How do I prepare for Defence Cyber Certification (DCC) Level 0?
How do I prepare for Defence Cyber Certification (DCC) Level 0?
Defence Cyber Certification, commonly known as DCC, is becoming increasingly important for businesses that work with the UK Ministry of Defence, Prime contractors or organisations within the wider defence supply chain.
For many smaller suppliers, DCC Level 0 is the logical starting point. It establishes a basic level of organisational cyber resilience and provides independent evidence that your business meets the relevant requirements of the Ministry of Defence Cyber Security Model.
The Ministry of Defence has asked defence industry partners to achieve DCC Level 0 by 31 December 2026. This includes maintaining Cyber Essentials for all applicable business-critical systems within scope.
That makes preparation particularly important for organisations that currently supply Defence, work through Prime contractors or plan to pursue defence opportunities.
Level 0 is deliberately achievable. It contains only three controls, compared with 101 at Level 1, 139 at Level 2 and 144 at Level 3. However, a small control set should not encourage businesses to treat the assessment casually.
Your organisation still needs to demonstrate that the requirements work in practice.
UK Cyber Security Group provides Defence Cyber Certification assessment services and Cyber Essentials certification, allowing organisations to prepare for the technical baseline and DCC assessment through an experienced cyber security provider.
UK Cyber Security Group’s Defence Cyber Certification service provides information and support for organisations preparing for DCC Level 0 and the higher DCC levels.
Understand what DCC Level 0 is trying to achieve
The Ministry of Defence uses the Cyber Security Model to build cyber resilience throughout its supply chain.
Cyber Security Model version 4 uses a risk-based approach.
A Cyber Risk Profile determines the security controls that a supplier needs to meet. Defence Standard 05-138 defines the controls associated with each Cyber Risk Profile.
DCC then provides an independent certification mechanism for demonstrating that an organisation meets the relevant controls.
Level 0 normally relates to work carrying a very low assessed cyber risk. It focuses on basic cyber security practices and provides the foundation for higher levels of DCC assurance.
An important point is that DCC operates at organisational level rather than simply examining one individual defence contract.
That means preparation needs to consider how your organisation operates as a business.
Know the Level 0 requirements before collecting evidence
DCC Level 0 contains three controls.
The requirements cover the Cyber Essentials baseline alongside fundamental organisational responsibilities around data protection and operational resilience.
The assessment is much smaller than the higher DCC levels, but your assessor still needs enough information to determine that your organisation meets the required controls.
Do not start by creating large amounts of paperwork.
Start by understanding each requirement and asking:
What do we currently do?
Who is responsible?
Can we demonstrate it?
Is the process followed consistently?
What evidence already exists?
Where are the gaps?
This approach normally produces a much clearer assessment submission than writing policies simply because they sound appropriate.
Cyber Essentials comes first
Cyber Essentials is a prerequisite for every DCC level.
Levels 0 and 1 require Cyber Essentials, while Levels 2 and 3 require Cyber Essentials Plus.
This makes Cyber Essentials one of the first things to check when preparing for DCC Level 0.
If you already hold Cyber Essentials, confirm that the certificate remains valid and that its scope appropriately covers the systems relevant to your DCC scope.
If you do not currently hold Cyber Essentials, work towards it before expecting to complete DCC certification.
The current Cyber Essentials Requirements for IT Infrastructure v3.3 became effective on 27 April 2026.
Cyber Essentials establishes an important technical baseline across five control areas:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
DCC Level 0 then builds on that baseline.
What are the key requirements for achieving Cyber Essentials certification?
Cyber Essentials focuses on protecting organisations from common internet-based cyber attacks.
The first requirement concerns firewalls.
Your organisation needs appropriate controls between devices and untrusted networks. Firewall rules should serve a legitimate business purpose, and unnecessary access should not remain open indefinitely.
Secure configuration forms another key requirement.
New computers, cloud services, network devices and other technology should not remain configured with unnecessary default settings, unused accounts or functionality that the organisation does not need.
