What is Defence Cyber Certification (DCC)?

Defence Cyber Certification (DCC) is the UK Ministry of Defence's organisation-wide cybersecurity certification scheme, officially introduced in July 2025. It replaced the previous Cyber Risk Profile (CRP) system and applies to all organisations in the UK defence supply chain — prime contractors, subcontractors, and technology suppliers. DCC mandates that each organisation holds certification at one of four levels (0, 1, 2, or 3) determined by the cyber risk profile of the contracts they hold. Level 0 requires Cyber Essentials Plus and is the baseline for all MOD suppliers. Levels 1 through 3 require progressively more rigorous independent assessment by an NCSC-approved assessor, with Level 3 typically conducted on-site. Holding the appropriate DCC level is increasingly a prerequisite for competing for MOD work.

What are the four DCC levels and what does each require?

DCC has four certification levels, each corresponding to a Cyber Risk Profile (CRP) assigned by the MOD or prime contractor. Level 0 (Very Low CRP): the universal baseline required of all MOD suppliers, satisfied by holding a valid Cyber Essentials Plus (CEP) certificate. No independent DCC assessor is required at this level. Level 1 (Low CRP): requires a comprehensive cyber security programme including risk management, access controls, incident response, and supply chain oversight, assessed independently by an NCSC-approved assessor. Level 2 (Moderate CRP): requires advanced oversight including more detailed technical controls, documented evidence of continuous monitoring, and greater depth of assessment than Level 1. Level 3 (High CRP): requires expert 'defence in depth' controls, typically assessed on-site by an NCSC-approved assessor, with the highest evidence and control requirements across all DCC levels.

How is a supplier's DCC level determined?

The supplier does not choose its DCC level. The MOD or prime contractor determines the required level by assessing the cyber risk of the contract using the Cyber Security Model (CSM). The CSM considers the sensitivity of data being handled, the nature of the equipment or service being supplied, and the potential operational impact of a cyberattack on the organisation. The assessment produces a Cyber Risk Profile — Very Low, Low, Moderate, or High — which maps directly to a DCC level of 0, 1, 2, or 3. The required DCC level is specified in the contract documentation. Suppliers already working on MOD contracts who are unsure of their required level should check their contract documentation for the Cyber Risk Profile or contact their MOD procurement team.

What is the difference between DCC and Cyber Essentials?

Cyber Essentials and Cyber Essentials Plus are embedded within DCC — they are not separate from it. Cyber Essentials Plus (CEP) is a requirement of DCC Level 0, the baseline that all MOD suppliers must satisfy regardless of their contract's risk profile. CEP also covers several control domains that are relevant at higher DCC levels, so achieving CEP is not just a Level 0 exercise — it is foundational to the higher levels as well. The difference is that Cyber Essentials Plus on its own is sufficient for Level 0, but Levels 1 through 3 require additional controls, more comprehensive evidence, and independent assessment by an NCSC-approved DCC assessor that goes significantly beyond the CEP scope.

How does DCC relate to ISO 27001 and Secure by Design?

DCC, ISO 27001, and Secure by Design are three distinct but complementary frameworks that defence contractors may need to engage with simultaneously. DCC is mandatory for MOD supply chain organisations and is MOD-specific — holding ISO 27001 does not satisfy DCC requirements, and DCC certification does not replace the need for ISO 27001 where that is separately required. ISO 27001 is a voluntary, internationally recognised information security management system standard — its controls and evidence base are complementary to DCC and can support DCC assessment preparation, but the two have different scopes, audit bodies, and certification processes. Secure by Design is an MOD framework requiring that security is designed into systems and products from the outset rather than added after development — it is increasingly expected on new defence contracts and sits alongside DCC rather than overlapping with it directly. Organisations preparing for DCC assessments should clarify which of these three frameworks apply to their specific contracts and plan a unified approach that avoids duplicating evidence-gathering effort.

Defence Cyber Certification: DCC levels, requirements, and assessment

Defence Cyber Certification (DCC) is not just a compliance deadline to clear and forget about. It is a framework designed to strengthen cyber resilience across the UK defence supply chain, with certification tied to the level of cyber risk associated with the work you take on.

There is also another important reason to take DCC seriously. Holding the appropriate DCC certification can help your organisation stand out when competing for MOD work, particularly as suppliers face increasing expectations around cyber resilience.

