network infrastructure.

Is additional Sub-Contracting required? – If additional sub-contracting to Tier 4 Sub-Contractors is required, Stages 9 to 13 are repeated. If no further Sub-Contracting is required, then delivery (Stage 14) commences.

Stage 15

Delivery - If no further Sub-Contracting is required then delivery (Stage 14) commences. The DefStan 05-138 (issue 4) CRP Level controls are maintained, reviewed and managed through to contract completion. Annual confirmation that CSM compliance is being maintained, is required by the Contracting Authority SRO.

Stage 16

Completion – The DefStan 05-138 (issue 4) CRP Level controls are maintained, reviewed and managed through to contract completion.