Show MoD your cyber posture is procurement-ready.

The buyer’s question. Who owns the supplier’s information security policy, when was it last reviewed, and where is the documented evidence of the governance forum that signed it off? An MoD assurance reviewer or a prime’s supplier-assurance team will not progress past Objective A unless this answer is concrete.

DS 05-138 reference. Clause 3 / Table 1 control 1100 (Governance) is the keystone of Objective A “Managing security risk”. It applies at Level 1, Level 2 and Level 3 and requires the supplier to hold management policies and processes governing the security of network and information systems and the protection of Data. Control 1102 names the accountable-owner obligation; Clause 2.4 requires that every control referenced in Clause 3 has a documented and implemented control in place with auditable evidence. Clause 1200 / 1202 then layers in the cyber security risk register and the periodic assessment cadence.

What counts as compliant. A documented and Board-endorsed Information Security Policy plus supporting standards / procedures. A named accountable owner — typically a CISO or equivalent — with a defined governance forum (Information Security Steering Group or equivalent) meeting on a documented cadence. An annual policy review at minimum, plus a re-review after any significant cyber security incident. A current cyber security risk register with a periodic re-assessment cadence baked in. All of it surfaced to the evidence pack so an assigned Authority can verify the governance state on demand.

What Secruna ships for governance. A tenant-level cyber posture artefact that records the supplier’s Information Security Policy state, the named accountable owner, the governance forum cadence and the last review date. A pre-filled governance section in the DS 05-138 evidence pack. A re-review reminder fired from the cadence schedule rather than from a spreadsheet someone forgot to maintain.

See this in your dashboard at: /inventory?framework=ds_05_138&control=1100 filtered to governance posture, with the policy review cadence tracked per tenant.

The buyer’s question. Where is MFA enforced today, where is it not, and what is the supplier doing about the gap before the next contract bid? Identity is the single most-checked control on supplier-assurance reviews because it is the cheapest control to fail and the most expensive incident to recover from.

DS 05-138 reference. Clause 3 / Table 1 controls 2201 and 2512 require MFA on critical / sensitive systems and on every remote access path at Level 2 and Level 3. Control 2317 layers in full-disk encryption on every endpoint at Level 1+. Controls 2315 and 2509 cover email authentication (DMARC + DKIM + SPF + managed filtering) at Level 1+. Control 2302 requires encrypted data-in-transit on every external channel at Level 2+. Control 2508 / 2507 layer in network segmentation with deny-by-default boundaries at Level 1+. Together these make up the access-control core of Objective B.

What counts as compliant. MFA enforced on every administrator account, every privileged role, every remote-access entrypoint and every system handling MoD-relevant Data. Full-disk encryption (AES-256 / FIPS) on every laptop, tablet and removable device. DMARC at `p=quarantine` or stronger, plus DKIM and SPF aligned, on every sending domain. TLS 1.2+ on every external channel. Network segmentation enforced with deny-by-default boundaries between corporate, OT, and MoD-relevant segments. All of it evidenced from the connector signal, not just the policy document.

What Secruna ships for access control. Read-only connectors against Microsoft 365 / Azure / Google Workspace that report MFA enforcement state per identity, Conditional Access posture, encryption state per endpoint, DMARC / DKIM / SPF state per domain, and segmentation posture across the network estate. A pre-filled access-control section in the DS 05-138 evidence pack. An exception register for the residual identities that cannot be MFA-enrolled, with the compensating controls documented per Issue 4 Clause 2.5.

See this in your dashboard at: /inventory?framework=ds_05_138&objective=B filtered to access-control posture, with per-identity MFA state and per-endpoint encryption state surfaced.

The buyer’s question. If an incident landed today, could the supplier reconstruct what happened from log data, and is that log data preserved in a place an MoD assurance reviewer or a prime would accept as tamper-resistant? “We have logs but they roll over after thirty days” is not a compliant answer.

DS 05-138 reference. Clause 3 / Table 1 control 3107 requires audit-log retention of at least 12 months, with offsite storage and a documented weekly review cadence — applies at Level 1+. Control 3102 imposes 24x7 continuous security monitoring with a SOC-shaped response function — applies at Level 3 only. Together these make up the core of Objective C “Detecting cyber security events”.

What counts as compliant. Audit logs retained for at least 12 months, stored offsite or in a tamper-resistant location, with a weekly review by a named role. Log coverage extends across identity events, endpoint events, network events and SaaS / cloud events touching MoD-relevant Data. At Level 3, a 24x7 monitoring capability — in-house SOC, MSSP, or hybrid — with a documented response runbook. Evidence of the weekly review actually happening (not just a calendar invite), and a documented escalation path when something suspicious is found.

