Defence Cyber Certification (DCC)

Defence Cyber Certification is the MoD's independently assessed cyber certification for defence suppliers, created by the Ministry of Defence with IASME as the Certification Authority and built on Defence Standard 05-138 Issue 4. It has four levels, Level 0 to Level 3. Cyber Essentials is a control at every level, and Levels 2 and 3 require Cyber Essentials Plus as well. Solusec is an appointed Certification Body for Level 0 and a Cyber Essentials Certification Body, so both come from us without a handoff.

The four levels at a glance

Your level is not something you choose from a menu. It is set by the Cyber Risk Profile that the MoD delivery team assigns to the contract, which means the right question is rarely "which level should we get" but "which level has our contract been assessed at".

DCC levels, controls and Cyber Essentials requirements

Level	Controls	Assessed risk	Cyber Essentials	CE Plus
Level 0	3	Very low	Required	Not required
Level 1	101	Low to moderate	Required	Not required
Level 2	139	High	Required	Required
Level 3	144	Substantial	Required	Required

Note the jump. Level 0 is three controls. Level 1 is a hundred and one. There is no gentle slope between them, and organisations that assume Level 1 is "Level 0 with a bit more paperwork" are in for a surprise. If your contract has been profiled at Level 1, treat it as a programme of work rather than an application.

One correction worth making, because it circulates widely and is wrong: Cyber Essentials Plus is not required at Level 1. Def Stan 05-138 Issue 4 lists Cyber Essentials (control 0001) as applying at all four levels, and Cyber Essentials Plus (control 0002) at Levels 2 and 3 only. The MoD's own Level 1 Supplier Assurance Questionnaire asks about Cyber Essentials and does not mention Plus at all. If a provider has told you that you need Plus for Level 1, check the standard.

What Level 0 actually asks for

Three controls. That is the whole of Level 0, and it is worth stating plainly because the scheme's name makes it sound heavier than it is.

1. Cyber Essentials (control 0001). Hold Cyber Essentials certification covering the scope required for all aspects of the contract, and commit to maintaining it for the duration of the contract.
2. UK GDPR compliance (control 2314). Ensure personal data is processed in compliance with the General Data Protection Regulation.
3. Resilient networks and systems (control 2500). Build resilience against cyber attack and system failure into the design, implementation, operation and management of the systems supporting your business functions and protecting data.

Governance and risk management are not Level 0 controls, despite appearing in several published summaries. They start at Level 1. For almost every SME reading this, the substantive work in Level 0 is getting and keeping Cyber Essentials; the other two controls are things a well-run business can usually already evidence.

What the 31 December 2026 date really means

In May 2026 the MoD's Director of Cyber Defence and Risk wrote that she had "recently asked all industry partners to achieve Level 0 DCC certification by 31st December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope". The MoD repeated the ask in July 2026.

We are going to be straight with you about the status of that date, because a lot of marketing around it is not.

• It is an ask, not a contractual mandate. IASME, which runs the scheme, states plainly that DCC is currently not mandatory, and that applicants may still tender for MoD contracts through the normal process.
• Holding DCC does not currently exempt you from the SAQ. Government guidance is explicit that suppliers with a valid DCC certificate are not yet exempt from completing elements of the Supplier Assurance Questionnaire. The word "yet" is clearly doing deliberate work, but no timeline for that change has been published.
• The contractual hook is still DEFCON 658 and the Cyber Security Model. That already applies to you today, regardless of DCC.

So why bother before the end of the year? Because the direction of travel is unambiguous, because buyers are already asking, and because the Cyber Essentials underneath it is genuinely worth holding on its own merits. What we will not do is tell you that you will be barred from MoD work on 1 January. That is not what the MoD said, and you should be sceptical of anyone who tells you otherwise.

How DCC fits with the Cyber Security Model and the SAQ

If you supply the MoD you are already inside a system that predates DCC, and the two now share a structure.

Where DCC sits alongside existing MoD cyber requirements

Mechanism	What it is	Status for you today
DEFCON 658	The contract clause that imposes the Cyber Security Model	Contractual, applies now
Cyber Security Model v4	The risk framework; uses Def Stan 05-138 Issue 4	Current, use for new procurements
Cyber Risk Profile	Level 0 to Level 3, assigned per contract by the MoD	Decides your DCC level too
Supplier Assurance Questionnaire	Self-assessment, now through the Supplier Cyber Protection Service	Still required; DCC does not yet replace it
Defence Cyber Certification	Independent third-party assessment of the same controls	Voluntary today, asked for by 31 Dec 2026

CSMv4 replaced the old five Cyber Risk Profiles (N/A, Very Low, Low, Moderate, High) with the four levels DCC certifies against. If your internal documentation still uses the old names, it is out of date.

What it costs, and how long it lasts

There is no published standard price for DCC. IASME does not set one, because the effort varies enormously between applicants, so every Certification Body prices its own assessments. Be wary of anyone quoting you a "standard DCC fee" as though the scheme set it.

For Level 0 the cost that actually matters to most suppliers is the Cyber Essentials underneath it, which we price transparently:

Cyber Essentials, the Level 0 prerequisite (Solusec pricing, excluding VAT)

Organisation size	Certification	+ urgent turnaround	+ gap analysis
Micro, 1 to 9 staff	£320	£420	£720
Small, 10 to 49 staff	£440	£540	£840
Medium, 50 to 249 staff	£500	£600	£900
Large, 250+ staff	£600	£700	£1,000

Ask us for a DCC Level 0 assessment quote and we will give you a fixed figure for your scope. A DCC certificate is valid for three years, subject to annual attestation that nothing material has changed in your organisation and to keeping your Cyber Essentials (or Cyber Essentials Plus at Levels 2 and 3) renewed each year. So the recurring commitment is annual, even though the certificate runs for three.

How Solusec helps

We are an appointed Certification Body for DCC Level 0, and an appointed IASME Certification Body for Cyber Essentials and IASME Cyber Assurance. In practice that means:

• Level 0: we assess and issue the certificate, and we certify the Cyber Essentials it requires at the same time. One organisation, one timeline, no handoff.
• Level 1: the jump to 101 controls is substantial. We provide scope reviews, gap analysis across the control set and evidence preparation so you go into assessment with the work done.
• Levels 2 and 3: these require Cyber Essentials Plus as well, and we refer those assessments to a body appointed for them. We will say so rather than stretch.

You can verify our appointments independently on the BlockMark registry and through IASME's DCC scheme pages. We are based in Shropshire and work with defence suppliers across the UK.

Common questions