If your business supplies the Ministry of Defence, directly or further down the supply chain, the MOD has asked you to hold Defence Cyber Certification (DCC) Level 0 by 31 December 2026. The request came from Eleanor Fairford, the MOD’s Director of Cyber Defence and Risk, in a letter to industry in July.
DCC isn’t a legal requirement, and IASME, which runs the scheme, still describes it as not universally mandatory. In practice, it is quickly becoming a standard contract condition, and suppliers without it risk being passed over for MOD work.
The good news is that most businesses already have the foundation in place. Every DCC level starts with Cyber Essentials, which many of our customers already hold.
What is DCC?
DCC is an organisation-wide cyber security certification for defence suppliers. The MOD developed it with IASME, the same body that runs Cyber Essentials. It went live in 2025 and sits within the MOD’s Cyber Security Model version 4 (CSMv4).
Assessors check your organisation against Defence Standard 05-138, which sets out the security controls expected at each level of risk.
The main change from the old approach is that you’re assessed once, as a whole organisation. Your certificate then covers any MOD contract that asks for your level or lower, so you no longer go through a separate assessment for each contract.
The four levels
DCC has four levels, from 0 to 3. The step up between them is large, so getting the right one matters.
| Level | Cyber risk | Controls | Prerequisite | Typical work |
|---|---|---|---|---|
| 0 | Very low | 3 | Cyber Essentials | Low-risk goods or services such as stationery or facilities management, with little contact with MOD systems |
| 1 | Low to moderate | 101 | Cyber Essentials | Day-to-day supplier work handling business data, backed by a structured security programme with evidence |
| 2 | High | 139 | Cyber Essentials Plus | More sensitive work, greater access or bigger impact on delivery |
| 3 | Substantial | 144 | Cyber Essentials Plus | Critical or highly sensitive defence work |
How your level is decided
You don’t pick your level yourself. For each contract, the MOD’s delivery team carries out a risk assessment and gives it a Cyber Risk Profile from Level 0 to Level 3. That profile tells you which DCC level the contract needs.
If you’re a subcontractor, the profile flows down. Your customer receives its own profile and reference from the MOD, then runs a risk assessment for the work it passes on to you.
A few points worth knowing:
- You can apply for any level straight away. There’s no need to work up through the lower ones.
- Your scope must stay the same whichever level you go for.
- Levels 2 and 3 need Cyber Essentials Plus, which includes an independent technical audit, not just a self-assessment.
- The MOD wants everyone at Level 0 first. Where a contract needs a higher level, it has said that work should be scheduled after December.
Why it’s worth sorting now
The December deadline is the obvious reason, but there are others.
- One certificate, many contracts. Once certified, you can bid for any MOD contract at or below your level without another assessment.
- Less pressure at bid time. Contracts are increasingly listing DCC as a condition. Having it already means you’re not rushing to certify while a tender is open.
- It lasts three years. You’ll need to make an annual attestation and keep your Cyber Essentials current, but there’s no full reassessment each year.
- Watch your Cyber Essentials renewal date. If your Cyber Essentials certificate expires during a DCC assessment, you fail automatically. It’s worth lining the two up.
Getting certified, and how we can help
- Find out which level you need. Ask your MOD contact or prime contractor for the Cyber Risk Profile and Risk Assessment Reference for your contract. If you don’t hold a defence contract yet, Level 0 is the place to start.
- Get Cyber Essentials in place. Or Cyber Essentials Plus if you’re aiming for Level 2 or 3. Make sure it covers all your business-critical systems in scope.
- Work out the gaps. Compare what you have today against the controls for your level. At Level 0 that’s a short exercise. At Level 1 it’s a proper project with evidence to gather.
- Fix what’s missing. Policies, technical controls, access management, supplier checks and so on.
- Book your assessment. This is carried out by an IASME-accredited DCC certification body.
Scanstation already helps local businesses achieve Cyber Essentials and Cyber Essentials Plus, so we can get the foundation sorted and make sure your systems are ready. We work with CyberSmart, an IASME-accredited DCC certification body, to take you through scoping, gap analysis and assessment for Levels 0 and 1.
If you supply the MOD, or you think one of your customers might, get in touch and we’ll help you work out where you stand before the December deadline.