What Secruna ships for audit + logging. A connector-level signal pattern that detects whether audit-log forwarding is configured against the major SaaS and cloud platforms, whether retention is set to 12+ months, and whether the weekly review evidence is attached to the tenant. An evidence-pack section that records the answer per control, with the source connector signal cited inline.

See this in your dashboard at: /inventory?framework=ds_05_138&objective=C filtered to audit-and-logging posture, with retention, offsite-storage and review-cadence state per source.

The buyer’s question. What is the supplier’s patch cadence, where are the unpatched systems, and when was the last independent test against the externally-facing estate? “We patch when we get round to it” is not a compliant answer at Level 1, never mind Level 3.

DS 05-138 reference. Clause 3 / Table 1 controls 2402 and 2405 require monthly vulnerability scans with CVSS v3-prioritised remediation at Level 1+. Control 2403 requires an annual penetration test against externally-facing systems at Level 1+. Cyber Essentials (Level 0+) and Cyber Essentials Plus (Level 2+) bracket the assurance side: self-assessed at Level 0, externally audited at Level 2+. Together these make up the core of Objective B “Protecting against cyber attack” on the proactive-testing side.

What counts as compliant. A monthly vulnerability scan covering the corporate estate, with findings triaged against CVSS v3 and remediated within a documented SLA. An annual penetration test against every externally-facing system, with findings tracked through to closure. Current Cyber Essentials at every profile; current Cyber Essentials Plus at Level 2+. A documented remediation tracker that the contracting authority can audit on request.

What Secruna ships for vuln-mgmt. Detection of vulnerability scanning posture across cloud connectors (Defender, AWS Inspector, Qualys, Tenable), the last-scan date per asset, and the open finding queue against CVSS thresholds. An evidence-pack section that cites the latest scan date and the remediation SLA per tenant. A reminder schedule that fires when a scan goes overdue or the annual pen test approaches.

See this in your dashboard at: /inventory?framework=ds_05_138&control=2402 with monthly-scan and pen-test cadence state surfaced alongside open findings.

The buyer’s question. Which subcontractors handle MoD-relevant Data, what Cyber Risk Profile do they sit at, and where is the supplier’s attestation that DS 05-138 has been flowed down to them? The prime contractor will audit the flow-down on every supplier-assurance review.

DS 05-138 reference. Clause 3 / Table 1 controls 1400 and 1401 require supply-chain attestation and DS 05-138 flow-down at Level 1+. The contractual hook is DEFCON 658 plus the Security Aspects Letter (Issue 4 Clause 2.8). The flow-down is unconditional — the prime contracting authority chooses the Cyber Risk Profile, and every tier below inherits the same control set unless an exception is documented and accepted under Clause 2.5.

What counts as compliant. A current register of every subcontractor handling MoD-relevant Data, with each one mapped to its Cyber Risk Profile and its current DS 05-138 attestation status. A documented flow-down clause in every relevant subcontract. Evidence that the supplier has obtained, reviewed and dated the attestation from each subcontractor — not just sent the clause and hoped. A re-review cadence so attestations do not silently expire between bid cycles.

What Secruna ships for supply chain. A supplier-register module that tracks third parties, their Cyber Risk Profile assignment, their attestation status and the next-review date. Reminder logic that fires when an attestation approaches expiry. An evidence-pack section that lists the supply-chain flow-down posture per contract, ready for the prime to audit.

See this in your dashboard at: /inventory?framework=ds_05_138&control=1400 with per-subcontractor attestation status and flow-down clause coverage surfaced.

The buyer’s question. If a cyber incident landed inside an MoD-relevant deliverable tomorrow, what is the supplier’s plan, who runs it, when was it last exercised, and what was learned? An incident-response plan that exists only in a Word document is a liability, not a control.

DS 05-138 reference. Clause 3 / Table 1 controls 4101 and 4103 require a documented incident-response plan with an annual exercise cadence at Level 2+. Controls 4104 and 4200 require an incident handling capability with a documented lessons-learned process at Level 1+. Together these make up Objective D “Minimising the impact of cyber security incidents”. Issue 4 also folds incident response into the governance review obligation under Clause 2.4 — every significant incident triggers a policy review upstream.

What counts as compliant. A documented incident-response plan covering identification, containment, eradication, recovery and post-incident review. A named on-call role and a documented escalation path to the Authority. An annual exercise — tabletop is the floor, not the ceiling — with exercise notes and actions tracked through to closure. A lessons-learned process that feeds the governance review. Evidence that the plan has actually been exercised, not just written.

What Secruna ships for incident response. A tenant-level posture artefact that records the IR plan version, the named on-call role, the last exercise date and the open lessons-learned actions. An evidence-pack section that cites the plan, the exercise log and the lessons-learned tracker. A reminder schedule that fires when the annual exercise approaches its due date.

See this in your dashboard at: /inventory?framework=ds_05_138&objective=D with IR plan, exercise cadence and lessons-learned state surfaced per tenant.