Defence suppliers: Cyber Essentials and DCC Level 0

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. What Defence Cyber Certification (DCC) is

Defence Cyber Certification (DCC) is the cyber security certification framework developed by the UK Ministry of Defence (MOD) and delivered by IASME. It replaces repetitive, contract-by-contract security questionnaires with an independent, evidence-based certification aligned to Defence Standard 05-138 (Def Stan 05-138 Issue 4). A DCC certificate lasts three years, subject to annual check-ins and maintaining your Cyber Essentials certificate continuously.

DCC has four levels corresponding to the assessed cyber risk profile of the supplier (URM Consulting, IASME DCC FAQ):

• DCC Level 0: For organisations with a very low assessed cyber risk. Requires a valid Cyber Essentials certificate plus compliance with three basic controls from Def Stan 05-138 Issue 4 (for example, Control 2134: Ensure UK GDPR Compliance, including conducting Data Protection Impact Assessments against the data types stored or processed). To pass Level 0, 100% of the controls must be fully implemented.
• DCC Level 1: For low-to-moderate cyber risk. Requires 101 controls from Def Stan 05-138 Issue 4 in addition to Cyber Essentials (minimum 80% score per objective).
• DCC Level 2: For high assessed cyber risk. Requires 139 controls in addition to Cyber Essentials Plus (minimum 80% score per objective).
• DCC Level 3: For the highest assessed cyber risk. Requires all 144 controls in Def Stan 05-138 Issue 4 (100% required) in addition to Cyber Essentials Plus.

2. How DCC scope differs from a narrow Cyber Essentials scope

One of the most common pitfalls for defence suppliers is scoping. Whereas basic Cyber Essentials allows you to certify a segregated sub-set of your network if you wish, DCC requires you to certify all parts of your organisation that are essential to its operation — ideally your whole organisation. If your Cyber Essentials certificate only covers a small sub-network and leaves out core systems used to run the business, it will not satisfy your DCC assessor.

3. Why subcontractors are being asked right now

Even if your business never bids directly to the MOD, if you supply engineering parts, specialist software, logistics, surveying or professional services to a defence prime contractor (such as BAE Systems, Airbus, Babcock, QinetiQ, Thales or General Dynamics in South Wales and across the UK), their supply-chain assurance teams flow the requirement down to you.