Security update management is equally important.
Supported operating systems, applications and relevant devices need security fixes applied within the required timeframe when vulnerabilities meet the Cyber Essentials criteria.
User access control means people should receive only the access they need.
Administrator privileges deserve particular attention because compromised privileged accounts can give an attacker significant control.
Malware protection provides the final core area.
Organisations need appropriate protection against malicious software on relevant devices.
These five controls give DCC Level 0 a recognised technical foundation rather than requiring the DCC assessment to recreate a separate technical security baseline.
Get your Cyber Essentials scope right
Scope causes unnecessary difficulty when organisations have not properly documented their technology.
Create an accurate picture of your environment.
Identify:
- Laptops
- Desktop computers
- Servers
- Mobile devices
- Network equipment
- Internet connections
- Cloud services
- Remote workers
- Home workers
- Administrator accounts
- Relevant third-party access
- Business-critical applications
Microsoft 365 also needs consideration if your organisation uses services such as Exchange Online, SharePoint, OneDrive or Teams.
Cloud services do not automatically fall outside your security responsibilities simply because another company operates the infrastructure.
Your organisation still controls areas such as identities, authentication, user permissions and security configuration.
DCC scope is broader than one defence project
One of the most important parts of DCC preparation is understanding its organisational scope.
IASME states that the DCC assessment scope must include the processes, systems and business areas required for the organisation to function and deliver securely and resiliently.
This means organisations should not automatically create an artificial boundary around the computer or employee working directly on an MOD contract.
Think about what keeps the business functioning.
That could include:
Finance
Identity systems
IT administration
Management
Cloud services
Backups
Communications
Operational systems
Business-critical suppliers
Customer systems
Remote working infrastructure
A failure in one of these areas could affect your ability to deliver your defence obligations even when that system does not directly process defence information.
Discuss scope with your Certification Body early.
Correcting an under-scoped assessment later can create unnecessary work.
Data protection needs practical evidence
Level 0 expects organisations to demonstrate appropriate data protection practice.
For UK organisations, that means considering obligations under the UK GDPR and Data Protection Act 2018 where applicable.
Avoid treating GDPR compliance as having a privacy notice on your website.
Think about how personal information moves through the organisation.
Ask:
What personal data do we process?
Why do we process it?
Where do we store it?
Who can access it?
How long do we retain it?
How do we securely dispose of it?
How do we respond to data subject requests?
How would we recognise and manage a personal data breach?
Who has responsibility for data protection?
Your answers should reflect what actually happens inside the organisation.
Build a simple data inventory
A small organisation does not necessarily need a complicated governance system to understand its data.
Start with the main business processes.
You might hold information about:
Employees
Customers
Suppliers
Contractors
Job applicants
Website users
Business contacts
Defence customers
For each area, identify what information you hold, why you need it and where it resides.
This exercise can reveal unnecessary information and old records that nobody realised the organisation still retained.
It can also identify data stored in unexpected locations, such as personal cloud storage, old email accounts or employee devices.
Good data governance supports both compliance and cyber resilience.
Resilience matters at Level 0
Cyber security is not only about preventing attacks.
Your organisation also needs to remain resilient when something goes wrong.
A ransomware incident, failed server, damaged laptop, compromised cloud account or major service outage can affect your ability to deliver contracts.
Level 0 therefore requires businesses to think about resilience rather than concentrating solely on defensive technology.
Start with your critical business services.
Ask what would happen if each became unavailable.
For example:
What happens if Microsoft 365 becomes inaccessible?
What happens if the main file storage system fails?
What happens if ransomware encrypts employee devices?
What happens if the office loses internet access?
What happens if a key cloud service becomes unavailable?
What happens if an administrator account becomes compromised?
What happens if a critical supplier suffers a cyber incident?
The answers help you understand where resilience measures need strengthening.
Backups need to support recovery
Backups are an important part of cyber resilience.
Simply having a backup product does not prove that your organisation can recover.
Know what receives backup protection.
