DCC Level 0: the Cyber Essentials deadline is approaching fast

The Ministry of Defence has asked every defence supply-chain partner to reach Defence Cyber Certification (DCC) Level 0 by 31 December 2026, and Cyber Essentials is the prerequisite. With the deadline approaching fast and assessor diaries filling up, the time to act is now.

What is DCC Level 0?

Defence Cyber Certification is the MoD’s organisation-wide cyber assurance scheme for its supply chain, run with IASME as the scheme’s certification authority. It was introduced through the Cyber Security Model version 4 (CSMv4) and is aligned to Defence Standard 05-138 (Issue 4). The scheme has four levels, 0 to 3, and Level 0 is the entry baseline that most suppliers are being asked to meet.

What Level 0 actually requires

Level 0 is often described as “just Cyber Essentials”, but that is only part of it. It sets three baseline controls, assessed against Defence Standard 05-138 (Issue 4):

• A valid Cyber Essentials certificate covering the business-critical systems in your DCC scope.
• Conformance with UK GDPR.
• Evidence that you operate a resilient business.

Cyber Essentials is the largest and most achievable of the three, and the one the rest is built on, which is why it is the sensible place to start. Just treat Level 0 as three controls, not one, so nothing catches you out late in the process.

The 31 December 2026 deadline

In 2026 the MoD’s Director of Cyber Defence and Risk asked all industry partners to achieve DCC Level 0 by 31 December 2026. To be precise, it is a request rather than a statutory mandate, and 1 January 2027 does not automatically void existing contracts. But it is a clear signal of intent: DCC is increasingly specified at tender through DEFCON 658, and primes are already asking subcontractors to evidence certification during onboarding. In practice, if you supply the MoD directly or through a prime, Level 0 is becoming the floor for winning new work.

Who is in scope

The requirement flows down the whole supply chain, not just the tier-one primes. The MoD works with around 12,000 SMEs, and the deadline reaches every tier. You do not need a live defence contract to certify: any organisation can apply at any time, and starting early avoids the year-end rush.

Cyber Essentials is the prerequisite

At the heart of DCC Level 0 is Cyber Essentials. You must hold a valid Cyber Essentials certificate covering the business-critical systems within your DCC scope before you can complete Level 0. Get Cyber Essentials in place and you are most of the way to the baseline. It is the single most important, and most achievable, step.

Why acting fast matters

There is less time than it looks. Once you count backwards from scoping, evidence gathering and booking an assessment slot, the window is tight, and certification body diaries fill up towards the year end. Waiting for a tender or a prime to force the issue often leaves too little time to scope, get Cyber Essentials in place and gather evidence within a procurement timetable. The suppliers who move now will not be scrambling in December.

How Solusec helps

We are an IASME Cyber Essentials Certification Body, and Cyber Essentials is exactly the prerequisite DCC Level 0 depends on. We can get your Cyber Essentials in place quickly: as standard we aim to assess within one business day of you submitting, and with our urgent option the same day. If you are up against the deadline, see our fast Cyber Essentials service, or get certified now.

Fast Cyber Essentials →

To be clear about scope: we provide the Cyber Essentials that Level 0 requires. The DCC assessment itself is carried out by an appointed DCC certification body, and we are happy to point you in the right direction once your Cyber Essentials is sorted.

Common questions