DCC certification for Ministry of Defence suppliers
Defence Cyber Certification (DCC) is the Ministry of Defence's cyber certificate for its suppliers, run with IASME. Our DCC Level 0 package costs £1,445 a year for 1 to 9 people, excluding VAT, on a 3-year term. Cyber Essentials is included and renewed each year. The MoD has asked suppliers to reach Level 0 by 31 December 2026.
from £1,445a year for Level 0, 1 to 9 people, excluding VAT. Level 1 from £5,595 a year.
About three minutes. We reply within 2 business hours, Monday to Friday.
- DCC is run by the Ministry of Defence with IASME. Certification is decided by the certification body.
- Every band priced on this page, excluding VAT, with Cyber Essentials included and renewed each year
- Nothing starts until you agree a written quote. We reply within 2 business hours.
What it costs
Level 0 and Level 1 by team size, and Level 0 on its own for firms that already hold Cyber Essentials. Have your Cyber Risk Profile, or the email from your prime contractor, to hand.
| Package | 1 to 9 people | 10 to 19 people | 20 to 49 people | 50 to 99 people |
|---|---|---|---|---|
| DCC Level 0a year, 3-year term, Cyber Essentials included | £1,445 | £1,945 | £2,995 | £4,495 |
| DCC Level 1a year, 3-year term, Cyber Essentials included | £5,595 | £6,195 | £7,295 | £8,795 |
| DCC Level 0 onlyone payment for 3 years, if you already hold Cyber Essentials | £995 | £1,19510 to 49 people | £1,695 | |
| DCC Level 0 on our Managed or Secure plana year, 3-year term | £1,195 | £1,545 | £2,395 | £3,495 |
Per organisation, excluding VAT. Level 0 and Level 1 are a 3-year term, invoiced yearly in advance. Level 0 only is one payment for the 3 years. More than 99 people, or Levels 2 and 3: quoted.
Over the 3-year term, Level 0 for 1 to 9 people is 3 x £1,445, which is £4,335 excluding VAT. Cyber Essentials is renewed each year within that. It is arithmetic on the prices above, not a separate offer.
On our Managed or Secure plan, DCC Level 0 costs less: see the support-client prices under Cyber Essentials.
About three minutes. We reply within 2 business hours, Monday to Friday.
Which level do you need?
Your contract decides. MoD delivery teams complete a risk assessment that sets a Cyber Risk Profile, and prime contractors do the same for their subcontractors. Def Stan 05-138 lists the controls for each profile, as the government's Cyber Security Model guidance explains.
| Level | Name | Controls | Needs |
|---|---|---|---|
| Level 0 | Basic | 3 | Cyber Essentials |
| Level 1 | Foundational | 101 | Cyber Essentials |
| Level 2 | Advanced | 139 | Cyber Essentials Plus |
| Level 3 | Expert | 144 | Cyber Essentials Plus |
Control counts are from Def Stan 05-138 Issue 4, which describes Level 0 as normally assigned where the assessed cyber risk is very low. The Cyber Essentials prerequisites are from IASME's DCC applicant guide.
DCC is run by the Ministry of Defence with IASME. Each contract's Cyber Risk Profile sets the level.
A DCC certificate doesn't yet replace the Supplier Assurance Questionnaire. The Cyber Security Model guidance says completing the full questionnaire is still mandatory in MoD procurement.
For the detail behind each level, read our guide to the four DCC levels.
The 31 December 2026 date
The Ministry of Defence has asked all industry partners to achieve DCC Level 0 by 31 December 2026. That includes Cyber Essentials for the business-critical systems in scope.
IASME's FAQ still says DCC is currently not mandatory. Your contract's Cyber Risk Profile sets the level you need, so check what your contract or prime contractor asks for. No MoD document we have read states a penalty for missing the date. Our guide covers what happens after 31 December 2026.
What's included
Level 0 and Level 1 both include our Cyber Essentials package, renewed each year of the term. Level 0 only covers the DCC part for firms that already hold Cyber Essentials and renew it themselves.
- Everything in our Cyber Essentials package, renewed each year
- The DCC Level 0 certification fee
- We prepare your DCC application and support the submission
- The yearly DCC check-in, handled with your Cyber Essentials renewal
DCC Level 1 includes:
- Everything in our Cyber Essentials package, renewed each year
- The DCC Level 1 certification fee
- We check your setup against the Level 1 controls before you apply
- We prepare your DCC application and support the submission
Level 0 only includes the DCC Level 0 certification fee, our preparation and support of your application, and the yearly check-in.
