Source: https://cloud365.io/blog/defcon-658-supplier-checklist/ # DEFCON 658: A Practical Checklist for Defence Suppliers 4 November 2026 3 minute read By the cloud365.io team Updated 4 November 2026 If a defence customer mentions DEFCON 658, start by asking what applies to your contract, which cyber risk profile they have assigned and what evidence they need. A general certificate or a guessed level may not answer their request. This checklist helps you prepare that conversation. On this page ## What the terms mean The [MoD’s Cyber Security Model guidance](https://www.gov.uk/guidance/cyber-security-model) distinguishes the contract terms, technical controls and supplier assurance process: | Term | Plain-English meaning | | --- | --- | | DEFCON 658 | The contractual condition covering the Cyber Security Model | | Cyber Risk Profile | The profile assigned through the customer’s risk assessment | | Risk Assessment Reference (RAR) | A reference to the assessment associated with the requirement | | DEF STAN 05-138 | The standard setting out the required cyber controls | | DCC | Defence Cyber Certification: independent assurance at a stated level | DCC and Cyber Essentials have different purposes. Our [DCC levels guide](https://cloud365.io/blog/defence-cyber-certification-dcc/) explains how they fit together. ## Ask your customer these questions Use this as a meeting checklist. Record the answer, who confirmed it and anything still unresolved. - Which contract or supplier-onboarding request are we discussing? - What Cyber Risk Profile and assessment reference apply? - What DCC level and certification scope do you expect? - Which evidence must we provide, to whom and by what date? - What should we do if preparation identifies a gap? - Are there requirements we must pass to our own suppliers? A helpful opening message is: “We want to make sure we prepare against the right requirement. Please confirm the applicable profile, reference, evidence and date.” Keep commercially sensitive details within your agreed customer channels. ## Understand the certification evidence The [MoD’s March 2026 notice](https://assets.publishing.service.gov.uk/media/69cba72ba60a12ca3913c610/ISN_2026-02_Use_of_Defence_Cyber_Certification__DCC__as_assurance_of_control_requirements_under_DEFCON_658.pdf) explains how valid DCC certification at the appropriate level can provide evidence of relevant control requirements. It does not turn every certificate into evidence for every contract. For example, a supplier may hold a certificate but still need to confirm whether its assessed scope covers the organisation and activities the customer is asking about. Treat that as a question to resolve before promising a completion date. ## What to gather internally Create a short preparation sheet with your current certificates and expiry dates, business locations, key systems, existing IT provider and the person who can coordinate answers. Add the customer’s confirmed deadline and a list of open questions. This is a practical starting point for a scoping conversation, not the full assessment evidence list. Your certification body will confirm what it needs. Avoid uploading contracts, network diagrams or credentials into an initial public enquiry form. ## The December 2026 request The [MoD has asked industry partners to achieve DCC Level 0 by 31 December 2026](https://defencedigital.blog.gov.uk/2026/07/13/building-cyber-resilience-in-the-uk-one-step-at-a-time/). Confirm your own customer’s requirements as well: a higher level or an earlier date may apply to your situation. Our planning advice is to check the scope and availability now, then work backwards from the confirmed date. The time needed depends on existing controls, preparation work and assessor availability. We cannot guarantee certification or a date before those are understood. ## Get a useful next step Send the requested level, your team size, existing certificate status and the date needed. If the level has not been confirmed, say so. We can explain the preparation service and agree what needs checking next. [Discuss your DCC requirements](https://cloud365.io/start/?service=dcc), or see the [DCC service and pricing](https://cloud365.io/dcc-certification/). Cloud365’s published DCC packages have a three-year term invoiced yearly; check the scope and terms before agreeing a package. ## Common questions Is DEFCON 658 a certificate? No. It is a contractual condition. Confirm the evidence your customer needs and the appropriate certification scope and level. Should I choose a DCC level myself? Ask your customer to confirm the applicable requirement. Tell us if the level is still unknown so we can scope the next conversation appropriately. ## More guides [22 October 2026 11 minute read ### Defence Cyber Certification (DCC): Levels and Level 0 Guide Defence Cyber Certification explained for UK suppliers: the four levels, the MoD's Level 0 ask for 31 December 2026, who it affects and how to get certified. Read the guide](https://cloud365.io/blog/defence-cyber-certification-dcc/)[4 November 2026 3 minute read ### Cyber Essentials Renewal: When to Start and What to Check Plan your Cyber Essentials renewal with a practical checklist for certificates, devices, cloud services and changes since last year. Know what to prepare. Read the guide](https://cloud365.io/blog/cyber-essentials-renewal-checklist/)[4 November 2026 3 minute read ### Cyber Essentials Plus: How to Prepare for Your Assessment Get ready for Cyber Essentials Plus with a practical checklist for scope, devices, access and fixes. Understand what to agree before booking the assessment. Read the guide](https://cloud365.io/blog/cyber-essentials-plus-preparation-checklist/)