For UK defence suppliers
Defence Cyber Certification Level 1.
DCC Level 1 assessment by an appointed certification body.
DCC Level 1 covers 101 controls, with documented evidence and practical verification. We assess UK defence suppliers against the Level 1 requirements. Get a scoped assessment quote, with preparation and remediation identified separately.
Our DCC appointment covers Levels 0 and 1. Level 1 assessment includes documented evidence review and practical verification.
Daniel McClure Fisher, our Managing Director, is an approved DCC Level 1 assessor.
DCC Level 1 certification.
We agree the work around your current controls and procurement deadline. You get a record of the gaps, the evidence needed and who is responsible for each action.
Preparing for Level 1
Scope the organisation, review gaps against the 101 controls and organise evidence for the Assessment Submission Record. Rehearse the practical demonstration and record the actions still needed.
Your appointed assessment body
DSC is appointed to assess and certify DCC Level 1. Your quote defines evidence review, practical verification, any site visits, clarification rounds and the impartiality arrangements. Certification follows a successful assessment.
Your Cyber Essentials position
Cyber Essentials is required at every DCC level. Check the scope and expiry of your current certificate as part of the preparation.
Declared roles and prior work
Level 1 requires a conflict of interest statement. Preparation work and prior services are declared. A certification body cannot assess answers or evidence it prepared itself.
Assessment prices
Your certification.
Your price.
See the assessment cost before you enquire. Add Cyber Essentials if you need it. Preparation and remediation are separate work.
Level 1 is a fixed quote after scoping. The assessment price covers your agreed evidence review, practical verification, visits where required and clarification rounds. Organisation size alone cannot price that work. We discuss your scope without charge and identify any preparation costs separately.
No contact details needed to see a price. We check the scope and confirm your written quote before you order.
DCC Level 0 assessment
From + VAT
Free scoping conversation · Reply within one working day
DCC Level 0 price list
One-off assessment, including the IASME DCC certification fee. All prices exclude VAT. Certification follows a successful assessment.
| Organisation | DCC Level 0 | DCC + Cyber Essentials |
|---|---|---|
| Micro 0–9 employees | £495 | £815 |
| Small 10–49 employees | £595 | £1,035 |
| Medium 50–249 employees | £795 | £1,295 |
| Large 250+ employees | From £995 | From £1,595 |
Included: scope review, Cyber Essentials alignment check, portal onboarding, assessment and certification on a pass. Clarification rounds and submission terms are agreed in your quote.
Separate costs: preparation, remediation, reassessment and changes to scope. Annual DCC attestation and annual Cyber Essentials renewal are quoted before you commit; they are outside this initial assessment price.
For larger or more complex scopes: multiple legal entities, business units or unusual assessment requirements need a scoped quote. Tell us before ordering. Level 1 is priced after scoping its 101 controls and practical verification.
Cyber Essentials pricesCyber Essentials Plus pricesDCC Level 1 assessmentDiscuss your scope
The 101 controls in DCC Level 1
Def Stan 05-138 Issue 4 holds 148 controls across four objectives. Level 1 uses 101 of them, and they are not spread evenly.
The objectives are the NCSC Cyber Assessment Framework's, which is why work you have already done on CAF alignment is not wasted here. If you have run a CAF self-assessment, you have a usable head start on Objectives C and D in particular.
Two things follow from the shape of that table. Objective C is the one that catches people: nine controls sounds small, but monitoring and detection cannot be written into existence the week before an assessment, and there is no partial credit route around a control scoring zero. And Objective A is where a small engineering firm usually has the least documentation, because governance artefacts are the ones nobody needed until a prime asked.
What changes when you leave Level 0 behind
The control count is the least of it. The process itself is different.
How DCC Level 1 is scored
Every control is scored 0 if it is not met, 1 if it is partially met, and 2 if it is fully met. To pass Level 1 you must satisfy both of these, per objective:
- At least 80% of the total points available in that objective, and
- Every control in that objective at least partially met, so nothing scores zero.
Take an objective with 10 controls. The maximum is 20 points, so you need 16. Ten controls fully met gets you 20. Nine full and one partial gets 19. Six full and four partial gets exactly 16, and passes. Five full and five partial gets 15, and fails on the threshold.
Now the part that catches people. Seven full, two partial and one not met also reaches 16 points, and still fails, because a control scored zero fails the objective outright however good the arithmetic looks. One neglected control sinks an objective that was otherwise comfortably clear.
