Defence Industrial Base Cyber Rules: CMMC, DFARS and DEFSTAN 05-138 Compared

Suppliers that sell to both the US Department of Defense and the UK Ministry of Defence face two cyber regimes with different scopes, different control sets and different assurance routes, and treating one as a proxy for the other leaves gaps on both sides. This regulatory map compares the US rules (DFARS 252.204-7012, DFARS 252.204-7021 and the CMMC programme) with the UK rules (DEF STAN 05-138 Issue 4, DEFCON 658 and the Cyber Security Model, including Defence Cyber Certification). It sets out who is covered, what each regime requires, where each stands as checked on 8 November 2026, how each is enforced, and what both mean for service accounts, automation credentials and AI agents. It is written for compliance leads, CISOs and security engineers at primes and subcontractors on either side of the Atlantic. For running the US obligations as one programme, see the Defence Industrial Base Cybersecurity Programme Guide.

Key takeaways

• The US protects information; the UK protects the enterprise. DFARS and CMMC apply to systems that process federal contract information or controlled unclassified information, while DEF STAN 05-138 Issue 4 scopes the supplier's whole corporate environment.
• CMMC is live but paused in Phase I. Phase I began on 10 November 2025; on 13 July 2026 the Department announced the immediate suspension of Phase II, and Phase I self-assessment requirements remain in place.
• DFARS 252.204-7012 never paused. NIST SP 800-171, 72 hour incident reporting, FedRAMP Moderate equivalent cloud and subcontractor flowdown still apply whatever happens to CMMC.
• The UK moved to four numbered levels. Cyber Security Model version 4 went live for new procurements from 3 December 2025, with cyber risk profiles Level 0 to Level 3 mapped to 3, 101, 139 and 144 controls in DEF STAN 05-138.
• Both name service accounts explicitly or implicitly. DEF STAN 05-138 control 2217 requires each service account to be owned by a single named individual; NIST SP 800-171 account and authenticator requirements cover every system account, not only people.

Regulations and frameworks at a glance

Scope: who and what is covered

United States

DFARS 252.204-7012 applies to covered contractor information systems that process, store or transmit covered defense information, and to subcontracts for operationally critical support or involving covered defense information. DFARS 252.204-7021 applies when a contract names a CMMC level: the contractor may only process federal contract information (FCI) or controlled unclassified information (CUI) on systems holding the required CMMC status, and must flow the correct level to subcontracts, except those for commercially available off-the-shelf items. Scope is therefore drawn around the information and the systems and people that touch it, which is why enclaves are a common cost-control strategy. See the CMMC Scoping Guide.

United Kingdom

The MOD describes DEF STAN 05-138 Issue 4 as applying to all MOD procurements, MOD suppliers and their subcontractors with a relationship to one or more MOD contracts. Clause 1.1 sets the scope as the supplier's overarching corporate or enterprise environment: the organisations, systems, processes and data needed to protect MOD data and functions. Clause 1.4 makes the controls a minimum, and a Security Aspects Letter can require more. The contract-specific level comes from a risk assessment completed by the MOD delivery team, which produces a cyber risk profile and, under CSMv4, a Risk Assessment Reference. Subcontractors complete their own risk assessment when work flows down, and the Cyber Security Model guidance states that suppliers are responsible for flow down.

Key obligations

DFARS 252.204-7012

• Adequate security: NIST SP 800-171 as in effect when the solicitation is issued, with variances requested in writing through the contracting officer for DoD CIO consideration.
• Incident reporting: report cyber incidents within 72 hours of discovery through the DIBNet portal (dibnet.dod.mil), which needs a DoD-approved medium assurance certificate.
• Evidence: preserve images of affected systems and relevant monitoring and packet capture data for at least 90 days from the report, submit isolated malware to the DoD Cyber Crime Center (DC3) and give DoD forensic access on request.
• Cloud: external cloud providers handling covered defense information must meet requirements equivalent to the FedRAMP Moderate baseline and the clause's reporting and forensic terms.