DCC runs on a 3-year cycle with a yearly check-in. Your Cyber Essentials certificate still has to be renewed every year, which the Level 0 and Level 1 packages do.
How it works
Six steps, from the level you've been asked for to the yearly check-in.
Tell us your level, or that you haven't been told one. The form asks who is asking (the MoD, a prime contractor or a tender) and which documents you've been sent.
Written quote. We confirm the level, your band and the 3-year terms. Nothing starts until you agree it.
Cyber Essentials first, if you don't hold it. Every DCC level needs it. Our Level 0 and Level 1 packages include it, with device protection and app patching.
We prepare and support your DCC application. We check your setup against the controls for your level and prepare the submission with you.
Certification body decision. The certification body assesses the application and decides. We prepare you; we don't certify you.
Yearly check-in. Certification is valid for three years, with annual attestation at the end of years 1 and 2. We handle it with your Cyber Essentials renewal.
Level 1: check before you apply
Level 1 has 101 controls, so it helps to know your gaps before you apply. Our DCC Level 1 gap assessment costs £2,950 for up to 49 people, excluding VAT. You get a written list of what passes, what fails and what to fix first, with an estimate of the work.
Level 1 has 101 controls. Work on controls you don't yet have is £95 an hour on a support plan or £125 otherwise. Or we fix a price once we've checked your setup. Certification is decided by the certification body.
Levels 2 and 3
Levels 0 and 1 need Cyber Essentials. Levels 2 and 3 need Cyber Essentials Plus, and we quote them.
Our Cyber Essentials Plus package starts at £2,495 a year for 1 to 9 people and includes the Plus audit. Tell us the level on the form and we quote the DCC part with it.
Common questions
What is DCC Level 0?
Level 0, called Basic, is the entry level of Defence Cyber Certification. It has 3 controls and is normally assigned where a contract's assessed cyber risk is very low. You need Cyber Essentials to hold it.
How much does DCC Level 0 cost?
With us, DCC Level 0 is £1,445 a year for 1 to 9 people on a 3-year term, excluding VAT, including Cyber Essentials each year. If you already hold Cyber Essentials, Level 0 on its own is £995 for the 3 years. On our Managed or Secure plan it is £1,195 a year.
Do we need DCC Level 0 by 31 December 2026?
The Ministry of Defence has asked all industry partners to achieve Level 0 by 31 December 2026, including Cyber Essentials for the systems in scope. IASME says DCC is currently not mandatory, and your contract's Cyber Risk Profile sets the level you need. Check what your contract or prime contractor asks for.
What are the DCC levels?
There are four. Level 0 Basic has 3 controls, Level 1 Foundational has 101, Level 2 Advanced has 139 and Level 3 Expert has 144. Levels 0 and 1 need Cyber Essentials. Levels 2 and 3 need Cyber Essentials Plus.
How long does DCC certification last?
Certification is valid for three years, with an annual attestation at the end of years 1 and 2. Cyber Essentials still has to be renewed every year, and our Level 0 and Level 1 packages do that for you.
Who decides which DCC level we need?
Your contract does. Ministry of Defence delivery teams complete a risk assessment that sets a Cyber Risk Profile, and prime contractors do the same for their subcontractors. Def Stan 05-138 lists the controls required for each profile.
Guides that go deeper
Plain-English guides on the rules, the costs and the settings behind this service.
Defence Cyber Certification (DCC): Levels and Level 0 Guide
Defence Cyber Certification explained for UK suppliers: the four levels, the MoD's Level 0 ask for 31 December 2026, who it affects and how to get certified.
Read the guide
Cyber Essentials or Cyber Essentials Plus: Who Needs Which?
Cyber Essentials or Cyber Essentials Plus? See what UK government, MoD, NHS, education, legal and construction rules ask for, with sources and worked examples.
Read the guide
Cyber Essentials Requirements 2026: Plain-English Checklist
Cyber Essentials requirements in plain English: scope, the five controls, the 14-day patch, password and MFA rules, a checklist and Microsoft 365 settings.
Read the guideNeed DCC before your contract does?
Tell us the level you've been asked for, or that you haven't been told one. We reply within 2 business hours, then send a written quote, and nothing starts until you agree it.
About three minutes. We reply within 2 business hours, Monday to Friday. Or email support@cloud365.io.