The DCC Level 0 deadline: what defence suppliers must do before 31 December 2026

The Ministry of Defence has asked all defence industry partners to reach Defence Cyber Certification Level 0 by 31 December 2026. Here is what that means, and how to be ready in time.

What the MoD has actually asked for

In 2026 the MoD's Director of Cyber Defence and Risk asked all industry partners to achieve Defence Cyber Certification Level 0 by 31 December 2026. That request includes holding Cyber Essentials for all applicable business-critical systems in scope. It is not yet a universal contractual mandate, but individual contracts are already specifying a required DCC level.

Why you should not leave it to the last minute

You cannot bid for a contract above your certified DCC level, so a missing certificate can cost you work. With a fixed deadline and a large supply chain all moving at once, assessment capacity will tighten as the date approaches. The suppliers who sort it early are the ones who stay eligible without the scramble.

What Level 0 actually involves

Level 0 is the supply chain floor, for work with a very low assessed cyber risk. It is a small set of controls, sitting on top of Cyber Essentials, with a pass mark of 100 percent. Because Cyber Essentials is the prerequisite, the practical first step for most suppliers is getting, or renewing, their Cyber Essentials certificate.

A simple plan to be ready

Get your Cyber Essentials in place, scope your business-critical systems, then complete Level 0. Because we are both a Cyber Essentials and a Defence Cyber Certification Level 0 body, we can do both together, with no handoffs, and fast-track where a deadline is tight.

Common questions