How do I prepare for Defence Cyber Certification (DCC)?

Preparing for Defence Cyber Certification, commonly called DCC, starts with understanding that the scheme looks at the cyber resilience of your organisation as a whole. It is not simply another questionnaire for one defence contract. DCC was developed by the Ministry of Defence and IASME to provide organisation-wide assurance for suppliers working in, or planning to work in, the UK defence supply chain.

IASME manages delivery of DCC for the MOD through assured Certification Bodies. The scheme uses Defence Standard 05-138 Issue 4 as its core technical and governance standard. IASME explains that Issue 4 broadens the focus beyond protecting MOD identifiable information and places greater emphasis on the overall resilience of the supplier organisation.

For most businesses, good preparation means working in a clear order: establish the DCC level you need, make sure the correct Cyber Essentials certificate is current, define the assessment scope, work through the relevant controls, collect evidence that proves the controls operate, remediate gaps and engage an IASME assured DCC Certification Body early.

UK Cyber Security Group provides Cyber Essentials certification and DCC assessment support. IASME currently lists UK Cyber Security Group Ltd within its network of DCC Certification Bodies. UK Cyber Security Group also describes itself as a registered Cyber Essentials Certification Body and provides support for businesses completing the Cyber Essentials process.

Understand what DCC is designed to achieve

DCC gives defence buyers a consistent way to assess the cyber resilience of suppliers. Instead of relying only on repeated contract-specific declarations, a supplier can obtain organisation-level certification and use that assurance in support of UK defence procurement where the certified level meets the requirement.

The MOD and IASME have created four DCC levels, from Level 0 through Level 3. Each level corresponds to the degree of cyber risk connected with the supplier’s role. IASME states that the MOD or a Prime determines the level required for a contract. Organisations can also seek certification before they hold a defence contract if they want to prepare for future opportunities.

DCC is not currently a universal requirement for every organisation seeking MOD work. IASME states that DCC is not mandatory across the board at present and that contract requirements are decided by the MOD. However, MOD guidance issued in 2026 instructs buyers to accept a current DCC certificate at the corresponding level, or a higher level, as assured evidence of compliance with the relevant Defence Standard 05-138 control level where DEFCON 658 applies.

That distinction matters. Do not assume you need Level 0 simply because you are a smaller supplier, and do not assume a higher level simply because your organisation already has strong security. The required level follows the cyber risk associated with the contracted output.

Determine the DCC level before doing detailed work

The four levels differ significantly in control coverage.

Level 0

Level 0 contains 3 controls and normally applies where the assessed cyber risk is very low. IASME describes it as the foundation level, focused on basic cyber security practice.

Level 1

Level 1 contains 101 controls and normally applies where the assessed cyber risk is low to moderate. It expects the supplier to demonstrate a comprehensive cyber security programme and good organisational practice.

Level 2

Level 2 contains 139 controls and normally applies where the assessed cyber risk is high. IASME expects advanced cyber security oversight, planning and robust organisational practices.

Level 3

Level 3 contains 144 controls and normally applies where the assessed cyber risk is substantial. It expects expert cyber security capability and a strong defence-in-depth approach to new and evolving threats.

If a tender, contract or Prime has already specified your required DCC level, use that requirement. If the paperwork is unclear, confirm the Cyber Risk Profile with the MOD delivery team or your Prime before committing substantial effort.

Get the Cyber Essentials prerequisite in place first

Every DCC level starts with Cyber Essentials.

IASME confirms that Levels 0 and 1 require Cyber Essentials, while Levels 2 and 3 require Cyber Essentials Plus. You do not have to work through DCC Levels 0 and 1 before applying for a higher level. You can apply directly for the level you need, provided that you hold the required Cyber Essentials assurance.

As of September 2026, new Cyber Essentials applications use Requirements for IT Infrastructure v3.3, which became effective on 27 April 2026. The NCSC publishes the current technical requirements and assessment questions through its Cyber Essentials resources.

This prerequisite matters because it establishes a technical security baseline before the broader DCC assessment examines governance, resilience, risk, people, processes and evidence.

What are the key requirements for achieving Cyber Essentials certification?

