What Is Defence Cyber Certification (DCC)?
Defence Cyber Certification (DCC) is a UK cybersecurity certification scheme designed to improve the security and resilience of organisations supplying the Ministry of Defence (MOD) and the wider defence sector.
Developed by the MOD in partnership with IASME, DCC provides independent assurance that an organisation has implemented cybersecurity controls appropriate to the risks associated with its activities.
Unlike Cyber Essentials, which focuses primarily on protecting IT systems against common cyberattacks, DCC takes a broader view of organisational cybersecurity.
It considers how organisations manage security risks, protect their operations, respond to incidents and maintain the resilience needed to continue delivering services.
For businesses operating within the UK defence supply chain, DCC is becoming an increasingly important consideration.
But what exactly is DCC, how does it work, and what does it mean for your organisation?
Why Has Defence Cyber Certification Been Introduced?
Modern defence operations depend on a complex network of suppliers.
These include major defence manufacturers, engineering businesses, software developers, managed service providers, consultants and specialist subcontractors.
A cybersecurity incident affecting one supplier can potentially disrupt other organisations within the supply chain.
For example, an attack against a small software supplier could interrupt services used by a much larger defence contractor. Similarly, a compromised IT service provider could introduce security risks across multiple customers.
Cybersecurity therefore needs to extend beyond the MOD's own systems.
The MOD has operated a Cyber Security Model for several years to help manage these risks. However, its approach has evolved.
Earlier versions concentrated heavily on protecting MOD Identifiable Information.
Cyber Security Model Version 4 places greater emphasis on the overall cybersecurity and operational resilience of supplier organisations.
This is an important change.
An organisation might protect sensitive customer information effectively but still be vulnerable to ransomware, operational disruption or the failure of a critical supplier.
DCC provides a structured way of independently assessing whether an organisation has implemented the controls needed to manage these wider risks.
How Does Defence Cyber Certification Work?
There are three important components to understand:
1. The MOD Cyber Security Model (CSM)
The Cyber Security Model establishes how cybersecurity risks are assessed and managed within MOD procurement and the defence supply chain.
Under Version 4, a risk assessment determines the Cyber Risk Profile associated with the work being undertaken.
2. Defence Standard 05-138 Issue 4
Defence Standard 05-138 defines the cybersecurity controls that suppliers are expected to implement.
The required controls depend on the Cyber Risk Profile assigned to the contract.
3. Defence Cyber Certification (DCC)
DCC provides an independent assessment of whether an organisation meets the relevant controls within Defence Standard 05-138.
The relationship is straightforward:
The Cyber Security Model determines the level of risk.
Defence Standard 05-138 establishes the required controls.
Defence Cyber Certification provides independent assurance that those controls have been implemented.
This approach allows suppliers to demonstrate their cybersecurity capabilities through a recognised certification scheme rather than relying entirely on individual customer assessments.
However, certification does not necessarily remove all contractual assessment or reporting obligations.
What Are the Four Levels of DCC?
Defence Cyber Certification has four levels, ranging from Level 0 to Level 3.
Each level reflects the degree of cybersecurity risk associated with a supplier's activities.
Certification level | Number of controls | Intended risk profile |
|---|---|---|
Level 0 | 3 | Very low |
Level 1 | 101 | Low to moderate |
Level 2 | 139 | High |
Level 3 | 144 | Substantial |
DCC Level 0 — Foundation
Level 0 establishes a basic cybersecurity foundation.
It contains three controls and requires Cyber Essentials certification.
This level is normally associated with activities presenting very low assessed cyber risk.
Although the number of additional controls is small, Level 0 still requires an independent DCC assessment.
DCC Level 1 — Established Cybersecurity Practices
Level 1 represents a substantial increase in requirements.
With 101 controls, it examines a much wider range of organisational cybersecurity capabilities.
These include security governance, risk management, access controls, incident management and organisational resilience.
Level 1 is normally associated with low-to-moderate assessed cyber risk.
