Interim process for the Supplier Cyber Protection service

We are making some changes to the Supplier Cyber Protection service. As a result, we have put an interim process in place from 7 June 2021. During this period, you cannot:

• access the usual Supplier Cyber Protection service
• access any data held in the service

The interim process is likely to last until autumn 2021.

Ministry of Defence (MoD) employees

As a MoD employee, you must complete Risk Assessments for new contracts using Microsoft Forms. If you cannot access Microsoft Forms, you can request a PDF version of the Risk Assessment.

After you have submitted a Risk Assessment, a member of the DCPP team will provide by email:

• the Cyber Risk Profile for the contract
• a Risk Assessment Reference (RAR)
• a link to the Supplier Assurance Questionnaire (SAQ) on Microsoft Forms, along with a PDF version of the SAQ, to share with your bidding suppliers

Suppliers working directly with MoD (Tier 1)

Suppliers bidding for a Tier 1 contract must complete a SAQ using Microsoft Forms. If you cannot access Microsoft Forms, you can complete a PDF version of the SAQ and email it to the DCPP team at ISSDes-DCPP@mod.gov.uk

After you have submitted a SAQ, a member of the DCPP team will email you and your contracting authority to:

• tell you whether you are compliant with the contract’s Cyber Risk Profile
• give you a SAQ Reference

Suppliers working on subcontracts (flowdown beyond Tier 1)

Beyond Tier 1, suppliers only need to complete Risk Assessments and SAQs for subcontracts with a High Cyber Risk Profile.

If a subcontract has a Cyber Risk Profile of Very Low, Low or Moderate, you do not need to complete a Risk Assessment or SAQ for it during the interim period. We will give more guidance later to let you know what you need to do when the new online tool is running.

Completing annual renewals

During the interim period, you do not need to complete annual renewals for Risk Assessments.

When the new online tool is running in autumn 2021, you will need to complete any overdue renewals within approximately 6 weeks. We will give more information about this during the interim period.

Contact the DCPP team for help

If you need help, you can contact us by emailing ISSDes-DCPP@mod.gov.uk.