# Def Stan 05-138 Intune mapping for suppliers | TenuVault Def Stan 05-138 Intune mapping: choose the assigned cyber risk level, review Issue 4 configuration findings and prepare evidence for supplier assessment. Canonical: https://www.tenuvault.com/guides/def-stan-05-138-intune-mapping Practical guide # Def Stan 05-138 Intune mapping Def Stan 05-138 Intune mapping shows selected configuration evidence against UK MOD supplier security references. TenuVault supports an Issue 4 comparison with a target cyber risk level, helping you organize technical findings for a wider supplier assessment. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Which supplier risk profile must I use? Obtain the cyber risk profile and assessment scope from the customer responsible for the contract. UK MOD's Cyber Security Model guidance describes that customer and supplier process. Def Stan 05-138 sets requirements for the risk profiles; the Intune administrator should not choose a lower level because it produces fewer findings. TenuVault documents a native Issue 4 comparison with target cyber risk levels 0 to 3. Record the selected target and compare it with the issue and profile required for your contract. If the engagement calls for another issue or interpretation, raise that mismatch before presenting the export as supporting evidence. - [UK MOD Cyber Security Model](https://www.gov.uk/guidance/cyber-security-model) - [Def Stan 05-138 Issue 4](https://assets.publishing.service.gov.uk/media/669923b249b9c0597fdaff90/Defence_Standard_05-138__Issue_4_-_cyber_security_for_defence_suppliers.pdf) ## What can the Intune administrator check for this contract? Begin with the customer's assigned cyber risk profile and the systems used to deliver that contract. Ask the contract security owner which endpoint requirements need technical material from Intune. The Cyber Security Model defines the supplier process; selecting a convenient device group does not establish that the whole contractual scope has been reviewed. For managed laptops included in that request, inspect the assigned endpoint security profiles and relevant configuration reports. Encryption questions lead to disk encryption policies; malware protection questions lead to antivirus settings; local administrative access questions may lead to account protection. Choose the policies because they answer the requested requirement, not because they sit under a security heading. Check actual device status for the contract population and note exclusions, conflicts or missing reports. Intune can help explain the configuration of managed endpoints, but supplier responsibilities also extend beyond those machines. Return organizational, subcontractor or separately managed system questions to the contract owner with a clear description of what you examined. - [MOD supplier risk profile process](https://www.gov.uk/guidance/cyber-security-model) - [Microsoft endpoint policy types](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-policy) - [Profile deployment and device reporting](https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/reports) ## How do I choose the Def Stan comparison level? 1\. Choose UK MOD Def Stan 05-138 from Frameworks in the supplier tenant. Read About this comparison and confirm that its Issue 4 basis is appropriate for the customer request. 2\. Set Target cyber risk level to the required level from 0 to 3. Under Platforms in scope, choose the managed platforms included in the contract review. 3\. Run Compare settings and inspect the capabilities relevant to the assigned target. Open Setting-by-setting evidence to trace a finding to its observed policy and assignments. 4\. Save the Def Stan comparison as PDF, CSV or JSON after reviewing collection limitations. Include the target level and unresolved items in the response sent through your normal supplier assessment process. The native Def Stan comparison and its PDF, CSV and JSON reporting are included in Community, so a supplier can review the technical scope before considering other features. - [Framework coverage workflow and limitations](https://docs.tenuvault.com/baselines/frameworks/) ## What does Def Stan 05-138 Intune mapping show? Create an evidence index tied to the customer request: requirement reference, mapped capability, assigned configuration, scope and evidence owner. Retain separate records for supplier processes and systems outside Intune. Where a policy is missing or different, agree a remediation owner and approval path. Where evidence is unknown, resolve the collection problem or document the outstanding evidence, rather than reporting a requirement as satisfied. Present each endpoint finding in terms the contract owner can act on: the requested reference, the managed population, the observation and the next action. For a missing capability, distinguish an absent policy from a policy assigned outside the relevant group. Do not lower the selected target just to remove the finding. If the request refers to another issue of the standard, retain that mismatch and ask for clarification before using the mapping. Once approved changes are complete, repeat the Issue 4 comparison at the same target and confirm device delivery. Keep the outstanding non-Intune work visible rather than folding it into the technical result. ## Can I test the contract scope before the full review? Use TenuVault to compare the contract's managed endpoints at the customer's assigned Def Stan target level. Review one unresolved finding with the contract security owner before preparing the wider supplier response. - [Compare Intune with security frameworks](https://www.tenuvault.com/guides/compare-intune-with-security-frameworks) - [Document Intune configuration for an audit](https://www.tenuvault.com/guides/document-intune-configuration-for-audit) - [Back up the configuration behind your evidence](https://www.tenuvault.com/intune-backup) - [Download TenuVault](https://www.tenuvault.com/download) ## Read the technical guides - [Framework coverage](https://docs.tenuvault.com/baselines/frameworks/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Does choosing a target risk level assign the contract profile? A: No. It selects the technical comparison target. Obtain the applicable profile through the customer and supplier process for the contract. ### Q: Does the export replace a supplier assessment? A: No. It provides scoped configuration evidence, with limitations, for the broader assessment. ### Q: Can I use an Issue 4 mapping for another issue? A: Do not assume equivalence. Confirm the applicable standard and retain any mismatch as an explicit limitation for the reviewer. ## Related guides - [validate your Intune baseline](https://www.tenuvault.com/openintunebaseline) - [How to document Intune configuration for an audit](https://www.tenuvault.com/guides/document-intune-configuration-for-audit) - [Essential Eight Intune checks](https://www.tenuvault.com/guides/essential-eight-intune-checks) - [How to find conflicting settings and duplicate Intune policies](https://www.tenuvault.com/guides/find-conflicting-intune-settings) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)