Failing a cyber requirement can block an award or a renewal, and an incident can trigger reporting duties and liability.
Across the 3 regimes
United Kingdom
DEFCON 658 requires compliance with Def Stan 05-138 at the contract's cyber risk profile, flowed down to sub-contractors, with immediate incident notification.
United States
DFARS 252.204-7012 requires safeguards and reporting of cyber incidents within 72 hours. The CMMC programme (32 CFR Part 170) adds certification.
EU and NATO
No EU-wide defence cyber clause. National requirements apply through the contract.
The rest of this page sets out the 4 quoted provisions behind these cells, what is usually negotiated, and what lenders and buyers ask. It is free with a work email, along with the full tools and guides.
Unlock the full section
Free. Work emails only. Unsubscribe at any time.
Related
- Checklist: Defence procurement contract review checklist
- Checklist: Supplier flow-down and cyber checklist
General information on public law and standard terms as at 28 Oct 2026, not legal advice on any contract or transaction. Quoted wording is checked against the official text linked to it.