DFARS 252.204-7021 and CMMC

• Level 1: 15 requirements from FAR 52.204-21, self-assessed annually with results in the Supplier Performance Risk System (SPRS), annual affirmation, no POA&M.
• Level 2: 110 requirements from NIST SP 800-171 Rev. 2, self-assessed or C3PAO-assessed every three years with annual affirmation; POA&Ms are allowed under 32 CFR 170.21(a)(2) but must be closed within 180 days.
• Level 3: assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) and adds selected enhanced requirements; see the NIST SP 800-172 Rev 3 Guide.
• Status validity: under the clause, conditional status may be no older than 180 days, final Level 1 no older than one year, final Level 2 and Level 3 no older than three years, and affirmations no older than one year.
• Reporting: give the contracting officer the CMMC unique identifiers issued in SPRS and any changes to them during the contract.

DEF STAN 05-138 Issue 4 and DEFCON 658

• Controls by level: Level 0 has 3 controls, Level 1 has 101, Level 2 has 139 and Level 3 has 144, grouped under four objectives (A to D) with four-digit control numbers.
• Cyber Essentials as a floor: control 0001 (Cyber Essentials) applies at every level; control 0002 covers Cyber Essentials Plus. See the Cyber Essentials Guide.
• Self-assessment and improvement plans: suppliers answer a Supplier Assurance Questionnaire through the Supplier Cyber Protection Service, scored automatically under CSMv4, repeated on each contract anniversary. A supplier that cannot comply submits a Cyber Improvement Plan, which becomes part of the contract.
• Deviations: clause 2.5 requires deviations from specified controls to be documented and flagged to the Authority at bid or as soon as identified.
• Operational cadence: examples include weekly log review (3107), monthly vulnerability scans (2402), annual penetration testing (2403), annual response plan exercises (4103) and lessons learned applied within 30 days of root cause analysis (4200).
• Incident reporting: the Issue 3 incident reporting clause was removed from the standard because it duplicated DEFCON 658, so reporting obligations come from the contract condition and Security Aspects Letter. See the Cyber Incident Reporting Requirements Map.

Timeline and current status

Two status points need care. First, the DoD CIO page states that during the pause NIST SP 800-171 Rev. 2 compliance is enforced through self-assessments and select government-led assessments, and gives no end date for the review, so plan as if third-party Level 2 requirements will return. Second, the Cyber Security Model guidance (last visibly updated 6 March 2026) says DCC holders are not yet exempt from completing elements of the questionnaire, while the later ISN 2026/02 tells buyers to treat a supplier with a valid DCC at the required level or higher as meeting the control requirement. Expect to hold DCC and still complete the questionnaire where your delivery team asks. Recheck both sources before any bid.

Enforcement and penalties

United States: the clauses are enforced through contract remedies (award eligibility, since CMMC status is a condition of award where required) and, for false representations of compliance, through the False Claims Act. Two 2025 Justice Department settlements show the pattern. On 26 March 2025 MORSECORP agreed to pay $4.6 million; the department said the company reported an SPRS score of 104 in January 2021 when a consultant later put it at -142, and used an email host that did not meet FedRAMP Moderate equivalent requirements. On 1 May 2025 Raytheon companies and Nightwing agreed to pay $8.4 million to resolve allegations that an internal development system used on 29 DoD contracts and subcontracts lacked required controls under DFARS 252.204-7012 and FAR 52.204-21 and had no system security plan; the department noted these were allegations without a determination of liability. Annual CMMC affirmations of continuous compliance in SPRS raise the stakes of inaccurate entries.

United Kingdom: DEF STAN 05-138 is enforced contractually through DEFCON 658: a supplier that does not meet its profile must agree a Cyber Improvement Plan that becomes part of the contract, and deviations must be declared. The published MOD material does not set statutory fines for these controls; consequences sit in contract management, procurement eligibility and the Security Aspects Letter.

What it means for AI agents and non-human identities

Neither regime has a separate chapter for machine identities, but both reach them through account, authenticator and privilege controls. The mapping below shows where.

AI agents with access to CUI are part of the CMMC assessment scope as users or processes acting on behalf of users, and inside the enterprise scope under DEF STAN 05-138. Give each agent its own identity, a named owner and credentials stored in a vault; never let an agent reuse a human engineer's credentials, which breaks attribution and makes the 7012 compromise review impossible. The Poland ArcGIS password leak shows how one emailed password to a military mapping database stayed valid for about three years without rotation or MFA. See the Defence Industrial Base Identity Security Guide and the Service Account Security Guide.