Cyber Essentials focuses on five core technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

Before starting DCC, make sure your Cyber Essentials position remains healthy rather than treating the certificate as a paperwork dependency.

Review which devices, software and cloud services fall within scope. Confirm that software remains supported. Review administrator privileges and user accounts. Make sure relevant cloud services use multi-factor authentication where required. Check that security updates, firewall controls, secure configuration and malware protection operate consistently.

A current Cyber Essentials certificate supports DCC, but the DCC assessor will look much further into how your organisation manages security and resilience.

UK Cyber Security Group provides Cyber Essentials certification and guidance for organisations that want support with the technical controls before progressing towards DCC.

Scope the organisation carefully

IASME makes scope a major part of DCC preparation.

Its current guidance states that the DCC scope must include all processes, systems and business parts required for the organisation to function and deliver in a secure and resilient manner. IASME strongly recommends discussing the scope with the chosen Certification Body early to avoid under-scoping.

This means you should not treat DCC as certification for one isolated server, one project folder or one small technical team if wider business processes support secure delivery.

Consider:

People who deliver the service

Business processes

IT systems

Cloud services

Networks

Locations

Information

Critical suppliers

Managed service providers

Security operations

Business continuity arrangements

Human resources processes

Governance and leadership

Legal and regulatory responsibilities

A strong scope gives you a reliable foundation for the rest of the assessment. A weak scope can create substantial rework because controls, evidence and risk decisions may all depend on the boundary.

Create a clear Statement of Scope

IASME’s preparation process asks applicants to review their organisational scope and complete a Statement of Scope before the assessment proceeds.

Write the statement so an assessor can understand what your organisation does, which business activity the certification covers and which systems and processes enable secure and resilient delivery.

Avoid vague descriptions.

If several legal entities contribute to the service, identify their role. If an external provider carries out an important security function, make that dependency clear. If employees work remotely, include the relevant working arrangements.

The scope should represent reality.

Download the official DCC material

IASME provides an Applicant Guide, Scoping Guidance, an overview, a Process Guide and Defence Standard 05-138 Issue 4 through its DCC resources. Applicants seeking Levels 1 through 3 can also use the Assessment Submission Record. IASME states that Level 0 does not require an Assessment Submission Record.

Use the official material as your primary preparation source.

Do not rely only on generic ISO 27001 policies, old Supplier Assurance Questionnaire answers or an informal control checklist. Existing material may help, but DCC assesses against the current Defence Standard and the relevant DCC controls.

A practical preparation folder should contain the official guide, your scope statement, a control tracker, evidence references, remediation actions and management decisions.

Build a control-by-control readiness review

For each control at your required level, ask four questions:

What does this control require?

How does our organisation meet it?

Who owns the activity?

What evidence proves it works?

The last question is crucial.

IASME tells applicants to answer each assessment question, describe how the organisation meets the control and provide supporting evidence that proves compliance in practice. Evidence should give the assessor a clear understanding of how the control is met and should remain readily available for submission when requested.

Do not stop when you find a policy.

A policy explains what should happen. Evidence demonstrates what actually happens.

Evidence should demonstrate real operation

Suppose your access control policy says managers review permissions regularly.

Useful evidence might include a completed access review, approval records, removal of unnecessary permissions and records showing how new users receive access.

If your backup policy says the organisation tests recovery, provide evidence of a completed recovery exercise and the actions that followed.

If your incident response process requires escalation, provide incident records or exercise evidence showing that employees understand the route.

Strong evidence can include:

Approved policies

Risk records

Access reviews

Training records

Backup test results

Incident records

Supplier assessments

Security monitoring output

Vulnerability management records

Business continuity tests

Management meeting records

Data protection records

Asset registers

Change records

Internal assurance activity

Use evidence that directly supports the control rather than uploading large amounts of unrelated documentation.

Prepare governance before the assessor arrives

DCC reaches beyond technical security. Higher levels place greater emphasis on governance, risk ownership, resilience and oversight.

Make sure senior management understands the scheme and the organisation’s security obligations.

Identify who has accountability for cyber security.

Assign control owners.

Define risk ownership.

Make sure employees know where to report incidents.

Review whether management receives useful security information.

Check that security actions have owners and realistic completion dates.

If a control depends on a third party, identify who manages that relationship.