DCC Level 2 — Advanced Cybersecurity
Level 2 contains 139 controls and requires Cyber Essentials Plus.
It is intended for organisations presenting a high level of assessed cyber risk.
The requirements place greater emphasis on advanced security oversight, risk management and the effectiveness of organisational security arrangements.
DCC Level 3 — Extensive Cybersecurity Assurance
Level 3 is the highest certification level.
It contains 144 controls and also requires Cyber Essentials Plus.
This level is intended for organisations presenting substantial assessed cyber risk.
It expects expert cybersecurity capabilities and a defence-in-depth approach to protecting the organisation against evolving threats.
The required level is normally determined by the MOD or the relevant prime contractor, rather than simply by the size of the supplier.
A small organisation delivering a critical service could therefore face more demanding requirements than a much larger organisation providing a low-risk service.
We explore the individual requirements in more detail in our forthcoming article, DCC Levels Explained: Requirements for Levels 0, 1, 2 and 3.
How Is DCC Different from Cyber Essentials?
Cyber Essentials and DCC are complementary schemes, but they serve different purposes.
Cyber Essentials concentrates on five fundamental technical security areas:
Firewalls
Secure configuration
Security update management
User access control
Malware protection
These controls help organisations protect themselves against common cyberattacks.
DCC builds on this technical foundation by examining wider organisational cybersecurity and resilience.
This includes how security is managed, how risks are identified, how incidents are handled and how the organisation maintains its ability to operate.
All four DCC levels require Cyber Essentials.
Levels 2 and 3 require Cyber Essentials Plus, which includes independent technical verification of the Cyber Essentials controls.
An organisation holding Cyber Essentials certification therefore has an important starting point, but it should not assume that it already meets the wider DCC requirements.
We will explore this distinction, together with comparisons to SOC 2 and ISO 27001, in a separate article.
Is Defence Cyber Certification Mandatory?
This is one of the most important questions for organisations supplying the defence sector.
As of October 2026, DCC certification is not universally mandatory for every MOD supplier.
However, that does not mean cybersecurity compliance is optional.
Individual MOD contracts can require suppliers to meet the controls associated with their assigned Cyber Risk Profile.
These requirements form part of the MOD's contractual cybersecurity arrangements.
DCC provides a recognised method of independently demonstrating that the relevant controls have been implemented.
The MOD has also indicated that suppliers should expect increasing requirements to hold valid DCC certification during the life of their contracts.
There is an additional development for 2026.
The MOD has asked defence industry partners to achieve DCC Level 0 by 31 December 2026, including the relevant Cyber Essentials certification.
This is an important objective for the defence supply chain, although organisations should distinguish it from the specific obligations contained within their individual contracts.
Suppliers should confirm their requirements with the MOD or their contracting organisation rather than assuming that a particular certification level automatically applies.
Who Needs to Consider DCC?
DCC is relevant to organisations that supply products or services to the MOD, either directly or through the wider defence supply chain.
This can include organisations that may not traditionally consider themselves defence contractors.
For example:
Software and SaaS providers
Businesses developing or operating applications used by defence organisations may need to demonstrate appropriate cybersecurity controls.
Managed service providers
MSPs supporting defence suppliers may be responsible for systems and services that are essential to their customers' operations.
Engineering and manufacturing suppliers
Organisations providing components, engineering services or specialist manufacturing capabilities can form part of critical defence supply chains.
Professional services and consultants
Consultancies providing technology, business or specialist advisory services may also be subject to cybersecurity requirements, depending on the nature of their contracts.
Subcontractors
DCC considerations are not limited to organisations contracting directly with the MOD.
Cybersecurity requirements can extend through the supply chain.
Importantly, an organisation does not need an existing MOD contract to apply for DCC certification.
Businesses planning to enter the defence market can pursue certification proactively.
Does DCC Cover the Whole Organisation?
One of the most significant aspects of DCC is its approach to scope.
