Get DCC Ready Before It Becomes a Bid Problem

Defence Cyber Certification is a cyber security certification developed by the Ministry of Defence and IASME. It provides independent assurance that a supplier meets the cyber security controls relevant to its DCC level under Defence Standard 05-138 Issue 4.

IASME currently states that DCC is not mandatory across the board and organisations can still tender through the normal MOD process. However, the MOD has asked all industry partners to achieve Level 0 by 31 December 2026, and individual contracts or Prime contractors may set specific requirements according to cyber risk.

Existing MOD suppliers, subcontractors working through Defence Primes, lower-tier suppliers and organisations planning to enter the defence supply chain should all understand DCC. It can be relevant to construction, facilities, catering, logistics, professional services, technology and many other suppliers, not only traditional defence manufacturers.

The MOD or your Prime determines the level required for a contract through its Cyber Risk Profile. If you have not been assigned a level, do not guess. Review current and planned Defence relationships and ask the relevant customer or Prime what requirement is expected.

Yes. Cyber Essentials is required for Levels 0 and 1. Cyber Essentials Plus is required for Levels 2 and 3. The relevant Cyber Essentials certification must adequately cover the internet-connected networks and devices within your DCC scope.

No. IASME states that none of the DCC levels are self-assessment certifications. An independent DCC Assessor verifies that the applicable requirements have been met.

Existing certifications and frameworks provide useful controls and evidence, and 2-sec can help map them to the relevant DCC requirements. However, IASME states that no other certification currently provides direct compliance with the Defence Standard controls.

DCC scope should include the essential functions and services your organisation needs to operate securely and resiliently. This can extend beyond systems used for one Defence contract and may include cloud services, operational technology and third parties that perform controls on your behalf.

For Levels 1 to 3, the process includes theoretical and practical phases. You explain how controls are met and provide evidence, then the Assessor verifies that the controls are implemented and effective in practice. Level 0 also requires independent assessment and is not self-assessed.

IASME does not define a standard timescale. It depends on your preparedness, the gaps that need to be remediated and Certification Body availability. Starting with scope and readiness early reduces the risk of discovering significant work against a live contract deadline.

DCC requires an annual attestation and full recertification every three years. Cyber Essentials or Cyber Essentials Plus must also be renewed annually, and you should discuss significant scope changes with the assessing Certification Body.

A Certification Body can identify gaps and may provide consultancy in a distinct role. However, if it is acting as your DCC Assessor, it cannot implement or manage your security defences. 2-sec focuses on readiness, remediation and evidence, then helps you engage an appropriate independent Certification Body for formal assessment.

No. DCC does not guarantee a contract award or automatic preference. It can provide reusable, independently verified evidence of cyber resilience at the certified level, strengthen credibility and reduce assurance friction when a customer asks you to prove your position.

We discuss your Defence relationships and timing, any assigned Cyber Risk Profile, your Cyber Essentials or ISO 27001 position, likely scope complexity, evidence maturity and known gaps. The review gives you a clearer view of the next step. It does not assign a definitive contract level where the MOD or your Prime has not.

No credible adviser can guarantee an independent Assessor's decision. 2-sec helps you identify and remediate gaps before formal assessment, giving you the strongest practical chance of passing the first time.