Good governance reduces the risk that policies exist but nobody takes responsibility for operating them.

Review cyber risk across the whole organisation

DCC focuses on organisational resilience, so risk management should cover more than obvious technical threats.

Consider risks involving:

Account compromise

Ransomware

Supplier failure

Cloud service disruption

Loss of sensitive information

Incorrect or unauthorised changes to information

Insider activity

Loss of equipment

Unsupported software

Poor configuration

Critical employee dependency

Business interruption

Physical security

Weak incident response

Third-party remote access

Legal or contractual non-compliance

Risk records should explain the business consequence, current controls, treatment actions, owner and review position.

For higher DCC levels, mature risk oversight becomes increasingly important.

Check resilience, backup and recovery

Resilience is a central DCC theme.

Ask which services the business needs in order to deliver defence-related work securely.

Identify critical systems, suppliers, information and employees.

Determine what happens if they become unavailable.

Review your backup arrangements.

Do you know what gets backed up?

Do you know how often?

Can you restore it?

Has somebody tested the recovery process?

Does your recovery plan consider loss of a cloud service, identity platform or managed provider?

An untested backup does not provide the same assurance as a recovery process that the organisation has exercised successfully.

Make data protection evidence clear

Defence suppliers still need to understand their wider legal obligations.

If your organisation processes personal information, ensure that your data protection governance, security arrangements and breach procedures remain current.

Evidence may include data protection policies, records of processing, breach handling procedures, data retention arrangements, privacy assessments where relevant, access controls and training.

Do not state that a law applies and stop there.

Show how your organisation translates the obligation into working practice.

Review suppliers and subcontractors

Supply chain risk sits at the heart of defence security.

Identify suppliers that can affect your ability to deliver securely.

These may include:

Cloud providers

Managed IT providers

Software providers

Payroll and human resources services

Hosting providers

Security monitoring providers

Development partners

Subcontractors

Professional advisers with access to sensitive information

For important suppliers, document the security due diligence you perform, the information or access involved, contractual requirements, incident notification expectations and ongoing review.

If a subcontractor contributes to defence delivery, make sure you understand how its security affects your own DCC scope and obligations.

Strengthen identity and access management

Review every important account before assessment.

Remove unused accounts.

Check administrator privileges.

Make sure users receive only the access they need.

Review privileged accounts separately.

Use strong authentication.

Check multi-factor authentication coverage.

Review leaver processes.

Make sure human resources, managers and IT coordinate when people join, move roles or leave.

If contractors or external organisations need access, give them named identities and restrict access according to business need.

Access control often produces excellent assessment evidence because account records, approvals and review reports can show the process working clearly.

Assess vulnerability and update management

Know which software and systems you operate.

Identify unsupported products.

Track security updates.

Know how you identify vulnerabilities.

Assign responsibility for remediation.

Escalate serious overdue issues.

If you use vulnerability scanning, make sure somebody reviews the findings and follows them through to closure.

A dashboard full of unresolved findings demonstrates detection, but it does not necessarily demonstrate effective risk treatment.

Test incident response

Do not wait for a real cyber incident to discover that employees do not know what to do.

Run an exercise.

Use a realistic scenario such as ransomware, compromised administrator credentials, supplier failure or sensitive information sent to the wrong recipient.

Test:

How employees report the incident

Who takes control

How technical investigation begins

How management receives updates

How legal or regulatory duties receive assessment

How customers or defence contacts receive notification where required

How recovery decisions get made

How lessons turn into improvements

Record the exercise and resulting actions.

Train employees for their actual responsibilities

Security awareness should reflect the risks employees face.

Generic annual learning can provide a baseline, but role-specific responsibilities matter.

Finance staff need to recognise payment manipulation.

Administrators need to understand privileged access.

Managers need to understand risk acceptance and access approval.

Developers need to understand security requirements within development work.

Employees handling defence information need clear rules for that information.

Training records can then show both participation and relevance.

How can I prepare my small business for Cyber Essentials assessment?

A small business should start by defining scope and understanding its technology.

Create a reliable inventory of devices, operating systems, software and cloud services. Check that supported software receives security updates. Review user accounts and administrator privileges. Confirm that applicable cloud accounts use MFA. Check firewall controls, secure configuration and malware protection.