So, what does DCC actually involve? How is your level decided? What does it mean for your organisation? This guide explains how the framework works, what each level requires, why organisational scope matters, and how to prepare for the certification process.

What DCC is and what it replaced

DCC is a new organisation-wide cybersecurity certification scheme officially introduced in July 2025 in partnership with IASME and the Ministry of Defence (MOD).

It forms part of the Cyber Security Model (CSM) version 4 and is underpinned by Def Stan 05-138 Issue 4, with DEFCON 658 and ISN 2026/02 setting out how the requirements apply across defence contracts and suppliers.

The framework is designed to strengthen cyber resilience across the defence supply chain while taking a risk-based approach to the level of assurance required. The requirements can therefore vary depending on the Cyber Risk Profile of the contract and the organisation’s role in the supply chain.

DCC ensures your day-to-day operations (such as HR, email, and finance networks) meet baseline security standards. The UK Ministry of Defence has requested that its supply chain achieve DCC Level 0 by 31 December 2026, although it has not mandated this requirement.

Why has DCC been introduced?

Suppliers used to rely more heavily on contract-by-contract Supplier Assurance Questionnaires (SAQs). This meant they would demonstrate their security arrangements against individual contracts rather than being assessed once against a defined organisational scope.

DCC changes this by introducing a single organisational assessment. Rather than self-assessing their security arrangements for each contract, organisations are formally assessed by an IASME DCC certification body, providing a higher level of assurance across the supply chain. Once certified, a supplier has demonstrated that it meets the requirements for its defined scope and DCC level, reducing the need to start the assurance process from scratch for every contract.

This creates a more consistent way to assess cyber resilience across your defence supply chain and gives suppliers a clearer basis for meeting the requirements of future contracts.

The transition from SAQs is not complete, and the MOD has not issued a formal notice confirming their removal. However, the MOD has clarified its position in Industry Security Notice 2026/02, dated 30 March 2026. Where a supplier holds a valid DCC certificate at the appropriate level, the certificate may be submitted as evidence that the supplier has satisfied the relevant requirements of DEFSTAN 05-138.

This means suppliers may still encounter SAQs as the wider assurance framework evolves, but an appropriate DCC certification can provide recognised evidence of compliance where applicable.

Level 0 is the floor, not the finish line

Level 0 provides a baseline for suppliers working in the MOD supply chain, but it does not determine the level they will need for every future contract.

As the Cyber Risk Profile of your work changes, so can the required DCC level.

Level 0 is a documentation-led assessment carried out by an IASME-authorised certification body rather than a hands-on technical audit. Suppliers still need to demonstrate that they meet the required controls with clear evidence.

The important point is that Level 0 is only the starting point. Contracts with higher Cyber Risk Profiles require suppliers to progress to Levels 1, 2, or 3, which bring additional controls and assessment requirements with them. The level you need today may therefore change as the work you take on changes.

What Level 0 requires

Level 0 focuses on three areas:

Cyber Essentials certification
UK GDPR and data protection compliance
Network security and business resilience

These requirements establish the baseline for DCC certification in the UK. You should therefore consider how your current security arrangements and evidence align with Level 0 before an assessment, particularly if you expect to take on contracts that could require a higher DCC level.

How your DCC level is decided

There are four DCC levels, each with a specific number of controls (more on this later). The level you need is determined by the Cyber Risk Profile (CRP) assigned to the specific contract you are bidding for.

Here’s how:

1. The Cyber Security Model (CSM) assessment

Before a contract goes out to tender, the MOD procurement team or prime contractor assesses its cyber risk using the MOD’s Cyber Security Model (CSM). The assessment considers factors such as:

The sensitivity of the data being handled
The nature of the equipment or service being supplied
The potential operational impact of a cyberattack on the organisation

2. Matching Cyber Risk Profiles to DCC levels

Once the risk assessment is complete, the contract is assigned one of four Cyber Risk Profiles. This determines the corresponding DCC level the supplier needs to hold.

Cyber Risk Profile	Mandated DCC Certification Level
Very Low	Level 0 (baseline cyber hygiene)
Low	Level 1 (comprehensive program)
Moderate	Level 2 (advanced oversight)
High	Level 3 (expert ‘defence in depth’)

The supplier does not choose its DCC level. It follows from the CRP assigned to the contract.

