Who Needs Defence Cyber Certification (DCC)? UK Guide

Defence Cyber Certification (DCC) is becoming increasingly important for organisations supplying the UK Ministry of Defence (MOD). But does it apply to every defence supplier, and what about smaller businesses, subcontractors, software providers and consultants?

The answer is not always straightforward.

Many organisations associate defence cybersecurity requirements with major defence manufacturers or businesses handling classified information.

In reality, the modern defence supply chain extends much further.

Software developers, managed IT service providers, engineering companies, professional services firms and specialist subcontractors can all play important roles in delivering defence capabilities.

A cyberattack against any one of these organisations could potentially disrupt a much larger defence operation.

This is why the MOD has introduced Defence Cyber Certification, working with IASME, to provide independent assurance of supplier cybersecurity and resilience.

However, there is an important distinction between being required to comply with defence cybersecurity controls and being required to hold DCC certification.

Understanding that distinction is the starting point for determining what your organisation needs to do.

Is Defence Cyber Certification Mandatory?

As of November 2026, DCC certification is not universally mandatory for every organisation supplying the MOD.

However, suppliers may already have contractual obligations to meet cybersecurity requirements under the MOD's Cyber Security Model (CSM).

The current Cyber Security Model Version 4 uses Defence Standard 05-138 Issue 4 to establish the cybersecurity controls that suppliers must satisfy, according to the risks associated with their contracts.

DCC provides an independently assessed way of demonstrating compliance with those controls.

The MOD has indicated that requirements to hold DCC certification will become increasingly common within defence procurement.

Where certification is explicitly required by a contract, suppliers must address that obligation.

There is also an important deadline approaching.

The MOD has asked all defence industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials certification for applicable business-critical systems.

This is an MOD-wide objective, but it should not be confused with a universal statutory requirement applying automatically to every business.

The specific requirements for individual suppliers remain dependent on their contracts and associated cybersecurity risk assessments.

Which Types of Businesses Need to Consider DCC?

DCC is relevant to a much wider range of organisations than traditional defence manufacturers.

The deciding factor is generally the organisation's relationship with MOD contracts and the cybersecurity risk associated with the services or products it supplies.

1. Direct MOD Suppliers

Organisations contracting directly with the MOD are the most obvious group.

These may include defence manufacturers, engineering companies, logistics providers, technology suppliers and specialist service providers.

Under Cyber Security Model Version 4, the MOD assesses the cybersecurity risk associated with the contract and assigns a Cyber Risk Profile.

This determines which Defence Standard 05-138 controls the supplier must satisfy.

The organisation may then be required to demonstrate compliance through the Supplier Assurance Questionnaire (SAQ), DCC certification or other arrangements specified in the procurement process.

Importantly, the required level is determined by the risk associated with the work, not simply the size of the supplier.

2. Subcontractors to Defence Suppliers

One of the most significant aspects of the MOD's cybersecurity approach is that requirements can extend through the supply chain.

A business does not necessarily need a direct contract with the MOD to be affected.

Consider an engineering company supplying components to a major defence manufacturer.

That engineering company might outsource part of its manufacturing process to another specialist business.

Cybersecurity requirements can extend from the prime contractor through both levels of subcontracting.

This process is known as flow down.

Under Cyber Security Model Version 4, suppliers are responsible for assessing the cybersecurity risk associated with relevant subcontracts and communicating the resulting requirements.

Each subcontract is assessed according to its own risk.

This means a subcontractor does not automatically inherit the same DCC level as its customer.

A smaller supplier could be assigned a higher or lower level depending on the nature of its activities and their potential impact.

Organisations should therefore review the cybersecurity provisions within their contracts rather than assuming that indirect suppliers are excluded.

3. Software and SaaS Providers

Software companies may not traditionally consider themselves defence contractors.

However, software is increasingly important to defence operations.

A SaaS application could support project management, engineering, asset management, logistics, procurement or other operational activities.

If the application becomes unavailable or compromised, it could affect the ability of a defence supplier to deliver its contractual obligations.

Consequently, software and SaaS providers supporting MOD contracts may fall within the scope of defence cybersecurity requirements.

The precise obligations depend on the contractual relationship, the services provided and the relevant Cyber Risk Profile.

For SaaS businesses, this raises additional questions.

For example, what happens when the application is hosted by a third-party cloud provider?

Does the SaaS provider remain responsible for cybersecurity controls?

How should the organisation account for outsourced infrastructure, development platforms and other critical services?