Understand how frequently backups run.
Control who can access them.
Consider whether an attacker who compromises the main environment could also damage the backups.
Most importantly, test recovery.
A successful backup notification tells you that a process completed. A successful restore gives much stronger evidence that the organisation can recover information.
Keep records of recovery tests where practical.
These records can also provide useful evidence of an active resilience process.
Build a basic incident response process
Every organisation should know what to do when a cyber security incident occurs.
The process does not need to become unnecessarily complicated for a small business.
Staff should know:
Who to contact
Who takes responsibility
How to report suspicious activity
How important systems can be isolated
Who communicates with customers
When senior management becomes involved
How incidents receive documentation
When external specialists need involvement
Whether regulators, customers or other parties require notification
An incident response contact list can make a significant difference during a real event.
Do not store the only copy somewhere that may become inaccessible during the incident.
How can I prepare my small business for Cyber Essentials assessment?
Start with an internal review of your IT environment.
Create an asset inventory and identify every device, operating system, cloud service and important application within scope.
Check whether operating systems and applications still receive security support from their vendors.
Apply required security updates.
Review administrator privileges.
Remove unnecessary accounts.
Check firewall configurations.
Make sure malware protection operates correctly.
Verify that relevant cloud services use multi-factor authentication in accordance with the current Cyber Essentials requirements.
Review remote workers and home workers as well.
Small businesses sometimes assume that limited staff numbers make their environment simple. Modern cloud services can make even a five-person company technically complex.
A small organisation might use Microsoft 365, SharePoint, OneDrive, cloud accounting, CRM, online backups, remote support and several third-party SaaS services.
Every relevant system deserves consideration.
Make MFA part of normal security
Multi-factor authentication provides an important defence against compromised passwords.
If your organisation uses Microsoft 365 or another cloud platform, check the authentication arrangements carefully.
Do not assume that registering employees for an authentication application means MFA always applies.
Verify actual sign-in behaviour.
Review administrator accounts separately.
Remove old users.
Check guest accounts.
Look for temporary exclusions that became permanent.
Contractors should receive only the access they genuinely require.
Identity security becomes particularly important where cloud platforms hold business-critical or defence-related information.
Control administrator privileges
Administrator accounts can make substantial changes to systems.
That power makes them attractive to attackers.
Employees should not routinely use privileged accounts for normal activities where a separate standard account can perform the work.
Review every administrator.
Ask whether the person still needs the access.
Check local administrator permissions on endpoints.
Review Microsoft 365 and cloud administrator roles.
Remove old supplier accounts.
Disable accounts belonging to former employees.
Access control works best as an ongoing management process rather than an annual exercise carried out immediately before certification.
What software solutions support compliance with Cyber Essentials standards?
Cyber Essentials does not force every organisation to purchase a particular product.
Technology should support the required security outcome.
Useful solutions can include:
Endpoint protection
Patch management
Asset discovery
Mobile device management
Vulnerability management
Identity management
Multi-factor authentication
Firewall management
Backup platforms
Security monitoring
Microsoft environments may use Microsoft Entra for identity controls and Microsoft Intune for endpoint management.
Microsoft Defender, SentinelOne and other established endpoint security platforms can contribute towards malware protection when configured and managed appropriately.
Vulnerability management tools can help identify unsupported software and missing security fixes.
The key issue is effectiveness.
Owning security software does not automatically make an organisation compliant.
Someone needs to monitor it, respond to alerts and maintain the configuration.
Prepare evidence before starting the DCC assessment
Evidence should demonstrate that your stated security practices actually happen.
Useful evidence might include:
A valid Cyber Essentials certificate
Relevant policies
Asset records
Data protection records
Backup records
Recovery test evidence
Risk assessments
Incident response documentation
Screenshots of relevant configurations
Training records
Access review records
Business continuity documentation
Supplier records
Responsibility assignments
Do not collect hundreds of screenshots without understanding why you need them.
Every piece of evidence should support a particular statement or requirement.
Good evidence tells the assessor a clear story.