How to find your required level

If you are already working on a defence contract and are not sure which DCC level applies, check your contract documentation for DEFCON 658, which introduces the relevant cyber assurance requirements. You can also check the Risk Assessment Reference (RAR) included in your tender documents.

If you are still unsure, your buyer or the prime contractor above you in the supply chain should be able to confirm the contract’s CRP and the DCC level you need.

However, the level you choose does not necessarily have to be limited to your current contractual requirements. An organisation may choose to achieve a higher DCC level based on the future work it intends to bid for in the UK defence market, or the type of work it wants to pursue based on work it is already undertaking in other international markets. Considering these plans when selecting a level can help you prepare for future opportunities rather than assessing your requirements solely against current contracts.

What is DCC scope, and why does it matter?

We know that under DCC, the assessment is organisation-wide. That said, your scope defines which parts of your organisation are being assessed, including the systems, people, locations, and business functions.

This ensures the assessment covers the environment that needs to meet the DCC requirements.

Why does getting the scope right matter?

It matters because defining it incorrectly can invalidate your entire certification, bar you from bidding on contracts, or leave your company legally liable. Also, the DCC model certifies your entire legal entity rather than just a single contract, so an inaccurate scope creates immediate operational roadblocks.

If you define your scope too narrowly, relevant parts of the organisation may be left outside the assessment. Then, if the scope needs to expand later because you take on higher-risk work, change how your business operates, or introduce new systems, you may have to complete additional assessment work.

What about Cyber Essentials?

Cyber Essentials is also a prerequisite for DCC certification at every level. So, the scope of your Cyber Essentials certification needs to match your DCC scope. Cyber Essentials Plus certification (CE+) is required for Levels 2 and 3, so suppliers need to factor this into their certification timeline from the start. If your DCC assessment covers your organisation but your Cyber Essentials certificate covers only part of it, the CE certificate cannot demonstrate compliance for the full DCC scope.

That is where AMR CyberSecurity comes in: an accredited UK-based DCC Certification Body for Levels 0–3, authorised by IASME and the MOD, and has security-cleared assessors who carry out DCC assessments. As an assessor, AMR sees first-hand the issues that can arise when suppliers get their DCC scope wrong.

What suppliers need to prove during DCC assessments

DCC requirements, controls, and passing criteria become more detailed as you advance from Level 0 to Level 3.

The reason behind this increase is the volume of security rules you must implement at every tier, drawn directly from Def Stan 05-138 (Issue 4). Here is a closer look at what each level represents:

Level 0 (Basic)

3 controls. Strictly core cyber hygiene.

Level 1 (Good Practice)

101 controls. Comprehensive cybersecurity governance.

Level 2 (Advanced)

139 controls. Advanced oversight, formal risk planning, and infrastructure monitoring.

Level 3 (Expert)

144 controls. Full ‘defence-in-depth’ capabilities.

So, what counts as evidence?

Before your DCC assessment, make sure:

Having the right controls in place is only part of the assessment because you also need to provide evidence that those controls are being applied.

Your required policies and procedures are documented and up to date.
You can provide evidence that your security processes are actually being followed.
Your records and documentation are consistent with how your organisation operates.
You can show that the people responsible for security understand their roles.
You can demonstrate how security risks are identified and managed.
Your evidence is available for the systems, people, and locations included in your DCC scope.
Your Cyber Essentials scope matches your DCC scope.
You have prepared additional evidence as the number of controls increases at higher DCC levels.

The cost drivers behind DCC certification

There is no single price for DCC certification because the cost depends on what needs to be assessed, how prepared your organisation is, and which DCC level you need. However, there are some factors that increase your costs to consider.

Scope size: Larger scopes can mean more devices, locations, and employees to assess, as well as more IT resources needed to secure them.

Cyber Essentials or CE+ gap: If your systems do not meet the required security standards, you may need to invest in remediation, new software or hardware, or replace unsupported legacy systems.

Remediation: Fixing vulnerabilities or gaps before an assessment can add IT, consultancy, and other implementation costs.

Assessment requirements: Costs can include assessor time, internal staff time spent gathering evidence and attending interviews, and certification or platform fees. Level 3 assessments are normally conducted on-site.

