UK - Defence Standard 05-138 (2024) - L3

Level L3 is the highest assurance tier in this set of the Defence Standard 05-138 Cyber Security Model, applied to MOD contracts assessed as carrying the greatest cyber risk. It is intended for work involving the most sensitive defence information or the greatest potential impact from compromise, and it demands the most extensive and rigorous set of controls in the framework.

At this tier suppliers are expected to demonstrate mature, defence-in-depth security spanning technical controls, governance, continuous monitoring, robust incident response and thorough supply chain assurance, building on every lower tier. The level of scrutiny and the expectation of demonstrable, well-managed protection are correspondingly high, and controls must be sustained and reviewed throughout the contract.