DCC Level 0: what defence suppliers need to know

The Ministry of Defence has asked its industry partners to achieve Defence Cyber Certification (DCC) Level 0. That request covers the whole supply chain, not just the primes, and it includes holding Cyber Essentials for the business-critical systems in scope.

Here is what Level 0 involves, where organisations tend to get caught out, and what to do now.

What DCC is

DCC is the MOD's cyber security certification for its suppliers. It was developed with IASME, the body that also runs Cyber Essentials, and it assesses organisations against Defence Standard 05-138 Issue 4.

There are four levels, each matched to how much cyber risk a supplier's work carries:

• Level 0: very low risk, 3 controls
• Level 1: low to moderate risk, 101 controls
• Level 2: high risk, 139 controls
• Level 3: substantial risk, 144 controls

Every level requires Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus. A certificate at a higher level also covers the levels below it, so one certificate can cover all your contracts up to that level.

IASME still describes DCC as not mandatory in every case. In practice, though, the MOD's request makes Level 0 the baseline it expects from anyone supplying into defence, and contracts are increasingly written around it.

Three things that catch people out

It is not a self-assessment. Unlike Cyber Essentials, no level of DCC is self-assessed, Level 0 included. An independent DCC Certification Body reviews your evidence and verifies that the controls are working in practice.

It covers your whole organisation. Your DCC scope is everything essential to running your business, whether it supports defence work or not. You can't limit it to the team or network that handles an MOD contract, and cloud services you depend on are in scope too.

Your Cyber Essentials scope has to line up. Any internet-connected system inside your DCC scope must also be covered by your Cyber Essentials certificate. Many organisations certified Cyber Essentials for a single office or network years ago, and that narrower scope won't stretch to cover DCC.

How the assessment works

You start by writing a statement of scope: what's in, what's out, and why. Your assessor will challenge it, so it needs to be clear and logical.

The assessment itself has two phases. In the first, you explain how you meet each control and submit your evidence. This phase isn't scored; it gives you a chance to clarify answers and fix gaps before the scored part. In the second, the assessor checks that the controls are actually in place.

Once certified, you renew Cyber Essentials every year, confirm each year that you're still meeting the DCC controls, and recertify DCC every three years.

What to do now

1. Confirm the level you need. The MOD or your prime contractor decides this, based on the cyber risk of the work. For most suppliers, Level 0 is the immediate requirement.
2. Check your Cyber Essentials. Is it current, and does its scope cover everything your DCC scope will? Remember that the Cyber Essentials rules tightened in April 2026: multi-factor authentication on cloud services and installing critical updates within 14 days are now automatic-fail questions.
3. Read the scheme guidance. IASME publishes an applicant guide and a scoping guide for each level. They include example answers, and they're worth an hour of anyone's time before starting.
4. Draft your scope early. Scoping takes longer than people expect, particularly where group companies, shared IT or outsourced services are involved.
5. Book your assessment. Certification bodies' diaries fill up as contract deadlines approach, and you may need time between the two phases to close gaps.

A note on independence

A DCC Certification Body can help you identify gaps, but if it is also your assessor, it can't implement or manage your security for you. That separation protects the integrity of the scheme. If you need hands-on remediation work, plan for who will do it alongside your assessment.

How CSIQ can help

CSIQ is an IASME-approved Certification Body for DCC Level 0, as well as for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance. We can help you set a sensible scope, get Cyber Essentials in place or extend it, and carry out your Level 0 assessment.

If you supply into defence and aren't sure where you stand, get in touch for a straight answer on what you need and how long it will take.