Make ownership clear
One of the simplest ways to improve DCC readiness is to assign responsibility.
Who owns cyber security?
Who manages Cyber Essentials?
Who oversees data protection?
Who checks backups?
Who manages user accounts?
Who responds to incidents?
Who approves administrator privileges?
Who deals with critical suppliers?
In a small organisation, one person may hold several of these responsibilities.
That is not automatically a problem.
The important point is that responsibility should be understood.
A process that everyone assumes somebody else handles creates risk.
Document what you actually do
Policies should reflect real business practices.
Do not download generic documents and change the company name.
An assessor needs to understand how your organisation meets the control.
If your policy says you test backups every month but nobody has tested a restore for two years, the document does not provide meaningful assurance.
Keep documentation proportionate.
A smaller business can often use concise procedures that clearly describe responsibilities and actions.
Good documentation should help employees perform their jobs securely.
Understand the role of the Certification Body
DCC assessment and certification need to come through an IASME-licensed DCC Certification Body qualified for the relevant level.
The Certification Body assesses your evidence and determines whether you satisfy the requirements.
This creates an important separation between implementing controls and independently assessing them.
Your assessor can explain requirements and clarify the assessment process, but the organisation remains responsible for implementing its security arrangements and demonstrating compliance.
UK Cyber Security Group provides Defence Cyber Certification assessment services and can assess organisations preparing for DCC.
The MOD wants Level 0 progress during 2026
DCC has moved rapidly since its launch.
In May 2026, the MOD’s Director of Cyber Defence and Risk asked defence industry partners to achieve Level 0 DCC certification by 31 December 2026, including Cyber Essentials for applicable business-critical systems within scope.
The MOD repeated this direction in July 2026.
This gives defence suppliers a clear reason to act before the end of the year rather than waiting for their next contract renewal.
Organisations further down the supply chain should also pay attention.
Prime contractors need to consider cyber risk when work passes to subcontractors, so security expectations can move through multiple supply-chain levels.
Cyber threats remain a business issue
The wider UK cyber risk also supports the MOD’s focus on supply-chain resilience.
The UK Government’s Cyber Security Breaches Survey 2025 to 2026 estimated that 43 per cent of UK businesses had identified a cyber breach or attack during the previous 12 months. This represented approximately 612,000 businesses.
The figure increased to 65 per cent among medium businesses and 69 per cent among large businesses.
Phishing remained the most commonly identified attack and affected 38 per cent of businesses.
Among businesses that had identified a breach or attack, 88 per cent experienced phishing.
These figures matter to defence suppliers because attackers do not need to target the MOD directly.
A smaller supplier with weaker security can provide another route into valuable information, relationships and supply chains.
Can I renew my Cyber Essentials certification through an online service?
Yes. Cyber Essentials uses an online assessment process through authorised Certification Bodies.
Cyber Essentials certification remains valid for 12 months, so organisations need to renew it annually if they want continuous certification.
This becomes particularly important when Cyber Essentials supports your DCC status.
Do not allow the underlying Cyber Essentials certificate to expire simply because the DCC certificate itself follows a longer certification cycle.
Set renewal reminders well in advance.
Review the environment again before submitting the renewal because your organisation may have added new devices, cloud services, employees or applications during the previous year.
Continuous Cyber Essentials maintenance also makes the annual DCC attestation easier to manage.
DCC certification needs ongoing maintenance
DCC should not become a certificate that disappears into a folder after assessment.
IASME states that DCC provides organisation-level assurance subject to annual attestation and full recertification every three years.
Your organisation therefore needs to maintain the controls after certification.
Review significant changes.
Maintain Cyber Essentials.
Keep resilience measures operational.
Continue managing data protection.
Review critical systems.
Maintain evidence.
If the organisation changes significantly, consider whether those changes affect the certification scope or control environment.
This ongoing approach makes future reassessment considerably easier.
Understand annual attestation
Annual attestation provides assurance that the organisation continues to meet the certification requirements between full assessments.