DCC is concerned with the security and resilience of the organisation, rather than only the systems handling MOD information.
The certification scope must include the essential functions and services required for the organisation to operate securely and resiliently.
This may include:
Internal IT systems and infrastructure.
Business-critical cloud applications.
Security policies and management processes.
Essential operational services.
Relevant supplier management arrangements.
Not every activity within an organisation must necessarily be included.
However, exclusions need to be justified, and the certification body will review the proposed scope.
For organisations relying heavily on cloud services, outsourcing or managed service providers, this is particularly important.
Using a third-party service does not automatically remove responsibility for demonstrating that the relevant security controls are satisfied.
How Long Does DCC Certification Last?
DCC certification is valid for three years, subject to ongoing requirements.
During that period, organisations must maintain their relevant cybersecurity controls.
They must also:
Renew Cyber Essentials or Cyber Essentials Plus annually.
Complete an annual attestation confirming that the DCC controls continue to be met.
Complete a full DCC reassessment every three years.
Significant changes affecting the certification scope may also need to be reviewed with the certification body.
This means DCC should not be treated as a one-off compliance exercise.
Cybersecurity controls need to remain effective as the organisation changes, adopts new technologies and introduces additional suppliers.
How Should Organisations Prepare for DCC?
For organisations considering certification, the starting point should be understanding their existing cybersecurity position.
A practical approach involves five stages.
1. Establish the required level
Confirm the applicable Cyber Risk Profile with the MOD or relevant prime contractor.
Organisations preparing for future defence opportunities can also choose to pursue certification proactively.
2. Review existing certifications
Identify whether the organisation already holds Cyber Essentials, Cyber Essentials Plus, ISO 27001 or other relevant security assurance.
Existing policies, processes and evidence may support the DCC assessment.
3. Assess the gaps
Compare existing security arrangements against the requirements of Defence Standard 05-138 for the relevant level.
This should identify controls that are already satisfied and those requiring further work.
4. Develop an improvement plan
Prioritise the changes needed to address identified gaps.
These may involve technical controls, management processes, documentation or operational procedures.
5. Arrange independent assessment
Work with an IASME-approved DCC certification body to complete the certification process.
The time required will depend on the organisation's existing cybersecurity maturity, the certification level and the extent of any remediation work.
Defence Cyber Certification Is About More Than Compliance
The introduction of DCC reflects an important shift in how cybersecurity is viewed within the defence supply chain.
Protecting individual systems remains essential, but organisations must also consider their ability to withstand incidents and continue operating.
That requires appropriate governance, risk management, security controls and operational resilience.
For some organisations, achieving DCC certification may require relatively modest changes.
For others, particularly those seeking Level 1 or higher certification, it could involve significant improvements to how cybersecurity is managed.
The objective should not simply be obtaining a certificate.
It should be establishing cybersecurity practices that are appropriate to the organisation's risks and sustainable over time.
What Should Your Organisation Do Next?
If your organisation already supplies the MOD or a defence prime contractor, establish which cybersecurity requirements apply to your contracts.
If you are considering entering the defence supply chain, review your existing cybersecurity arrangements and identify whether DCC certification would support your commercial objectives.
In either case, understanding the requirements early can help avoid unexpected costs, delays and procurement difficulties.
Independent Technology and Cybersecurity Guidance
SystemAssure provides independent technology strategy and advisory services to businesses navigating technology, security and operational challenges.
If you need help understanding how DCC requirements could affect your organisation, assessing your current capabilities or developing a practical improvement roadmap, we can help you identify the appropriate next steps.
Frequently asked Questions
Further Reading
IASME — Defence Cyber Certification
The official scheme overview, including certification levels and prerequisites.
IASME — DCC Frequently Asked Questions
Detailed guidance on certification requirements, scope, assessments and renewal.
Official guidance on Cyber Security Model Version 4 and its relationship with DCC.
MOD — Cyber Security Model Question Sets
Published Supplier Assurance Questionnaires for the four risk levels.