This is the difference between Level 1 and Level 0, where 100% of controls must be fully met and there is no partial credit at all. Level 1 gives you room to be imperfect, but no room to have a gap.
Prepare your organisation for assessment
Start with your current scope and evidence. You can apply directly for Level 1; holding Level 0 first is not a prerequisite.
Scope, and the diagrams that prove it
The boundary, the business organisation and network diagrams, the system lists, and which systems sit inside Cyber Essentials. An inadequate scope fails an assessment on its own, before a single control is marked.
Gap analysis across all 101
Review the requirements with your team or independent implementation provider. Record gaps and owners honestly; the formal assessment determines the scores.
Close the gaps
Governance artefacts written, monitoring and detection stood up, response and recovery tested rather than documented. Your own team or a separate technology provider completes implementation. A certification body cannot implement controls or prepare evidence it will later assess.
Build the submission, then rehearse it
The Assessment Submission Record assembled with evidence referenced to the exact section that supports each answer, then a dry run of the practical demonstration, so the first time you are asked to show a control is not in front of your assessor.
We provide a fixed assessment quote after a free scoping conversation. Your entities, sites, systems, evidence and practical verification requirements determine the work. We identify any preparation or remediation separately and discuss a realistic assessment timetable before you commit.
If it turns out you need Level 0 rather than Level 1, we will say so. DCC provides organisation-level evidence, but the full Supplier Assurance Questionnaire remains required under current MOD guidance. The level should follow your procurement requirement and scope.
Common questions
Can you help us with DCC Level 1?
Yes. DSC is an appointed certification body for DCC Levels 0 and 1. We assess your evidence and verify your Level 1 controls in practice. We explain the requirements and agree scope, with the required conflict of interest declaration. Implementation and evidence preparation must be handled independently of the DCC assessment; we cannot assess work we prepared ourselves.
How many controls are in DCC Level 1?
101. One is Cyber Essentials, 12 are in Objective A (managing security risk), 75 in Objective B (protecting against cyber attack), nine in Objective C (detecting cyber security events) and four in Objective D (minimising the impact of incidents). Def Stan 05-138 Issue 4 holds 148 controls in total, and no single level uses all of them.
What is the pass mark for DCC Level 1?
Two conditions, both required, assessed per objective: at least 80% of the points available in that objective, and no control scoring zero. Controls are marked 0 for not met, 1 for partially met and 2 for fully met. Reaching 80% does not save you if a single control is not met at all, which is the rule most people miss.
How is Level 1 different from Level 0?
Level 0 is three controls, marked once, through a portal, at 100% with no partial credit. Level 1 is 101 controls in an Assessment Submission Record, marked twice through theoretical then practical scoring, including a live demonstration of your controls and possibly a site visit, at 80% per objective with nothing at zero. Level 1 also requires a conflict of interest declaration and the hashing of your submission. The Level 0 portal route cannot be used to reach Level 1.
Do we need Level 0 before Level 1?
No. You can apply at any level under the current scheme, and Level 1 contains Level 0's controls anyway. But the Level 0 portal route specifically cannot be used to aim at a higher level, so if you know you need Level 1, start on the Levels 1 to 3 process rather than certifying Level 0 and expecting to upgrade it.
Does Level 1 need Cyber Essentials Plus?
No. Control 0002, Cyber Essentials Plus, applies at Levels 2 and 3. Level 1 needs basic Cyber Essentials under control 0001, covering the right scope and maintained for the life of the certificate. We are an appointed certification body for Cyber Essentials and Cyber Essentials Plus, as well as DCC Levels 0 and 1. Any Level 2 or Level 3 DCC assessment needs a body appointed for that level.
Will there be a site visit?
Possibly. Practical scoring always includes a remote demonstration of your controls over teleconference. An in-person site visit happens where one was identified during scoping. Either way you should raise site inductions, staff availability and clearance requirements early, because an assessor who runs out of time marks the remaining controls as not met.
If you help us prepare, can you still assess us later?
Not for work we would then be marking. The scheme is explicit: a certification body cannot complete documentation or prepare answers or evidence that it will later assess. Helping you achieve Cyber Essentials is permitted and is declared in the conflict of interest statement. The assessment route is agreed before preparation starts, so work that DSC prepares can be assessed by another appropriately appointed certification body.
Discuss your DCC Level 1 requirement.
Tell us the required level, your organisation's size, sites, current Cyber Essentials position and target date. We will confirm the assessment scope and provide a written quote. Any preparation work is identified separately.