Use the current NCSC Cyber Essentials requirements and questions rather than relying on an old assessment. The current requirements are v3.3 for assessments started from 27 April 2026.

Once Cyber Essentials is in place, reuse the work sensibly for DCC. Asset information, access records, update management evidence and security policies can provide useful foundations, but DCC will require wider organisation-level evidence.

What software solutions support compliance with Cyber Essentials standards?

No single platform guarantees Cyber Essentials or DCC compliance.

Useful technology can support specific controls.

Endpoint management can help maintain device visibility and update status. Identity platforms can support access control and MFA. Endpoint security can support malware protection. Vulnerability management can help identify technical weaknesses. Backup systems can support resilience. Security monitoring can help identify suspicious activity. Compliance platforms can help organise policies, controls, actions and evidence.

The key question is whether the control works.

A tool only adds value when someone configures it correctly, reviews its output and takes action when it identifies a problem.

Choose a DCC Certification Body early

IASME delivers DCC through assured Certification Bodies. DCC assessors must work for a Certification Body and must complete the relevant training and assessment for the DCC level they deliver.

Engage a Certification Body before you finish all preparation.

Early discussion can help confirm the level, scope and assessment expectations before you spend time building the wrong evidence pack.

IASME’s directory allows applicants to find Certification Bodies qualified for the required level. UK Cyber Security Group Ltd appears in the current DCC Certification Body directory and provides DCC assessment services.

DCC is independently assessed

IASME states that none of the DCC levels is a self-assessment.

That makes evidence quality important.

The assessor needs to establish whether your answers reflect actual organisational practice.

Prepare employees who own major controls so they can explain what they do.

Make evidence easy to locate.

Do not create a special audit-only process that disappears after certification.

The strongest preparation makes the required controls part of normal operations.

Do not assume another certification gives automatic DCC compliance

Existing assurance can help considerably.

ISO 27001, Cyber Essentials Plus, IASME Cyber Assurance or another recognised framework may already provide policies, controls and evidence relevant to DCC.

However, IASME states that no other current certification directly grants compliance with Defence Standard 05-138 controls. Applicants can reuse suitable evidence, but they still need to demonstrate the DCC requirements.

IASME also points applicants towards MOD mapping material that compares Defence Standard 05-138 Issue 4 with other recognised standards.

Use existing evidence as an accelerator, not as an assumption that a control automatically passes.

Can I renew my Cyber Essentials certification through an online service?

Yes. Cyber Essentials uses an online assessment process and requires annual recertification to remain current.

This annual requirement also matters for DCC.

IASME states that a DCC certificate remains valid for three years only when the organisation completes the annual attestation and maintains current Cyber Essentials, or Cyber Essentials Plus where the higher DCC level requires it.

Plan renewal dates as part of your DCC compliance calendar.

Do not allow the underlying Cyber Essentials certificate to expire while relying on a current DCC certificate.

Understand how DCC remains valid

A successful DCC certificate has a three-year validity period, subject to ongoing conditions.

IASME requires:

Annual Cyber Essentials or Cyber Essentials Plus recertification

An annual DCC attestation

Full DCC recertification every three years

The annual attestation confirms that the organisation continues to meet the controls and that the scope has not significantly changed.

Certification therefore needs ongoing management.

Changes such as acquisitions, new critical services, major supplier changes, significant infrastructure changes or major incidents should trigger security review rather than waiting until the three-year point.

DCC and defence procurement

DCC can reduce repeated assurance activity because certification works at organisation level.

IASME states that a certificate can cover multiple contracts up to the certified level.

MOD guidance published in 2026 goes further by instructing defence buyers to accept maintained DCC certification as assured evidence against the corresponding Defence Standard control requirement under DEFCON 658.

A Level 0 certificate satisfies the corresponding Level 0 requirement.

A Level 1 certificate can satisfy Levels 0 and 1.

A Level 2 certificate can satisfy Levels 0, 1 and 2.

A Level 3 certificate can satisfy Levels 0 through 3.

This makes advance preparation valuable for businesses expecting to bid regularly into the defence supply chain.

Current UK cyber risk supports the case for stronger assurance

The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of UK businesses identified a cyber breach or attack during the previous 12 months, equivalent to approximately 612,000 businesses.

