DEFCON STATUS MOD

Suppliers who require RA or SAQ documentation should contact the DCPP team. If the Cyber Risk Profile is ‘High’, prime contractors must complete a RA for their sub-contractors and sub-contractors must continue this flow down throughout the supply chain until the Cyber Risk Profile is no longer ‘High’. If the Cyber Risk Profile is above ‘Not Applicable’ and the tender documentation includesĭEFCON 658, suppliers will be notified that the SCPS Tool is not available and the interim process, hosted on the DCPP Gov.uk page, must be followed until further notice.

DEFCON STATUS MOD

Where suppliers are taking part in a MOD tendering exercise which commenced after the 4th June 2021, they will be provided by MOD with the Cyber Risk Profile for the tendered contract. The questions and scoring methods for the interim SAQ methods remain unchanged. If you completed the SAQ using the interim process, a copy of this should be submitted with your tender, along with an email from DCPP confirming the SAQ result and, if appropriate a CIP. If you have completed the tender process using the SCPS tool prior, you should send a copy of the competed SAQ and, if appropriate, CIP with your tender response. If the Cyber Risk Profile is assessed to be ‘High’ prime contractors must complete a RA for their sub-contractors and sub-contractors must continue this flow down throughout the supply chain until the Cyber Risk Profile is no longer ‘High’. The detail of the interim process is hosted on the DCPP Gov.uk page where Defence Suppliers would usually access the SCPS Tool. Where you are taking part in a MOD tendering exercise which commenced prior to 4th June 2021, you may follow the interim process if an SAQ has not already been completed and a copy downloaded from the SCPS tool. Please note Suppliers must still flow down DEFCON 658 in sub-contracts in accordance with DEFCON 658 Clause 3.1. This contractual obligation will be paused for all contracts containing DEFCON 658. Suppliers should allow a minimum of two working days for the result to be issued, noting that a non-compliant result will require the preparation of a Cyber Implementation Plan (CIP).ĭEFCON 658 requires contractors to renew the SAQ annually. The SAQ result will be provided by the DCPP team via email. The SAQ will be completed using either MS Forms (preferred) or a PDF. Where the MOD RA is ‘High’, DCPP will provide the required RA documentation. This contractual obligation will be paused for all contracts, where sub-contracts have not yet been placed, except those where the MOD RA results in a ‘High’ Cyber Risk Profile. However, MOD wishes to make UK Defence Suppliers aware of some changes to the process until a replacement tool is available:ĭEFCON 658 requires contractors to flow down the RA/SAQ process for any sub-contracts.

The interim process is similar to the SCPS process for the most part. The purpose of this ISN is to make Industry aware of the interim process and provide guidance on the operation of DEFCON 658 and the Cyber risk processes to be followed until further notice. This ISN does not supersede or supplement any others. The interim process is explained in more detail on the DCPP Gov.uk web page. With effect from 12:00 4th June 2021 the SCPS tool was replaced with an interim process whilst a new tool is developed by Defence Digital. RAs and SAQs are completed on MOD’s Supplier Cyber Protection Service (SCPS) tool (aka “Octavian”). Where contracts contain DEFCON 658, tenderers are required to complete a Supplier Assurance Questionnaire (SAQ) as part of their tender response and, if awarded the contract, the SAQ must be renewed annually by the supplier. DEFCON 658 must be included in all MOD contracts with a Cyber Risk Profile higher than ‘Not Applicable’. To determine the Cyber Risk Profile in all MOD contracts, the MOD completes a Risk Assessment (RA) for each MOD contract.

Defcon status