DCC Level 0: what MOD suppliers need in place before DIPS 2 opens
Published
Contents
If you sell digital or IT services and you've started looking seriously at defence, you've probably run into a certificate you'd never heard of, attached to a date that's already close. Defence Cyber Certification Level 0 is that certificate, and the Ministry of Defence has asked industry to hold it by 31 December 2026.
This article covers what the MOD has asked for, where the requirement becomes contractual rather than voluntary, what Level 0 involves, and why the timing matters if you're planning to bid for DIPS 2 when it goes to tender in 2027.
What the MOD has asked for
In a Defence Digital blog post on 13 July 2026, the MOD said it has asked all industry partners to achieve Level 0 of the Defence Cyber Certification (DCC) by 31 December 2026, including obtaining Cyber Essentials for all applicable business-critical systems within scope.
We have noticed that some commentators have referenced DCC Level 0 as mandatory for every MOD supplier. That isn't what the published wording says, and we think this is an important point to note.
Where it stops being a request
There are three routes, and most suppliers meet at least one of them.
DEFCON 658. This is the contract condition that applies the Cyber Security Model to an MOD contract. Where it sits in your contract, compliance with the Def Stan 05-138 controls is a contractual obligation, not a suggestion. The MOD's Industry Security Notice collection now includes a notice on using DCC as assurance of control requirements under DEFCON 658, which makes a valid certificate a recognised way to evidence those controls.
Tender conditions. GOV.UK's Cyber Security Model guidance states that suppliers should expect to see increasing requirement to hold valid DCC certification for the duration of their MOD contract, and that this will be specified as a condition under tender.
Flow down. Suppliers are responsible for passing requirements to their subcontractors, and DEFCON 658 contains the obligations they have to place on them. Plenty of firms with no direct MOD contract are in scope because the prime above them is.
Your cyber position is scored before anyone reads the interesting part of your bid
Under Cyber Security Model version 4, the sequence works like this. The authority gives you a Risk Assessment Reference and a Cyber Risk Profile level at the earliest market engagement, and it's usually in the invitation to tender. You complete a Supplier Assurance Questionnaire through the Supplier Cyber Protection Service, self-assessing against that profile. The questionnaire is scored automatically, and you're told immediately whether you're compliant.
If you aren't, you must submit a Cyber Improvement Plan setting out when you will be. That plan goes in with your tender and becomes part of the contract document. And this is the line worth rereading: the authority takes supplier compliance, or the improvement plan you've proposed instead, into consideration in supplier selection.
Think of it the way you'd think about a financial standing check in any other tender. Nobody wins a contract on it. You can absolutely lose one.
What Level 0 requires
DCC has four levels, 0 to 3, matched to the Cyber Risk Profile assessed for the work. Level 0 is the entry level, designed for organisations with a basic assessed risk profile, and it's assessed against three control areas drawn from Def Stan 05-138 (Issue 4) :
Cyber Essentials. The prerequisite. Your Cyber Essentials scope needs to align adequately with your DCC scope, and you must maintain it across the certificate period.
UK GDPR compliance. Documented policies and procedures, with DPIA evidence appropriate to the size of your organisation.
Resilient networks and systems. Practical measures showing you can withstand disruption and recover. Assessors want evidence that's real, a tested restore rather than a policy saying you take backups.
Two elements often catch suppliers out.
The first is scope. DCC is an organisation-wide certification. Issue 4 of the standard shifted the focus from protecting MOD information to the security and resilience of the organisation as a whole, so you can't narrow it to the systems that touch your MOD contract. Cyber Essentials and DCC scopes also won't be identical: Cyber Essentials looks at internet-connected systems, while a DCC scope can include systems that aren't connected at all, and your Cyber Essentials scope may contain connected systems that aren't business-critical. Getting that relationship documented is fiddly, and it's the discipline everything above Level 0 depends on.
The second is that DCC does not currently get you out of the questionnaire. GOV.UK states that suppliers holding a valid certificate are not yet exempt from completing elements of the SAQ, and that completion of the full questionnaire at the required level remains mandatory as part of contractual risk assessment and procurement. That may change. Today, the certificate sits alongside the questionnaire rather than replacing it.
