Partner services
Defence Cyber Certification Level 0 for defence suppliers
The Ministry of Defence (MOD) has asked every defence industry partner to achieve Defence Cyber Certification (DCC) Level 0 by 31st December 2026. It's the new baseline for the defence supply chain, and it's built on Cyber Essentials. We introduce you to a trusted partner with public sector experience, so you're certified in time.
Rated 5.0 on GoogleAt a glance
- What Level 0 asks for
- A current Cyber Essentials certificate, plus three controls assessed by a certification body
- Valid for
- Three years, with an annual attestation and annual Cyber Essentials renewal
- Delivered by
- A trusted partner, introduced and co-ordinated by Advice Cloud
MOD target date for Level 0: 31st December 2026. If you don't yet hold Cyber Essentials, start there now.
Talk to us this weekWhy it matters
Why defence buyers ask for DCC
The MOD's Cyber Security Model sets the cyber controls its suppliers must meet, through a contract condition called DEFCON 658. Those obligations flow down to subcontractors, so they reach well beyond the MOD's direct suppliers.
DCC is the MOD's own certification scheme, owned by the MOD and managed by IASME. A valid certificate at the right level is accepted as assurance that you meet the controls DEFCON 658 requires, so you can evidence them once for the whole organisation rather than contract by contract.
- Meet the MOD's Level 0 baseline before the 31st December 2026 target
- One certificate for many contracts, presented in support of defence procurements up to your level
- Ready when a prime asks, because DEFCON 658 obligations follow you down the supply chain
Where it's required
Where DCC is asked for
DCC is set by the defence contract rather than by a framework. These positions were checked on 13th November 2026.
All defence industry partners
The MOD has asked every industry partner to achieve DCC Level 0 by 31st December 2026, whatever level their individual contracts require.
MOD contracts with DEFCON 658
Each contract carries a Cyber Risk Profile, from Level 0 to Level 3. The DCC level you need matches it, and the MOD may require certification as part of the procurement.
Defence supply chains
DEFCON 658 obligations pass from the prime to its subcontractors. If you supply a defence prime, expect them to ask for evidence at the right level.
The requirements
What each DCC level asks for
Every level starts with Cyber Essentials. Level 0 is the foundation, and the level your contract needs is confirmed by the MOD or your prime.
| DCC level | Controls assessed | Cyber Essentials needed |
|---|---|---|
| Level 0 (this page) | 3 | Cyber Essentials |
| Level 1 | 101 | Cyber Essentials |
| Level 2 | 139 | Cyber Essentials Plus |
| Level 3 | 144 | Cyber Essentials Plus |
What Level 0 involves
A current Cyber Essentials certificate that covers the systems in your DCC scope, and evidence that you meet three controls from the MOD's cyber standard, Def Stan 05-138.
It isn't a self-certification. You describe how you meet each control and provide evidence, and a certification body appointed by IASME assesses it.
The route to certification
- 1Confirm your level. Check the Cyber Risk Profile on your contracts, or start at Level 0.
- 2Cyber Essentials first. Get or renew it, with a scope that matches your DCC scope.
- 3Evidence the controls. Show how you meet each one, with supporting evidence.
- 4Assessment. A certification body reviews your evidence and issues the certificate.
- 5Keep it. Attest every year, renew Cyber Essentials every year, and recertify every three years.
How we help
Certified before the MOD's deadline
We don't certify you ourselves. We introduce you to a trusted partner who delivers Cyber Essentials and DCC, has worked with public sector suppliers and delivers to a standard we're happy to put our name to. We stay involved, so your certification lines up with the defence contracts and frameworks you're going for.
- 1
Talk to us
We check where you stand on Cyber Essentials and which DCC level your contracts need.
- 2
Meet our partner
We introduce you to our partner, who agrees your scope and plans the work back from your deadline.
- 3
Get certified
Our partner supports you through Cyber Essentials and DCC Level 0, and we keep it aligned with your bids.
Talk to us about DCC Level 0
Tell us what you need and we'll come back to you, or book a call with one of our team.
Speak with our DCC experts
Pick a time that suits you. We'll talk through your defence contracts, the level they need and what has to happen before the deadline.
DCC Level 0: your questions answered
What is Defence Cyber Certification?
An organisation-wide cyber security certification for suppliers to UK defence. It's owned by the MOD and managed by IASME, and it has four levels, from Level 0 to Level 3, each matched to a contract's Cyber Risk Profile.
Is DCC Level 0 mandatory?
The MOD has asked all defence industry partners to achieve Level 0 by 31st December 2026, and its guidance tells suppliers to expect DCC to feature increasingly in contract requirements. Individual contracts set the level you actually need.
Which DCC level do I need?
The level matches the Cyber Risk Profile assigned to your contract, which the MOD or your prime contractor will confirm. If you don't have a contract yet, Level 0 is the baseline the MOD has asked for.
Do I need Cyber Essentials first?
Yes. Every DCC level starts with Cyber Essentials, and Levels 2 and 3 need Cyber Essentials Plus. If you don't hold it yet, that's the first job.
Can I get certified without an MOD contract?
Yes. IASME lets organisations apply at any level, even if they aren't currently working on an MOD contract. That makes sense if you're planning to bid for defence work.
How long does DCC certification last?
Three years, as long as you complete an annual attestation that nothing major has changed and renew your Cyber Essentials certificate every year.
What if a contract needs DCC and I'm not certified yet?
The MOD's Cyber Security Model has a Cyber Implementation Plan for suppliers who can't yet meet the requirements, setting out how and when they will. It's a stopgap, not a substitute, so plan to certify.
Can I move up to a higher level later?
Yes, but it's a new assessment at the higher level. IASME doesn't let you upgrade by assessing only the extra controls, so if you know a contract will need Level 1 or above, it may make sense to go straight there.
How long does it take, and what does it cost?
Both depend on whether you already hold Cyber Essentials, the size of your organisation and your scope. Our partner will give you a timeline and a proposal once they've seen where you stand.
Who will deliver the work?
One of our trusted partners, introduced by us. You'll know who they are and what they propose before you commit to anything, and we stay involved throughout.