DEFCON 658: A Practical Checklist for Defence Suppliers

What the terms mean

The MoD’s Cyber Security Model guidance distinguishes the contract terms, technical controls and supplier assurance process:

DCC and Cyber Essentials have different purposes. Our DCC levels guide explains how they fit together.

Ask your customer these questions

Use this as a meeting checklist. Record the answer, who confirmed it and anything still unresolved.

• Which contract or supplier-onboarding request are we discussing?
• What Cyber Risk Profile and assessment reference apply?
• What DCC level and certification scope do you expect?
• Which evidence must we provide, to whom and by what date?
• What should we do if preparation identifies a gap?
• Are there requirements we must pass to our own suppliers?

A helpful opening message is: “We want to make sure we prepare against the right requirement. Please confirm the applicable profile, reference, evidence and date.” Keep commercially sensitive details within your agreed customer channels.

Understand the certification evidence

The MoD’s March 2026 notice explains how valid DCC certification at the appropriate level can provide evidence of relevant control requirements. It does not turn every certificate into evidence for every contract.

For example, a supplier may hold a certificate but still need to confirm whether its assessed scope covers the organisation and activities the customer is asking about. Treat that as a question to resolve before promising a completion date.

What to gather internally

Create a short preparation sheet with your current certificates and expiry dates, business locations, key systems, existing IT provider and the person who can coordinate answers. Add the customer’s confirmed deadline and a list of open questions.

This is a practical starting point for a scoping conversation, not the full assessment evidence list. Your certification body will confirm what it needs. Avoid uploading contracts, network diagrams or credentials into an initial public enquiry form.

The December 2026 request

The MoD has asked industry partners to achieve DCC Level 0 by 31 December 2026. Confirm your own customer’s requirements as well: a higher level or an earlier date may apply to your situation.

Our planning advice is to check the scope and availability now, then work backwards from the confirmed date. The time needed depends on existing controls, preparation work and assessor availability. We cannot guarantee certification or a date before those are understood.

Get a useful next step

Send the requested level, your team size, existing certificate status and the date needed. If the level has not been confirmed, say so. We can explain the preparation service and agree what needs checking next.

Discuss your DCC requirements, or see the DCC service and pricing. Cloud365’s published DCC packages have a three-year term invoiced yearly; check the scope and terms before agreeing a package.