Defence Cyber Certification Level 0, done before December.
The Ministry of Defence has asked all industry partners to achieve Defence Cyber Certification Level 0 by 31 December 2026. Level 0 requires Cyber Essentials for your business-critical systems. We are an appointed certification body for both, so the whole requirement is met by one team, and assessed by the people who helped you prepare.
Defence Cyber Certification, and the date the MOD has asked for.
In May 2026 the Ministry of Defence's Director of Cyber Defence and Risk asked all industry partners to achieve DCC Level 0 certification by 31 December 2026. If you supply the MOD, directly or through a prime, this is the floor.
Defence Cyber Certification is the MOD's assurance scheme for its supply chain, built with IASME as the scheme's Certification Authority. It evidences compliance with the Cyber Security Model, and the controls behind it sit in Defence Standard 05-138 Issue 4. It comes at four levels, 0 to 3, matched to the Cyber Risk Profile assigned to your contract.
Four steps, and we run all of them.
Most suppliers are closer than they think. The work is usually evidence and scope rather than new technology.
Scope the systems that matter
We identify your business-critical systems and agree what sits inside the boundary. Getting scope right is the difference between a clean assessment and a re-run, and it is where most of the argument happens.
Certify Cyber Essentials
Level 0 requires it, and we are an appointed Cyber Essentials certification body, so the assessment happens here rather than being handed to a third party. If you already hold it, we check it covers the right scope.
Close the gaps against Def Stan 05-138
We review your controls and evidence against the standard, tell you plainly what is missing, and fix it if you want us to. You get the list either way.
Assess and certify Level 0
We assess and issue the certificate as an appointed DCC certification body for Level 0. Then the annual check in keeps it live across the three year term.
Which levels we certify, and which we do not.
Plainly, because you should not have to ask twice. Our appointment covers Level 0 today, with Level 1 following.
DCC does not replace your Supplier Assurance Questionnaire.
You will find suppliers, and a fair number of cyber firms, saying that Defence Cyber Certification removes the need to complete a Supplier Assurance Questionnaire. As things stand, that is not correct.
The MOD's own guidance is explicit: suppliers holding a valid DCC certificate are not yet exempt from completing elements of the SAQ, and completion of the full SAQ to the required level remains mandatory. The intention is that DCC and the SAQ converge over time, and the MOD has said it hopes to bring DCC into the online tooling. It has not happened yet.
What that means practically: budget for both this year. Do the DCC Level 0 work because the MOD has asked for it and because it genuinely raises the floor the SAQ measures, and keep completing the SAQ as your contract requires. If someone tells you the certificate gets you out of the questionnaire, check the date on their advice.
Fixed by size. Cyber Essentials in the price.
Every DCC quote in this market has a Cyber Essentials cost inside it, because Level 0 requires the certification. Most providers itemise it separately or price it in, because they are not a Cyber Essentials certification body and have to buy that part in. We are. So it is included.
That is the whole certificate cost. No separate Cyber Essentials invoice, no IASME fee added at the end, and no surcharge for a single agreed scope. We are not cheaper because the assessment is thinner. We are cheaper because there is one less company involved.
Where remediation is needed to close gaps, it is quoted separately and you decide whether we do it or you do. You get the findings either way, so you are not buying a report you then have to buy again.
The three year picture. A DCC certificate lasts three years with an annual attestation, and Cyber Essentials recertifies annually. So the honest total is the initial fee plus the annual Cyber Essentials recertification across the term, not a single number. We set the three year figure out in writing before you commit, because a surprise in year two is not a surprise we want to be responsible for.
Earlier is cheaper in the way that matters. The MOD has asked industry to reach Level 0 by 31 December 2026, which means the whole supply chain is working to one date. Certification bodies have finite assessor capacity, so lead times stretch as the date approaches. The cost does not change; the risk of not holding a certificate in January does.
Two appointments, one team. We are an appointed certification body for Cyber Essentials and for DCC Level 0, an NCSC Assured Service Provider under the Cyber Advisor scheme, and we hold UKAS certified ISO 27001 and ISO 9001. Our assessors work to these standards every day, so the gap review tells you what an assessment actually looks for rather than what a checklist says. Where separation of duties matters, we will say so and keep the roles apart.
Common questions
Do we need Cyber Essentials before DCC Level 0?
Yes. Level 0 includes obtaining Cyber Essentials for all applicable business-critical systems within scope, so it is part of the certification rather than a nice to have alongside it. We are an appointed Cyber Essentials certification body, so we can certify that part too. If you already hold Cyber Essentials, the first thing we check is whether its scope covers the systems DCC cares about, because the two scopes are set separately and often differ.
What is the deadline for DCC Level 0?
In May 2026 the MOD's Director of Cyber Defence and Risk asked all industry partners to achieve Level 0 DCC certification by 31 December 2026. It is a request rather than a contractual mandate, but treat it as the date your customers will start asking about, and check your own contract conditions, because DCC requirements are specified at tender.
Can you certify us to Level 1, 2 or 3?
Not today. Our appointment covers Level 0. Our Level 1 assessor training is booked for October 2026, so we expect to assess Level 1 from late 2026. We do not assess Levels 2 or 3. We will prepare you, certify the Cyber Essentials Plus those levels require, and point you to a certification body that does the DCC assessment.
Does DCC replace the Supplier Assurance Questionnaire?
No, not currently. MOD guidance states that suppliers with a valid DCC certificate are not yet exempt from completing elements of the SAQ, and that completion of the full SAQ to the required level remains mandatory. Plan for both.
How long does DCC certification last?
Three years, with an annual check in to confirm nothing significant has changed in the interim. Cyber Essentials, which Level 0 requires, recertifies annually, so in practice you have a yearly touchpoint and a three yearly recertification.
What is Def Stan 05-138?
Defence Standard 05-138 is where the actual controls sit. DCC assesses you against it, and Issue 4 is the current version. It lists the cyber security controls required for each Cyber Risk Profile, so the set that applies to you depends on the profile assigned to your contract. We have written up what it asks for in Def Stan 05-138 explained.
We are a subcontractor, not a prime. Does this apply to us?
Usually yes. Cyber requirements flow down the supply chain through contract conditions, and DEFCON 658 explicitly contains the obligations suppliers must place upon their subcontractors. If a prime has sent you a questionnaire mentioning DEFCON 658, a Cyber Risk Profile or Def Stan 05-138, this applies to you.
Let us make Level 0 dead simple.
Tell us who you supply and what you already hold, and we will tell you what Level 0 needs from you and how long it will take. You speak to an engineer and an assessor, not a salesperson.