A defence customer has asked for Level 1, and your first question is what needs to be included. Start with the functions your organisation depends on, then trace the systems and services behind them. A list of laptops alone will miss important dependencies.
What belongs in DCC scope?
The scope needs to cover essential functions and services needed to operate and deliver. It can extend beyond the team handling a particular MOD contract. Supporting work such as purchasing, identity management and payments may be essential too.
Ask each business owner: what would stop us delivering if it disappeared tomorrow? Record the function, its output, the consequence of disruption and its dependencies. Use that discussion to build a scope that someone outside your company can understand.
Map sites, IT, cloud services and operational technology
For an engineering supplier, begin with a drawing becoming a finished part. Trace the design files, order system, workshop equipment, inspection records, dispatch process and the people who support them. This is an illustrative way to discover dependencies, not a ready-made scope decision.
- Sites and people: offices, workshops, remote work and shared facilities.
- IT and cloud: identity, business applications, storage, networking and recovery arrangements.
- Operational technology: production or test systems, including disconnected equipment where it supports essential functions.
- External dependencies: managed IT, cloud providers, subcontractors and shared group services.
Outsourcing a function does not make the dependency disappear. Write down what your organisation controls, what the provider controls and who can supply the evidence.
Show how Cyber Essentials coverage fits
Draw the DCC boundary and show Cyber Essentials coverage separately. DCC can include offline systems and operational technology that do not fall within the same CE boundary. Check the applicable CE requirements and explain the relationship with your certification body.
Bring the current certificate and scope description. An existing certificate is a useful starting point; its name or expiry date alone does not settle whether its coverage is adequate.
- Laptops, desktops and thin clients
- Mobiles and tablets
- Servers and virtual servers
- Cloud services: IaaS, PaaS, SaaS
- Firewalls and routers
- OT, ICS and SCADA
- Air gapped networks
- Isolated test and build rigs
- Standalone CAD workstations
Make exclusions and uncertainties explicit
For each proposed exclusion, record what it does, why you believe it is outside scope and any connection to essential functions. A system being difficult to update, old or managed by someone else is a reason to investigate it carefully.
Do not assume a smaller scope is acceptable because you are applying at a lower level. Resolve the boundary with your assessor, including legal entities, shared services and site access. Use the official scoping attestation once the working brief is ready.
What about outsourced IT, group companies and offline machines?
| Situation | What to establish |
|---|---|
| Our MSP manages everything | Identify the services, responsibilities and evidence owners. Your organisation still needs to demonstrate the controls fulfilled by the provider. Ask about access to records and demonstrations early. |
| A production machine is offline | If it supports an essential function, disconnection alone does not remove it from DCC scope. Describe its role and discuss the applicable controls and any proposed compensating approach. |
| Our parent company runs identity and finance | Explain the shared services and dependencies. Agree whether the parent is included or the service is treated as an external supplier arrangement, including the evidence needed. |
| Several legal entities share systems | Name them and explain the boundary. Discuss whether a combined scope is appropriate or separate assessments can use shared evidence. |
| Only one team works on the MOD contract | Look beyond the team to the applicant organisation’s essential functions. Contract data alone does not define the DCC boundary. |
These are scoping questions to resolve, not automatic inclusion or exclusion decisions for your business. The IASME scope FAQs explain the scheme’s treatment of suppliers, shared services and operational technology.
Run a useful scoping meeting
- Invite an operations owner, IT lead and someone authorised to agree the scope.
- List essential functions and map their sites, systems and suppliers.
- Review diagrams, CE coverage and proposed exclusions together.
- Assign an owner and date to each unanswered question.
- Take the draft brief to your certification body before building the full submission.
A useful first meeting can be 45 minutes: ten minutes on the business and required level, fifteen on dependencies, ten on boundaries and ten assigning unresolved decisions. This is a suggested agenda, not an assessment timetable or a promise that scope can be settled in one meeting.
The output: a draft boundary, a dependency map and an action list. The downloadable Word brief records applicant approval and the separate official attestation; the workbook keeps functions, systems, suppliers and proposed exclusions connected.
Can we apply directly for Level 1?
Yes. You do not have to certify at Level 0 first. Confirm the level with your buyer and prepare for the Level 1 assessment against the agreed organisational scope. Existing Cyber Essentials, ISO 27001 or other assurance work may supply useful evidence, but does not automatically satisfy all DCC controls.
For Level 1, plan who will explain and demonstrate the controls as well as who will gather documents. Our Level 1 evidence guide explains how to organise that work.
DCC Level 1 scoping guide and workbook
A practical scoping guide, an editable scope brief and a workbook for functions, sites, IT, OT, suppliers and evidence.
ZIP: 5-page PDF guide, Word scope brief and Excel workbook
Preview the guide’s first page See the layout and contents before requesting it. Opens in a new tab.
Original DSC templates for you to complete. Use them alongside the official requirements; a completed template does not establish compliance.
Discuss the assessment early
DSC is an appointed certification body for DCC Levels 0 and 1. We can explain the requirements, discuss scope and assess your evidence. Under the scheme’s independence rules, we cannot implement controls or prepare answers and evidence that we will then assess; implementation support needs an appropriate separate provider arrangement.
Discuss your Level 1 scope and assessment. For an initial conversation, a high-level description is enough. We agree secure handling before you share detailed diagrams or evidence.
Official guidance and versions
This is original DSC guidance checked against the IASME public resources, including Scoping Guide v1.3 and Applicant Guide Levels 0–3 v2.2, on 24 October 2026. Use the current official documents for your assessment. The download is a working aid, not the official attestation or Assessment Submission Record.