Defence Cyber Certification is the assessment scheme. The Cyber Security Model (CSM) is the specification that DCC assesses against. They are two different things, and understanding the distinction matters if you are preparing for certification.
The current version is CSM v4, published in December 2025. It is the authoritative source for what an MOD supplier is actually required to implement at each DCC level. If you are preparing for DCC and you have not read CSM v4, you are working from secondary sources - including this guide, which is designed to orient you to the primary document, not to replace it.
This article explains what CSM v4 is, how it relates to DCC and to DEFSTAN 05-138, how its control families are organised, what changed from CSM v3, and what practical steps a supplier should take to use CSM v4 effectively during assessment preparation.
For the broader scheme context, see the DCC explainer and DCC levels guide.
CSM v4 is a control specification document. It lists the specific cybersecurity controls an MOD supplier must implement, organised by control family, mapped to the four Cyber Risk Profile tiers (Very Low, Low, Moderate, High), which in turn correspond to DCC Levels 0, 1, 2, and 3.
In its structure, CSM v4 is similar to other control frameworks you may have seen:
The difference is that CSM v4 is defence-specific. It includes controls relating to supply chain vetting, classification markings, MOD network integration, and incident reporting routes that are not present in civilian frameworks. It also explicitly maps each control to a DCC level, so a supplier can read CSM v4 and see exactly which controls apply to their contract.
DEFSTAN 05-138 is the MOD defence standard that sets out the cybersecurity requirements. CSM v4 is the operational model that implements those requirements. Think of DEFSTAN 05-138 as the "what" and CSM v4 as the "how".
Practically, CSM v4 is what you actually read during certification preparation. DEFSTAN 05-138 is referenced by CSM v4 where relevant but is a more formal policy-level document that most suppliers do not need to engage with directly. The IASME-licensed assessor assesses against CSM v4; the assessor's findings are framed in CSM v4 language.
CSM v4 defines four tiers of control requirement:
At each level, CSM v4 specifies controls across around a dozen control families (the exact number varies by version). Each control has an identifier, a description, the level(s) at which it applies, and typically a reference to the underlying DEFSTAN 05-138 requirement.
CSM v4's control families cover the standard cybersecurity domains plus defence-specific additions. The main families:
L0 requires a subset of these controls; L1 adds more; L2 adds most of the remaining; L3 requires the full set with maturity expectations.
CSM v3 was the baseline through most of 2024 and early 2025. CSM v4 (December 2025) introduced several material changes:
If your organisation prepared against CSM v3 and has not re-reviewed under v4, the gap analysis should include these five areas specifically.
A practical workflow for using CSM v4 during DCC preparation:
For a consolidated readiness list derived from CSM v4, see the DCC requirements checklist.
Annual attestation under DCC (see DCPP-to-DCC transition) is conducted against the current version of CSM at the attestation date. If CSM v5 is published during your three-year certificate period, your annual attestation may need to address v5-specific controls that were not in v4 at original certification. This is a known feature of the scheme, not a quirk, and is why suppliers should track MOD/IASME communications on CSM updates.
Fig's consultants work through CSM v4 with every client during scoping. The control-by-control walkthrough is the most efficient way to identify gaps, plan remediation, and structure evidence collection. The Fig technology platform automatically maps machine-generated evidence (configuration state, patch state, access control state) to the relevant CSM v4 control IDs, which reduces the manual evidence assembly burden on the client and gives the assessor a direct control-to-evidence trace.
For suppliers new to the scheme, this structural discipline is often the difference between a clean first-pass assessment and a cycle of clarification requests.
Key questions from MOD suppliers researching this topic.
The Cyber Security Model is the MOD specification that defines the technical and organisational cybersecurity controls expected of defence suppliers. It is the specification that DCC assesses against. The current version is CSM v4, published December 2025.
DEFSTAN 05-138 is the underlying defence standard that sets cybersecurity requirements. CSM v4 is the practical model that translates DEFSTAN 05-138 into the specific controls a supplier must implement at each DCC level. They work together - DEFSTAN sets the requirements, CSM operationalises them.
CSM v4 is available to suppliers through the MOD procurement process and via IASME for suppliers engaging with DCC. It is not a fully open public document in the way NCSC Cyber Essentials materials are, but it is accessible to any legitimate defence supplier.
Yes. CSM v4 defines the control requirements at each of the four levels. L0 has a subset of CSM v4 controls; L1 has more; L2 adds further controls; L3 has the full set plus the highest maturity expectations.
CSM has been revised approximately every two to three years. v4 (December 2025) is the current version. Suppliers should expect v5 within a three-to-five-year horizon and monitor MOD/IASME communications for transition timing.
Defence Cyber Certification is the UK MOD's new independent cybersecurity certification framework for its supply chain. It replaces the self-assessed Supplier Assurance Questionnaire approach under the old DCPP. This guide explains how DCC works, who needs which level, and what the transition from DCPP means for existing suppliers.
DCC Level 0 inherits the five Cyber Essentials technical controls and layers defence-specific governance on top. This guide breaks down each control, the specific evidence an IASME-licensed assessor expects, common configuration mistakes, and how the controls map to the CSM v4 requirements behind L0.
On the Defence Cyber Certification scheme's first birthday, the UK Defence CISO Eleanor Fairford has asked all MOD suppliers to achieve DCC Level 0 certification by 31 December 2026. This guide explains what the mandate covers, where it sits in the wider government supply chain Cyber Essentials programme, and the practical timeline suppliers now need to work to.