The important principle is that outsourcing infrastructure does not automatically transfer all cybersecurity responsibility to the cloud provider.

The SaaS business must understand which security responsibilities it retains and how it can demonstrate that applicable controls are satisfied.

We will explore these issues in a dedicated article on DCC for SaaS providers and MSPs.

4. Managed Service Providers and IT Support Companies

Managed service providers (MSPs) are another important category.

An MSP may manage the IT infrastructure, cloud services, user identities, endpoint devices or cybersecurity systems of a defence supplier.

Depending on its responsibilities, an MSP could have privileged access to systems that are essential to its customer's operations.

A compromise affecting the MSP could therefore have consequences beyond the MSP's own business.

Where an MSP forms part of the delivery chain for an MOD contract, relevant cybersecurity requirements may be passed down through the contractual arrangements.

This is particularly important for MSPs supporting multiple defence-sector customers.

A recognised cybersecurity certification could help demonstrate a consistent level of organisational security across those relationships.

However, DCC certification does not automatically replace every customer-specific contractual or assurance obligation.

5. Engineering and Manufacturing Businesses

Defence supply chains depend on many specialist engineering and manufacturing businesses.

Some produce complete systems, while others supply individual components, materials or specialist services.

Even where these organisations do not handle classified information, cybersecurity incidents can still affect their ability to operate.

For example, ransomware could interrupt production, compromise engineering systems or delay the delivery of critical components.

Cyber Security Model Version 4 places greater emphasis on organisational resilience rather than focusing exclusively on protecting MOD information.

Consequently, the security and resilience of manufacturing and operational systems may be relevant to the organisation's assessed risk.

The required controls will depend on the contract and the organisation's role within the supply chain.

6. Consultants and Professional Services Firms

DCC can also be relevant to organisations providing consultancy and professional services.

These might include technology advisers, project managers, engineering consultants, business analysts and other specialist contractors.

The fact that a company provides advice rather than physical products does not automatically exclude it from defence cybersecurity requirements.

For example, a consultancy might have access to commercially sensitive project information, use systems connected to a customer's environment or deliver services essential to a defence programme.

On the other hand, a consultancy providing a limited, low-risk service might be assigned a relatively low Cyber Risk Profile.

The nature of the engagement and the contractual assessment are what matter.

Does DCC Apply to Small Businesses?

Yes. Small businesses can be subject to DCC requirements.

There is no general exemption simply because an organisation has relatively few employees or limited turnover.

However, DCC is designed around different levels of assessed cybersecurity risk.

The four certification levels are:

This risk-based approach is particularly important for SMEs.

A small business delivering a relatively low-risk service may face less demanding requirements than an organisation responsible for a critical operational capability.

Equally, a small company delivering a highly sensitive or business-critical service could be assigned a higher level.

Business size alone does not determine the required DCC certification level.

Who Decides Which DCC Level Is Required?

For direct MOD contracts, the MOD's Cyber Security Model risk assessment determines the Cyber Risk Profile.

For relevant subcontracts, the contracting supplier performs a flow-down risk assessment to establish the appropriate requirements.

The four levels correspond to increasing cybersecurity risk.

A supplier should not simply assume that Level 0 is sufficient because it is a small organisation or because it already holds Cyber Essentials.

Equally, an organisation should not assume that Level 3 is necessary merely because it supplies a large defence contractor.

The appropriate level depends on the assessed risk.

Organisations can voluntarily pursue DCC certification even if they do not currently hold a defence contract.

This may be useful for businesses planning to enter the defence supply chain.

However, voluntary certification should be approached carefully.

Obtaining a higher certification level than necessary could introduce additional costs and administrative requirements without delivering a corresponding commercial benefit.

What If You Already Have Cyber Essentials, ISO 27001 or SOC 2?

Many organisations already maintain cybersecurity certifications or independent assurance reports.

These can provide a useful foundation for DCC.

Cyber Essentials is particularly relevant because it is a prerequisite for all DCC levels.

Cyber Essentials Plus is required for Levels 2 and 3.

ISO 27001 and SOC 2 may also provide evidence of existing security governance, risk management, incident response and other controls.

However, neither ISO 27001 certification nor a SOC 2 report automatically replaces DCC.

An organisation must still demonstrate that it satisfies the applicable Defence Standard 05-138 controls.

The practical opportunity is to reuse existing policies, processes and evidence wherever they meet the requirements, rather than creating completely separate cybersecurity management systems.

We will explore this in our forthcoming comparison of DCC, Cyber Essentials, SOC 2 and ISO 27001.

