Defence Cyber Certification (DCC): Levels and Level 0 Guide

This guide explains how the scheme works, who it reaches and how a small supplier gets Level 0. It also covers what Level 1 adds and what it costs. If you searched for "DCC level 0" or "DCC level 1" and found dice and dungeons, that was a tabletop role-playing game. This is the other DCC.

What Defence Cyber Certification is and who runs it

The MoD developed DCC with IASME, which describes itself as "the MOD's official cyber certification partner". IASME delivers the scheme through its network of assured certification bodies. These are firms IASME licenses to assess standards such as Cyber Essentials and DCC.

The scheme launched in May 2025. It checks you against Defence Standard 05-138, usually written DEF STAN 05-138. Issue 4 of the standard, dated 14 May 2024, contains 148 controls in total.

The certificate covers your organisation, not a single contract. IASME says it gives "a single, organisation-level, assurance" you can present in defence procurements. Before DCC, assurance was handled contract by contract.

How Defence Cyber Certification fits the Cyber Security Model

DCC sits inside a wider process called the Cyber Security Model (CSM). The government describes the CSM as "how Defence builds cyber security into its supply chain". A contract condition called DEFCON 658 sets out its contract terms.

Version 4 of the CSM took effect on 3 December 2025. The old version used risk profiles from Very Low to High and focused on "MOD Identifiable Information". Version 4 looks at the security and resilience of the whole organisation instead.

So DCC did not replace the CSM. It is a way to prove independently that you meet the CSM's controls. In a typical tender, the pieces fit together like this:

1. Risk Assessment. The MoD delivery team assesses the contract. This produces a Cyber Risk Profile (CRP) from Level 0 to Level 3, and a Risk Assessment Reference (RAR). The RAR usually appears in the invitation to tender.
2. Supplier Assurance Questionnaire (SAQ). You self-assess against that profile in the online Supplier Cyber Protection Service. It scores the SAQ automatically and tells you straight away whether you comply.
3. Cyber Improvement Plan (CIP). If you fall short, you submit a CIP saying when you will comply. It becomes part of the contract.
4. DCC certificate. This is independent evidence that you meet the controls. Under ISN 2026/02, buyers are instructed to accept a valid certificate at the required level or higher.

One catch: a certificate does not yet replace the SAQ. The government's CSM guidance says "completion of the full SAQ to the required level remains mandatory" for now. You also complete a new SAQ each year on the contract's anniversary, with one month to do it.

The four Defence Cyber Certification levels

The contract's Cyber Risk Profile sets the level you need. Names and control counts come from DEF STAN 05-138.

A higher certificate covers every lower level. ISN 2026/02 says a Level 3 certificate "is to be accepted as full satisfaction of all lower levels". If you hold several contracts at different levels, the MoD's updated text for the standard says to certify at the highest one.

The MoD's 31 December 2026 ask for Defence Cyber Certification Level 0

In a May 2026 post on the Defence Digital blog, Eleanor Fairford, the MoD's Director of Cyber Defence & Risk, said:

"I have also recently asked all industry partners to achieve Level 0 DCC certification by 31st December 2026"

She added that this "includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope." A Defence Digital post in July 2026 repeated the ask, and IASME repeated it in September 2026.

Is Defence Cyber Certification mandatory?

Not yet for everyone. The 31 December date is an MoD request to industry. The MoD's interim text for DEF STAN 05-138 says the MoD "may require certification as part of procurement". It adds: "It is anticipated that Level 0 certification will become a baseline requirement for Defence suppliers."

In practice, the duty arrives through contracts. The CSM guidance says "Suppliers are contractually required to meet Def Stan 05-138 controls." The MoD recognises a DCC certificate as independent proof that you do.

What happens after 31 December 2026

• Higher levels follow. Fairford asked that higher levels needed lower down the supply chain "should be scheduled for delivery after 31 December 2026".
• More tenders will ask for it. The CSM guidance tells suppliers to expect DCC to be "specified as a condition under tender".
• Gaps are handled by a plan. Where a supplier is not yet certified, a CIP lets it work towards compliance under contract.
• Primes may move sooner. IASME warns that primes "may set earlier internal deadlines to manage their own risk".

None of the MoD documents we read sets a penalty for missing the date itself.

Who Defence Cyber Certification affects

DEF STAN 05-138 applies to "all Ministry of Defence (MOD) procurements, MOD suppliers and their subcontract suppliers". DEFCON 658 carries the obligations down the chain.

Flow-down works like this. A prime runs a risk assessment for each subcontractor and passes on the new RAR. The tier 2 subcontractor completes its SAQ, and the chain repeats for its own tier 3 suppliers.

So the question is not whether you make anything military. It is whether you hold, or want, work that links back to an MoD contract. These examples are illustrative:

• Logistics. A 12-person haulier moves machined parts between a prime's sites.
• Facilities. A 30-person cleaning and maintenance firm has staff on a defence site.
• Software. A five-person developer builds a stock-tracking tool for a tier 2 engineering firm.
• Training. A provider runs health and safety courses for a defence contractor's staff.
• Professional services. An engineering consultancy or accountancy does subcontracted work for a prime.

Each would learn its level from the buyer's risk assessment, not from guesswork.