Treat it as a useful governance checkpoint.
Before attesting, confirm that:
Cyber Essentials remains valid.
The organisation still meets the Level 0 controls.
The certification scope remains accurate.
Significant organisational changes have received appropriate consideration.
Business-critical systems remain protected.
Resilience arrangements remain operational.
Responsibilities remain assigned.
Do not wait until the attestation date to discover that an underlying requirement expired months earlier.
Which companies provide Cyber Essentials certification services in the UK?
Cyber Essentials certification must come through the official Cyber Essentials scheme.
Organisations should use an authorised Certification Body rather than assuming that any IT provider can issue a recognised certificate.
UK Cyber Security Group provides Cyber Essentials certification alongside Defence Cyber Certification assessment services.
This can make the journey easier for organisations preparing for DCC Level 0 because Cyber Essentials forms a prerequisite for the DCC assessment.
A business can therefore review its technical baseline, complete Cyber Essentials and then move towards its DCC requirements with a clear understanding of the relationship between the schemes.
Which UK-based firms offer Cyber Essentials consultancy services?
Many UK cyber security organisations offer Cyber Essentials guidance and preparation services.
The important distinction lies between consultancy and certification.
A consultant can help identify weaknesses and explain technical requirements. An authorised Certification Body conducts certification under the official scheme.
When choosing support, ask whether the provider understands both Cyber Essentials and Defence Cyber Certification.
This becomes particularly useful for defence suppliers because decisions made during Cyber Essentials scoping can affect later DCC preparation.
UK Cyber Security Group provides Cyber Essentials certification and DCC services for organisations working within or preparing to enter the defence supply chain.
Do not assume Level 0 will always be enough
Level 0 is the starting point, but the required DCC level ultimately depends on the Cyber Risk Profile associated with the work.
The four DCC levels currently contain:
Level 0: 3 controls
Level 1: 101 controls
Level 2: 139 controls
Level 3: 144 controls
Cyber Essentials supports Levels 0 and 1.
Cyber Essentials Plus becomes mandatory for Levels 2 and 3.
A company does not have to obtain every lower certificate before pursuing a higher level.
If a future contract requires Level 1, you can work directly towards Level 1.
The same principle applies to Levels 2 and 3 where the appropriate prerequisite and control requirements are satisfied.
Level 0 can prepare you for future defence work
An organisation does not need to wait until it wins an MOD contract before considering DCC.
IASME allows organisations to seek certification even when they are not currently engaged on a UK Defence contract.
For businesses targeting the defence sector, early preparation can provide practical benefits.
It gives the organisation time to understand its systems.
Weaknesses can be addressed before a tender deadline.
Cyber Essentials can be maintained continuously.
Staff become familiar with security responsibilities.
Evidence develops naturally through normal business processes.
The company can then approach defence opportunities from a stronger starting position.
Consider your subcontractors
Defence supply chains rarely stop with the primary supplier.
Your organisation may depend on IT providers, cloud services, manufacturers, consultants, logistics companies or specialist subcontractors.
Understand which external organisations support critical business functions.
Ask what happens if they suffer an outage.
Consider whether they can access sensitive systems or information.
Know how quickly you could operate without them.
Where defence requirements need to flow down, make sure the appropriate contractual and Cyber Security Model processes receive attention.
Supply-chain security is ultimately about understanding dependencies rather than simply collecting certificates.
Build a simple DCC Level 0 readiness checklist
Before submitting for assessment, check the following:
Do you hold valid Cyber Essentials certification?
Does Cyber Essentials cover the appropriate business-critical systems?
Have you agreed or reviewed the DCC scope?
Do you understand the three Level 0 controls?
Can you demonstrate appropriate data protection arrangements?
Do you understand the personal information your organisation processes?
Have you identified critical systems and services?
Do you have appropriate resilience arrangements?
Are important systems backed up?
Have you tested recovery?
Do staff know how to report a cyber incident?
Are security responsibilities assigned?
Are policies consistent with actual working practices?
