UK - Defence Standard 05-138 (2024) - L0

Level L0 is the lowest assurance tier within the Defence Standard 05-138 Cyber Security Model, applied to MOD contracts assessed as carrying the least cyber risk. It represents the entry point of the graduated model, where the work involves little or no sensitive defence information and the likelihood or impact of a cyber compromise is judged to be minimal.

At this tier the emphasis is on confirming that the contract genuinely falls into the lowest risk category and on maintaining basic good practice, rather than on implementing the heavier control sets required higher up the scale. Suppliers still complete the risk assessment process so that the L0 outcome is properly recorded, and they remain responsible for reassessing if the nature of the work changes.