Defence Cyber Certification
DCC Level 0 certification for the defence supply chain
The MOD has asked defence industry partners to achieve Defence Cyber Certification by 31 December 2026. If you already supply the MOD, that includes you. We certify Level 0 and help you put Levels 1 to 3 in place.
Defence Cyber Certification (DCC) is the MOD’s cyber security certification scheme for organisations in the defence supply chain, delivered by IASME. It has four levels, from Level 0 to Level 3. The more sensitive the information you handle, the higher the level you’ll need.
Buyers and supplier assurance platforms are already asking where organisations stand. If you plan to bid for MOD, defence, policing, national security or other government contracts involving sensitive information, expect DCC to come up. Over time, Level 0 is likely to become a standard prerequisite, much as Cyber Essentials did.
If you work in defence, DCC is coming up
Four levels of DCC
Every level starts with Cyber Essentials. Levels 2 and 3 need Cyber Essentials Plus. Certification lasts three years, with an annual attestation in between.
Level 0
3 controls. The entry point. It builds on Cyber Essentials and confirms you protect personal data and can recover quickly if something goes wrong. We assess and certify Level 0.
Level 1
101 controls. Requires Cyber Essentials. We help you implement it.
Level 2
139 controls. Requires Cyber Essentials Plus. We help you implement it.
Level 3
144 controls. Requires Cyber Essentials Plus. We help you implement it.
What's assessed?
Three areas, checked against how you really work
Level 0 looks at three things. For each one, we want to see evidence of how it works in practice, not just what your policies say.
Cyber Essentials
You hold current Cyber Essentials certification and commit to keeping it. A track record of renewals is good evidence.
UK GDPR compliance
Your privacy policy, privacy notice and ICO registration, plus a clear picture of what personal data you collect, where it's held, where it goes and why. Data protection impact assessments help too.
Resilient networks and systems
You know what your systems are, how they're backed up, what redundancy you have and how you'd restore service after an attack or failure.
We open your portal
You get access to the online assessment.
You answer the questions
First your organisation's details, then the DCC questions.
We review your answers
Before any evidence is checked, our assessor reviews your responses and flags anything that needs more detail or more work, so you can close gaps first.
Evidence meeting
We go through the evidence behind your answers. We might ask you to walk us through your joiners process, or how your backups and recovery fit together.
Certification
Once we're satisfied you meet the requirements, you get your DCC Level 0 certificate.
Need Level 1, 2 or 3? We'll help you get there
Levels 1 to 3 are much more demanding, and cost more. Scheme rules keep implementation and assessment separate, so the same company can’t help you build your controls and then certify them.
For these levels, we help you implement the controls and partner with an independent certification body for the assessment. You still have a route forward with us.
Defence Cyber Certification
DCC Level 0 pricing
Level 0 certification priced by the size of your organisation. Talk to us about implementation support for Levels 1 to 3.
Micro (0–9 employees)
£650*
Small (10–49 employees)
£750*
Medium (50–249 employees)
£950*
Large (250+ employees)
£1,150*
*Prices exclude VAT.