Can you provide evidence when the assessor requests it?
Have you considered important suppliers and dependencies?
Are administrator privileges controlled?
Is MFA operating where Cyber Essentials requires it?
Are supported systems receiving security updates?
Is malware protection active?
Are old accounts removed?
Are remote workers included appropriately?
Can senior management explain how the organisation maintains cyber resilience?
If you cannot confidently answer several of these questions, address those areas before assessment.
Avoid overcomplicating Level 0
One of the biggest risks for small businesses is assuming defence certification must involve enormous policy manuals and enterprise security systems.
Level 0 exists as a practical baseline.
Your controls should remain proportionate to the organisation.
A ten-person engineering business and a multinational defence contractor will naturally manage some processes differently.
Both still need to demonstrate the required security outcomes.
Focus on clear responsibilities, working controls and evidence.
Do not create complexity merely to make the organisation look mature.
Simple processes that people actually follow provide far more value than impressive documents that nobody uses.
Prepare your people as well as your technology
Cyber resilience depends on employees.
Staff should understand basic cyber security expectations.
They need to recognise phishing.
They should know how to report suspicious activity.
Passwords and authentication need appropriate protection.
Employees should understand why they cannot simply install unapproved software or share accounts.
People also need to know what to do when something goes wrong.
A technically secure environment can still fail when nobody knows who should respond to an incident.
Keep awareness practical and relevant to the employee’s role.
Keep evidence organised
Create a simple evidence structure before the assessment.
Group material according to the DCC requirements.
Use clear filenames.
Record document owners.
Keep current versions.
Remove obsolete copies where appropriate.
Make sure sensitive evidence receives appropriate protection.
Your assessor should be able to follow the evidence without having to reconstruct how your organisation operates.
Clear evidence can make the assessment considerably more efficient.
What happens if you are not ready?
The MOD’s Cyber Security Model includes a Cyber Improvement Plan mechanism for suppliers that do not yet hold the required DCC level or cannot currently meet particular requirements.
The Cyber Improvement Plan records how and when the supplier plans to reach the required position.
However, businesses should not treat a Cyber Improvement Plan as a substitute for proper preparation.
Where you have time before a tender or contract requirement, working towards the correct certification provides a much stronger position.
The earlier you identify weaknesses, the more time you have to address them sensibly.
Your practical route to DCC Level 0
For most organisations, preparation can follow a straightforward sequence.
First, determine whether Level 0 matches the relevant Cyber Risk Profile or your current defence requirement.
Next, define the organisation’s DCC scope.
Review your Cyber Essentials position and obtain or renew certification where required.
Then examine the three Level 0 controls.
Review data protection.
Assess business-critical systems and resilience.
Check backups and recovery.
Document incident responsibilities.
Gather evidence showing that these arrangements work.
Address gaps before submitting for assessment.
Finally, use an IASME-licensed DCC Certification Body qualified to assess Level 0.
Once certification has been achieved, maintain the controls, complete the required annual attestation and prepare for full recertification every three years.
DCC Level 0 should not feel like an enormous compliance project.
Its purpose is to establish a credible minimum level of cyber resilience across the defence supply chain.
For many small and medium-sized organisations, the biggest step is simply bringing together practices they should already have: Cyber Essentials, sensible data protection, secure business systems and the ability to recover when something goes wrong.
With the MOD asking defence industry partners to achieve Level 0 by 31 December 2026, organisations that start preparing now have an opportunity to address weaknesses before demand for assessment increases.
UK Cyber Security Group provides both Cyber Essentials certification and Defence Cyber Certification assessment services, helping businesses prepare for the technical baseline and demonstrate the organisational controls required for DCC.
For businesses already supplying Defence, working through a Prime contractor or preparing to enter the defence supply chain, DCC Level 0 provides a practical starting point for demonstrating that cyber security and operational resilience form part of normal business practice.
UK Cyber Security Group Ltd is here to help
Please check out our Free Cyber Insurance
Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,
If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us
