DCC vs Cyber Essentials: how the two fit together

Defence Cyber Certification and Cyber Essentials are often confused. They are different things that work together. Here is how, and which you actually need.

Cyber Essentials: the technical baseline

Cyber Essentials is the UK Government-backed scheme covering five core technical controls that stop the majority of common cyber attacks. It is the foundation almost every business benefits from, and it is required for many contracts and insurance policies. Cyber Essentials Plus is the same five controls, independently tested on your live systems rather than self-assessed.

Defence Cyber Certification: organisation-wide assurance for defence

Defence Cyber Certification, or DCC, is the MoD-backed scheme delivered by IASME under Defence Standard 05-138. It assures a supplier's cyber security across the whole organisation, not just the technical controls, and it has four levels set by the cyber risk of the contract. It is evidence-driven: policies, logs and records, not just a form.

How they relate

Cyber Essentials sits inside every DCC level as the technical baseline. every level requires Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus as well. So DCC does not replace Cyber Essentials; it builds on it. If you are heading for DCC, your Cyber Essentials work is the first step, not a separate exercise.

Which do you need?

If you want a recognised security baseline, or a contract or insurer asks for it, you need Cyber Essentials. If you supply, or want to supply, the UK defence sector, you will increasingly need Defence Cyber Certification as well, at the level your contract's risk profile demands.

Common questions