Compliance steps

1. Inventory contracts and clauses. List every DoD contract with 7012 and 7021 (and the level named) and every MOD contract with DEFCON 658, its Risk Assessment Reference and cyber risk profile.
2. Draw both boundaries. Define the CUI and FCI boundary for US work and the enterprise boundary for UK work. Where the same tenant serves both, the stricter combined control set applies to shared services such as identity, email and endpoint management.
3. Build one control crosswalk. Map NIST SP 800-171 Rev. 2 requirements to DEF STAN 05-138 controls at your highest UK level. The MOD publishes a mapping document for Issue 4 (September 2024) against NIST SP 800-171 Rev. 3, NIST CSF 2.0, Cyber Essentials, ISO/IEC 27001:2022 and other frameworks; because CMMC Level 2 still uses Rev. 2, check each mapped line and record gaps both ways.
4. Close identity gaps first. Named owners for service accounts, MFA for remote and privileged access, vaulted administrator credentials with quarterly review, and per-agent identities. These controls appear in both regimes and in most findings.
5. Assess and record. Enter SPRS scores and CMMC affirmations accurately; complete the Supplier Assurance Questionnaire in the Supplier Cyber Protection Service; raise a Cyber Improvement Plan or POA&M for anything unmet rather than overstating.
6. Decide on certification. For UK work, weigh DCC at the level your contracts require against questionnaire-only assurance. For US work, prepare for a C3PAO assessment even during the Phase II suspension. See the CMMC 2.0 Level 2 Assessment Guide.
7. Rehearse incident reporting. Test the 72 hour DIBNet path (with a valid medium assurance certificate) and the DEFCON 658 route in one exercise, including evidence preservation for 90 days.
8. Flow down and monitor. Flow the right clauses and levels to subcontractors, collect their affirmations or questionnaire outcomes before award, and recheck annually.

Small suppliers with one MOD contract at Level 0 or Level 1 and Level 1 CMMC work can often meet both with Cyber Essentials Plus plus the FAR 52.204-21 basics. Primes with Level 2 or 3 profiles on both sides gain most from a single crosswalk, one evidence repository and one identity platform.

Common failure patterns

• Assuming CMMC is dead. The Phase II suspension does not remove 7012, Phase I self-assessments or annual affirmations.
• Overstating SPRS scores. A score that does not reflect reality is the fact pattern behind recent False Claims Act settlements.
• Scoping the UK like the US. An enclave that satisfies CMMC does not satisfy DEF STAN 05-138, whose scope is the whole enterprise.
• Unowned service accounts. Control 2217 and NIST account management both fail where nobody owns a shared automation account.
• Cloud email outside requirements. Using a provider without FedRAMP Moderate equivalence for covered defense information breaks 7012.
• Treating DCC as a full exemption. Certification helps, but the questionnaire and Security Aspects Letter still apply where the MOD asks.

Practitioner checklist

• Record each contract's clauses, CMMC level and UK cyber risk profile in one register.
• Confirm 7012 obligations are met today: NIST SP 800-171, 72 hour reporting, certificate, cloud equivalence.
• Keep SPRS scores and CMMC affirmations accurate and reviewed by someone who understands the evidence.
• Complete the CSMv4 Supplier Assurance Questionnaire on each contract anniversary.
• Maintain a NIST SP 800-171 to DEF STAN 05-138 crosswalk with gaps in a POA&M or Cyber Improvement Plan.
• Assign a named owner to every service account, API key and AI agent identity.
• Vault administrator credentials and review them quarterly.
• Exercise US and UK incident reporting together at least annually.
• Flow down clauses and verify subcontractor status before award.
• Recheck the DoD CIO CMMC page and MOD ISNs before each bid.

Standards and references

• eCFR: DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
• eCFR: DFARS 252.204-7021 Contractor Compliance with the CMMC Level Requirements
• DoD CIO: About CMMC
• Ministry of Defence: Cyber Security for Defence Suppliers (Def Stan 05-138 Issue 4)
• Ministry of Defence: Cyber Security Model
• Ministry of Defence: ISN 2026/02 Use of Defence Cyber Certification under DEFCON 658
• US Department of Justice: Raytheon Companies and Nightwing Group settlement
• US Department of Justice: MORSECORP settlement

This guide summarises US and UK defence supplier cyber security rules for security practitioners and is not legal advice; confirm obligations with your legal and contracts teams and the primary texts. Related NHI Mgmt Group resources: Defence Industrial Base Identity Security Guide · DFARS 252.204-7012 Guide · NIST SP 800-171 and CMMC 2.0 Guide · IASME Cyber Assurance