Certificates run for three years, with annual attestation and annual Cyber Essentials renewal to keep them valid.
Holding the certificate and evidencing it properly in a bid are two different jobs, and the second one is where marks get lost. Most suppliers who come to us are strong on the technical answer and weaker on the compliance and evidence sections wrapped around it. If you've got a live defence opportunity and you're unsure how to present your cyber position, our bid review services can help you get it right before submission.
Why DIPS 2 turns this from sensible into urgent
The current Digital and IT Professional Services framework, RM6249, is tight. It's available to MOD customers only, it has six lots with up to seven providers in each, and it currently lists 17 suppliers. It expires on 16 November 2027 and no extensions are available.
Its replacement, RM6413 Digital and IT Professional Services 2, is a different proposition. The Government Commercial Agency (GCA) pipeline notice puts the estimated total value at £2.4bn excluding VAT, with an estimated term running from 1 September 2027 to 31 August 2035. It will be available to customers with defence and security requirements including, but not limited to, the MOD, and potentially the Home Office and the Foreign, Commonwealth and Development Office.
Now line the dates up:
31 December 2026. The date the MOD has asked industry to hold DCC Level 0.
March 2027. GCA's estimated publication of the Find a Tender notice for DIPS 2, roughly two months later.
September 2027. Estimated framework award.
Cyber Essentials is a prerequisite for Level 0, so the real sequence is Cyber Essentials first, then DCC. A supplier who starts in January 2027 has missed the MOD's date and is working on certification while the tender is live. A supplier who starts now has a three-year certificate that covers the whole competition and the opening stretch of the framework term.
However, it’s important to note that DIPS 2 tender documents don't exist yet, so nobody can tell you DCC will be a condition of award. The commercial vehicle and the lot structure are still being worked through in pre-market engagement, with options including an open framework. Treat any specific claim about DIPS 2's structure with caution until GCA confirms it.
What is on the record is that cyber assurance is already live in DIPS contracting. Published call-off documents under the current framework carry a cyber schedule, assign a Cyber Risk Profile to each requirement and set Cyber Essentials or Cyber Essentials Plus accordingly. One published call-off also required SC clearance as a minimum for all supplier personnel. Combine that with GOV.UK's statement that DCC will be specified as a condition under tender, and the planning assumption writes itself.
What suppliers should do now
Check your Cyber Essentials. Not whether you have it, but what it covers and when it expires. If the scope is narrow, that's your first piece of work.
Define your business-critical systems. Write down what's in, what's out and why. This is the artefact an assessor will press on, and it's the thing that makes Levels 1 to 3 achievable later.
Ask for your Risk Assessment Reference and Cyber Risk Profile. If you hold or are bidding for MOD work and your delivery team or prime hasn't given you these, request them. You can't complete a questionnaire or start flow down without them.
Find a certification body. We recommend Pera Prometheus who specialise in supporting the defence industry. Engaging early is the cheapest way to avoid misreading a control.
Build the evidence as a habit, not a project. Tested restores, current DPIAs, a scope document you’ll want to maintain. Annual attestation means this comes round again.
If DIPS 2 is the target, work backwards from March 2027. Certification, clearances and reference material all take longer than the bid itself. If you’re unsure about the timelines and want to explore your options, please contact one of our experienced advisers.
What happens next with DIPS 2?
Pre-market engagement runs to November 2026, with procurement documentation drafted between November 2026 and March 2027. The lot structure, the commercial vehicle and the conditions of participation will all firm up over that window.
We track RM6413 and will update this page as GCA confirms the detail, so it's worth bookmarking if defence is on your roadmap.
Getting listed on a defence framework is a different exercise from G-Cloud or DOS, and the preparation starts further out. Advice Cloud has supported more than 700 organisations with framework applications since 2012. If you want to know whether DIPS 2 is a realistic target for your business and what you'd need in place by March 2027, talk to us about framework listing services.