Scope is also wider than the contract. The MoD's interim text for the standard applies it to your "business-critical operations" across the whole legal entity. IASME's scoping guide gives payroll, building entry and HVAC systems as examples. If business-critical work relies on a third-party service, such as Microsoft 365, you must still show the controls are met.

A certificate covers only the legal entity assessed. It does not automatically extend to the rest of a group.

How to get Defence Cyber Certification Level 0

Level 0 has three controls, all from DEF STAN 05-138:

• Cyber Essentials (control 0001). You need a certificate that covers your scope, kept in place for the life of the contract.
• UK GDPR compliance (control 2314). IASME expects policies, procedures and data protection impact assessment (DPIA) evidence that suit your size.
• Resilient networks and systems (control 2500). You show your systems can withstand attacks or failures and recover.

All three must be fully met. The applicant guide allows "no partial compliance" at Level 0.

Step by step

1. Get Cyber Essentials first. It is the prerequisite, and IASME calls it "most of the journey" for many firms. Our Cyber Essentials requirements guide covers what that assessment checks.
2. Write down your scope. List the systems, people and sites your business needs to operate. Show how your Cyber Essentials scope lines up with it. Under-scoping means failure, even if every control is met.
3. Choose a DCC certification body. It can be the one that did your Cyber Essentials, or another. It reviews your scope and may quote.
4. Get onboarded. The certification body sets you up on the IASME portal at Level 0.
5. Answer the questions. You explain how you meet each control in a portal submission. Level 0 needs no Assessment Submission Record.
6. Assessment. The certification body marks each answer compliant, non-compliant or "more information needed". You can update and resubmit.
7. Certificate. If you pass, a digital certificate is issued automatically, with a badge for your website or email.

Scope is where firms trip up. Take an illustrative 15-person machine shop. Its Cyber Essentials covers laptops and Microsoft 365, but its CNC machines run on a separate offline network. That network is business-critical, so it belongs in the DCC scope.

For resilience, assessors want proof. IASME gives tested restores as an example, rather than a policy that says you do backups.

Timescales

The IASME process guide sets out the steps but gives no standard turnaround. IASME says it takes time, especially if you need to gather evidence, tighten scope or test restores. Its advice is: "don't leave Level 0 to the end of the year."

The 3-year cycle and the yearly check-in

A DCC certificate is valid for three years. You make an annual attestation at the end of years 1 and 2. At the end of year 3 it expires and you reapply. Cyber Essentials renews every year, and Level 0 needs it kept in place throughout.

What Defence Cyber Certification Level 1 adds

Level 1 is the "Foundational" level, for "low to moderate" assessed risk. It jumps from 3 controls to 101, but still needs only Cyber Essentials, not Plus.

The extra controls reach well beyond IT settings. Examples from the standard include:

• governance, clear roles and regular risk assessment
• up to date network diagrams and asset management
• supply chain risk and trusted provider relationships
• physical access controls and visitor management
• staff awareness training and a joiners, movers and leavers policy
• patch management and security monitoring
• penetration testing of external systems at least every 12 months
• tested incident management and recovery processes

The pass mark changes too. Each control scores 0, 1 or 2 points. You need at least 80% of the points in each objective, and no control can score zero.

The process is fuller. You complete an Assessment Submission Record with evidence for each control. The certification body scores it on paper, then you demonstrate the controls on a remote call. A site visit is added if scoping calls for one.

Why gap work matters for Defence Cyber Certification Level 1

With 101 controls and an 80% bar per objective, applying blind is risky. A gap analysis compares what you do today with each control before you apply. It separates quick policy fixes from items that need budget, such as a penetration test.

Take an illustrative 40-person electronics assembler whose prime asks for Level 1. It may already have Cyber Essentials and good backups. It may still lack a network diagram, a visitor log and a yearly penetration test. Finding that first lowers the risk of a failed assessment.

What Defence Cyber Certification costs

The total has three parts: Cyber Essentials, the DCC assessment and any work to close gaps.

• Cyber Essentials. IASME charges £320 plus VAT for 0 to 9 staff and £440 for 10 to 49. It charges £500 for 50 to 249 and £600 for 250 or more. It renews every year, and our Cyber Essentials cost guide goes further.
• The DCC assessment. IASME's DCC scheme and help pages show no fixed fee. IASME's process guide says certification bodies may quote, based on details such as size, scope, number of sites and readiness.
• Gap work. At Level 1, budget for fixes, staff time and a yearly penetration test. Levels 2 and 3 also need Cyber Essentials Plus, which our Cyber Essentials Plus guide explains.

Cyber Essentials can also bring free cyber insurance arranged by IASME. It covers UK organisations with turnover under £20m that certify the whole organisation, with incident response up to £25,000.

How cloud365.io can help with Defence Cyber Certification

We prepare suppliers for DCC Level 0 and Level 1 and support the submission. The certification body makes the decision. Our DCC Level 0 package includes Cyber Essentials renewed each year, from £1,445 a year for 1 to 9 people on a 3-year term. If you already hold Cyber Essentials, Level 0 alone starts at £995 for the 3 years. Clients on our Managed or Secure plans pay from £1,195 a year for DCC Level 0. Prices exclude VAT, and our DCC packages show every size band and the Level 1 option.