Defence Cyber Certification (DCC)
Defence Cyber Certification (DCC)
Defence Cyber Certification (DCC) is the UK Ministry of Defence assurance framework designed to improve cyber resilience across the defence supply chain. Delivered through IASME, DCC provides organisation-wide assurance and replaces the previous DCPP assurance approach with a more comprehensive certification model.
DCC Level 0 required by 31 December 2026
The MOD’s minimum baseline for all industry partners
What Has Changed?
The updated DCC framework focuses on the security and resilience of the entire organisation rather than solely protecting MOD information. Organisations are assessed against Def Stan 05-138 Issue 4 and assigned certification levels aligned to contract cyber risk profiles.
DCC Levels
Four certification levels, each mapped to the cyber risk of the contracts you hold or are bidding for.
- Level 0 – 3 controls – Cyber Essentials – Target baseline for very low-risk contracts
- Level 1 – 101 controls – Cyber Essentials – Aimed at low-to-moderate risk contracts
- Level 2 – 139 controls – Cyber Essentials Plus – Aimed at high-risk contracts
- Level 3 – 144 controls – Cyber Essentials Plus – For substantial-risk contracts
Key Requirements
Depending on the DCC level required, organisations will need to:
- Maintain Cyber Essentials or Cyber Essentials Plus where applicable
- Assign board-level cyber responsibility
- Conduct organisation-wide cyber risk assessments
- Implement security policies
- Establish incident response procedures
- Enforce access controls
- Manage suppliers and third parties
- Maintain asset management
- Operate vulnerability management
- Provide security monitoring appropriate to the required DCC level
Who Will Be Affected?
- Prime contractors
- SMEs
- Subcontractors
- Technology suppliers
- Managed service providers
- Consultancies
- Organisations bidding for MOD contracts
Any organisation seeking to bid for or maintain UK MOD contracts may be affected. Organisations within wider defence supply chains should expect customers and prime contractors to request evidence of compliance.
Deadlines and Compliance
31 December 2026
The MOD has requested that industry partners achieve DCC Level 0 by 31 December 2026 as a minimum baseline. Higher DCC levels may be contractually required based on the Cyber Risk Profile assigned to specific contracts.
Benefits of Certification
Cyber Resilience
Demonstrates commitment to cyber resilience
MOD Compliance
Supports compliance with MOD requirements
Less Duplication
Reduces repetitive supplier assurance requests
Supply Chain Trust
Strengthens trust across the supply chain
Competitive Edge
An advantage when bidding for defence opportunities
Typical Assessment Process
- 1. Determine Level – determine the required DCC level
- 2. Define Scope – define the organisational scope
- 3. Cyber Essentials – achieve Cyber Essentials / Cyber Essentials Plus where required
- 4. Gap Assessment – complete a gap assessment against the controls
- 5. Implement Controls – implement the required controls
- 6. Submit Evidence – submit evidence to an approved certification body
- 7. Certification – complete assessment and certification
- 8. Maintain – annual attestations and periodic reassessment
How We Can Help
Nihon Cyber Defence supports organisations at every stage of the DCC journey. We can assist with scoping and readiness for all levels, while our licensed Certification Body formally assesses and certifies organisations at DCC Levels 0 and 1.
Our DCC Services
- DCC readiness assessments
- Scoping exercises
- Gap analysis
- Remediation support
- Policy development
- Cyber Essentials preparation
- Cyber Essentials Plus preparation
- Evidence reviews
- Internal audits
- Certification support across all DCC levels