DEFCON 658 must be included in all MOD contracts with a Cyber Risk Profile higher than ‘Not Applicable’. Where contracts contain DEFCON 658, tenderers are required to complete a Supplier Assurance Questionnaire (SAQ) as part of their tender response and, if awarded the contract, the SAQ must be renewed annually by the supplier.