If your organisation works on Ministry of Defence (MOD) contracts, or supplies a company that does, you will hear more and more about Defence Cyber Certification (DCC). Here's what it is, whether you need it and how to choose the right level.
What is Defence Cyber Certification?
DCC is a certification scheme created by the MOD and IASME, the organisation that also runs Cyber Essentials. It was launched in July 2025.
It independently checks that your organisation meets Def Stan 05-138, the MOD's cyber security standard for its suppliers. Instead of filling in a different security questionnaire for every contract, you get certified once and show the certificate.
Why the MOD introduced it
Attackers often target the defence supply chain because smaller suppliers can be an easier way in than the MOD itself. Since 3 December 2025, every MOD supplier has been covered by the Cyber Security Model, the MOD's risk-based approach to supply chain security. DCC is the independent proof that you meet the controls the model asks for.
How the levels work
Before a contract starts, the MOD carries out a short risk assessment and gives the work a Cyber Risk Profile from Level 0 to Level 3. The profile tells you which DCC level you need.
- Level 0 (very low risk). Cyber Essentials plus 3 additional controls. Suitable for suppliers whose work carries very little cyber risk.
- Level 1 (low to moderate risk). Cyber Essentials plus 101 controls covering areas such as governance, risk management, access control, logging and incident response.
- Level 2 (high risk). Cyber Essentials Plus plus 139 controls.
- Level 3 (substantial risk). Cyber Essentials Plus plus 144 controls, for the most sensitive work.
Level 1 is the level most suppliers need. In our experience, most defence suppliers and subcontractors are given a Low or Moderate risk profile, so Level 1 is the one most often asked for in contracts and tenders. Levels 2 and 3 are for the smaller number of organisations working on more sensitive programmes.
The level is set by the contract, so if you're unsure, ask your MOD delivery team or the prime contractor you supply. You don't need to hold a lower level before applying for a higher one.
Do you need it?
DCC isn't compulsory for everyone yet. The MOD decides which contracts require it, and prime contractors are expected to pass requirements down their supply chains. You're likely to need it if you:
- hold, or are bidding for, an MOD contract
- supply products or services to a defence prime contractor
- provide IT or managed services to defence suppliers
You can also apply without a current defence contract. Many suppliers are getting certified now so it's in place before a tender asks for it.
How certification works
- Find your level from your contract's Cyber Risk Profile.
- Agree your scope. DCC covers your whole organisation's essential functions and services, including essential cloud services, not just the systems used for MOD work.
- Make sure Cyber Essentials (or Plus) is in place and covers the internet-connected parts of your scope.
- Choose a DCC Certification Body.
- Theoretical phase. You provide evidence and context for each control. This part isn't scored, and the assessor can ask for clarification.
- Practical phase. The assessor checks that the controls are actually in place. This part is scored.
Certification lasts three years, with an annual check that your controls are still in place. Cyber Essentials or Cyber Essentials Plus still needs renewing every year.
How long does it take?
That depends mostly on how ready you are. An organisation with Cyber Essentials and good documentation can move quickly through Level 0. Level 1 and above usually needs some preparation first, such as policies, logging, supplier management and an incident response plan.
How we can help
Cambridge Cyber Security is an IASME-assured Certification Body for Cyber Essentials, Cyber Essentials Plus and Defence Cyber Certification Levels 0 and 1, the levels most suppliers need. We can help you confirm which level your contract requires, carry out a gap assessment against the controls and take you through to certification.
- Defence Cyber Certification Level 0
- Defence Cyber Certification Level 1
- Cyber Essentials and Cyber Essentials Plus
If you have a contract or tender that mentions DCC, get in touch or call us on 01223 921 300.