What your subcontractors need from you

DCC requirements flow down the entire defence supply chain to eliminate backdoor vulnerabilities and protect the total ecosystem. An example of a vulnerability could be a subcontractor with weak access controls, outdated software, poor password practices, or inadequate incident response. A weakness at one point in the chain can create risk for the organisations and systems connected to it.

As such, if you are a prime contractor, you would have to understand the cyber assurance of the subcontractors supporting your contract. You should also be able to provide evidence that the relevant requirements are being managed.

Remember:

For primes: Know which subcontractors form part of your delivery chain and what cyber requirements apply to them.

For subcontractors: Be prepared to provide evidence of your cyber assurance when you are onboarded or asked to demonstrate compliance.

For both: Understand the DCC level and CRP attached to the work, so the requirements being passed down are clear.

DCC vs ISO 27001 vs Secure by Design

Besides DCC, there are two other frameworks that serve completely different purposes within UK defence procurement.

Here is a quick glance:

	DCC	ISO 27001	Secure by Design
Main focus	Organisation-wide cyber resilience	Information security management	Security of a product or system
What it assesses	Security arrangements across a defined organisational scope	Information security policies, processes and risk management	How security is built into a product or system throughout its lifecycle
Where it applies	UK defence supply chain contracts where DCC is required	Organisations across industries	Defence products, systems and capabilities
How it helps	Demonstrates the required level of cyber assurance for a defence contract	Provides a structured approach to managing information security	Builds security requirements into design and development
Does it replace DCC?	—	No	No

ISO 27001 and Secure by Design in practice

ISO 27001

Known as the Business Framework, this is an international commercial standard that focuses on governance, policies, and continuous risk management. While it shows your business takes security seriously, the MOD does not accept it as a replacement for DCC. Though you can use your existing ISO 27001 policies to quickly pass a DCC audit, you must still undergo formal DCC certification.

Think of a defence manufacturer that uses ISO 27001 to manage information security across its business, including policies, risk management, and access controls. This can support its DCC preparation, but, again, ISO 27001 does not replace the DCC certification required for a contract.

Secure by Design (SbD)

This is a MOD initiative that shifts away from ‘checking security at the end’ to building security into the entire lifecycle of a product. It focuses strictly on the technical architecture of the output you are delivering.

For example, a company developing military software may need to build security requirements into the product’s architecture, development process, and testing from the start.

In short:

DCC = the organisation.
ISO 27001 = the information security management system.
Secure by Design = the product or system.

How to maintain your DCC level

A DCC certificate is valid for only three years from the date of issue.

Although it is not a set-and-forget credential, you must complete an annual check-in/attestation during this time. This is to confirm that no major organisational changes have occurred, and you must renew your prerequisite Cyber Essentials or Cyber Essentials Plus certificate every 12 months.

For example, an acquisition could bring new employees, systems, or locations into the organisation. A new site or major change to your IT environment could have the same effect. Winning a contract with a higher Cyber Risk Profile may also mean your organisation needs to meet a higher DCC level.

As a result, you should keep an eye on:

Organisational changes: acquisitions, new offices, or changes to your legal entity.

Technology changes: new systems, networks, or significant changes to your existing environment.

Contract requirements: new work with a higher Cyber Risk Profile or DCC level.

Certification dates: annual attestation requirements and your three-year recertification date.

Keeping track of the scope, controls, and evidence throughout the certification period can make the next assessment much more straightforward. The level of cyber assurance DCC gives for a defined period is what allows the certification to continue supporting your defence contracts.

Get ready for DCC certification with Infinum

Whether you are still preparing or ready for a formal DCC assessment, Infinum can support you throughout the process.

Start with a DCC readiness and scope review

Review your organisational scope, DCC requirements, and readiness, including the Cyber Essentials or Cyber Essentials Plus requirements that apply to your DCC level. This can help identify potential gaps before formal assessment.

Get a formal DCC assessment.

AMR CyberSecurity, part of the Infinum group, provides formal DCC assessments across Levels 0–3. We are one of a limited number of organisations approved as a Certification Body for all four DCC levels under the UK Ministry of Defence’s Defence Cyber Certification scheme.

Infinum is also a Certification Body for Cyber Essentials and Cyber Essentials Plus.