What Happens If a Supplier Cannot Meet the Requirements?

An organisation that does not currently satisfy all the required controls may still have a route towards compliance.

Under Cyber Security Model Version 4, the MOD provides a Cyber Improvement Plan (CIP) process.

A CIP identifies the areas where the supplier does not yet meet the required controls and sets out how and when those gaps will be addressed.

The plan can be considered as part of the procurement and contractual process.

However, submitting a CIP does not automatically guarantee that a supplier will be accepted.

The contracting authority must consider whether the proposed improvements and timescales are acceptable.

Organisations should therefore identify potential gaps as early as possible, particularly before responding to a tender.

Waiting until a procurement deadline could leave insufficient time to implement essential controls or arrange certification.

Do You Need DCC Before Bidding for an MOD Contract?

Not necessarily.

The MOD's current guidance allows suppliers to participate in procurement through the Cyber Security Model assessment process, subject to the applicable requirements.

For a new MOD opportunity, the contracting authority normally provides a Cyber Risk Profile and Risk Assessment Reference.

The prospective supplier then completes a Supplier Assurance Questionnaire using the MOD's Supplier Cyber Protection Service.

If the supplier cannot demonstrate compliance, it may need to submit a Cyber Improvement Plan.

Where a tender explicitly requires DCC certification, the supplier must address that condition.

It is also important to understand that holding a valid DCC certificate does not currently remove the requirement to complete the full Supplier Assurance Questionnaire.

Certification provides independent evidence of compliance with the relevant controls, but the MOD's procurement and contract assurance processes still apply.

Should You Obtain DCC Before You Need It?

For organisations already supplying the defence sector, the first step should be establishing their existing contractual obligations.

For businesses planning to enter the market, there may be commercial advantages to preparing in advance.

Certification could help demonstrate that the organisation takes cybersecurity seriously and has independently assessed controls in place.

It may also reduce the need to repeatedly demonstrate the same organisational controls to different customers.

However, certification involves both initial and ongoing costs.

A sensible approach is to assess likely customer requirements, review existing cybersecurity capabilities and determine whether proactive certification would be proportionate.

For some organisations, achieving Cyber Essentials and preparing for DCC Level 0 may be an appropriate starting point.

For others, particularly those intending to deliver higher-risk services, a more comprehensive assessment may be necessary.

How Can You Tell Whether Your Organisation Needs DCC?

If you are uncertain about your position, start with five questions:

1. Do you supply the MOD directly or provide products or services supporting an MOD contract?

2. Does your contract include Defence Standard 05-138, DEFCON 658 or other defence cybersecurity requirements?

3. Has your customer provided a Cyber Risk Profile or Risk Assessment Reference?

4. Are you required to complete a Supplier Assurance Questionnaire or hold a particular DCC certification level?

5. Could a cybersecurity incident affecting your organisation disrupt the delivery of a defence-related service or product?

These questions will not replace a formal contractual risk assessment, but they can help identify whether further investigation is necessary.

If you are already part of the defence supply chain and have not received a Cyber Risk Profile or Risk Assessment Reference, ask your customer to clarify the applicable requirements.

What Should Your Organisation Do Next?

Defence Cyber Certification is not exclusively a concern for large defence contractors.

Smaller suppliers, subcontractors, software companies, MSPs and professional services firms may all be affected.

The key is understanding the relationship between your organisation's activities, the relevant MOD contracts and the cybersecurity risks involved.

For existing defence suppliers, the priority should be confirming contractual requirements and reviewing current compliance.

For organisations considering entering the defence sector, an early cybersecurity readiness assessment can help identify potential obstacles before they affect commercial opportunities.

With the MOD's Level 0 objective approaching on 31 December 2026, now is a sensible time to review your position.

Frequently Asked Questions

Independent Technology and Cybersecurity Guidance

SystemAssure provides independent technology strategy and advisory services, helping businesses understand technology risks, assess existing capabilities and develop practical improvement plans.

If you are uncertain how Defence Cyber Certification could affect your organisation, SystemAssure can help you review your requirements, identify potential gaps and determine the appropriate next steps.

Discuss a Technology Challenge

This article is part of the SystemAssure Defence Cyber Certification series. Read our introductory article, What Is Defence Cyber Certification (DCC)?, and look out for our next article explaining DCC Levels 0, 1, 2 and 3.

Information reflects published MOD and IASME guidance as of November 2026. Specific contractual requirements should always be confirmed with the relevant contracting authority.