UK - Defence Standard 05-138 (2024) - L2

Level L2 is the moderate assurance tier of the Defence Standard 05-138 Cyber Security Model, applied to MOD contracts that carry a middling cyber risk. At this level the foundational hygiene expected at the lower tiers is no longer considered sufficient on its own, and suppliers must add further controls that address more capable or more determined threats.

The additional measures typically extend into areas such as stronger access and identity management, monitoring and logging, incident response readiness and supply chain assurance, building on the Cyber Essentials style baseline rather than replacing it. Suppliers are expected to evidence these controls through the assurance process and to maintain them across the life of the contract.