The rate rose to 65 per cent among medium businesses and 69 per cent among large businesses. Phishing remained the most commonly reported attack and affected 38 per cent of businesses.

The same research estimated that 19 per cent of businesses experienced at least one cyber crime during the year. Among businesses that identified a cyber breach or attack, 44 per cent went on to classify at least one event as cyber crime.

These figures show why defence assurance needs more than policy documents. Suppliers need controls that operate consistently across people, systems, suppliers and business processes.

Which companies provide Cyber Essentials certification services in the UK?

Official Cyber Essentials certification comes through Certification Bodies operating within the IASME network.

UK Cyber Security Group provides Cyber Essentials certification and confirms that it operates as a registered Cyber Essentials Certification Body. The company offers assessment and support for organisations that want help meeting the technical requirements.

UK Cyber Security Group also appears within IASME’s current DCC Certification Body network, giving defence suppliers a route to support for both the Cyber Essentials foundation and DCC assessment.

When choosing a provider, look for clear knowledge of current Cyber Essentials requirements and experience with defence assurance.

If your target is DCC, confirm that the provider holds IASME authorisation for the DCC level you need.

Which UK-based firms offer Cyber Essentials consultancy services?

Many UK cyber security consultancies support organisations with Cyber Essentials preparation, technical remediation and certification readiness.

UK Cyber Security Group provides Cyber Essentials certification together with wider cyber security and DCC services. Its current Cyber Essentials service supports applicants through the certification process, while its DCC service supports organisations preparing to demonstrate compliance with the relevant Defence Standard controls.

Good consultancy should improve the underlying security position rather than simply rewrite assessment answers.

The provider should help you identify gaps, understand scope, strengthen controls and produce evidence that reflects genuine working practice.

A practical DCC preparation sequence

A straightforward preparation route looks like this:

1. Confirm whether a defence contract, MOD delivery team or Prime has specified a DCC level.
2. Obtain or renew Cyber Essentials for Levels 0 and 1, or Cyber Essentials Plus for Levels 2 and 3.
3. Download the current IASME DCC Applicant Guide, Scoping Guidance and Process Guide.
4. Review Defence Standard 05-138 Issue 4.
5. Define the organisation-wide scope and complete the Statement of Scope.
6. Choose an IASME assured DCC Certification Body qualified for your target level.
7. Review every applicable control.
8. Record how the organisation meets each requirement.
9. Identify the person responsible for each control.
10. Map strong evidence to each answer.
11. Complete a structured gap review.
12. Remediate weaknesses before formal assessment.
13. Test controls that depend on operational effectiveness, including recovery and incident response.
14. Make sure senior management understands significant risks and responsibilities.
15. Organise evidence so the assessor can review it efficiently.
16. Complete the assessment honestly and respond clearly to assessor requests.
17. After certification, maintain Cyber Essentials, complete annual DCC attestation and keep control evidence current.

This sequence prevents the common mistake of starting with forms before understanding the underlying security requirement.

Common preparation weaknesses

One common problem is under-scoping.

Another is collecting policies without collecting evidence that the processes operate.

Organisations can also struggle when nobody clearly owns a control.

Other weaknesses include outdated risk assessments, missing supplier reviews, unsupported software, incomplete MFA coverage, untested backups, weak incident exercises, excessive privileged access and records that do not match current working practice.

Avoid last-minute document creation.

If a control says the business reviews something periodically, the assessor should be able to see completed reviews.

If a process says management considers cyber risk, keep evidence of management decisions.

If you claim recovery capability, test it.

DCC rewards operational maturity rather than paperwork volume.

Keep evidence organised from the beginning

Evidence management can become one of the most demanding parts of preparation, especially at the higher DCC levels.

Create a clear evidence reference for each control.

Use consistent names.

Record the owner.

Record the date.

Identify where the evidence sits.

Keep obsolete evidence away from the current assessment material.

Make sure sensitive evidence receives suitable protection.

The assessor should be able to connect your written explanation with a real record, system or process.

Good organisation also helps your own team identify gaps quickly.

If you cannot find evidence for a control that you believe operates, ask whether the process actually creates reliable records.

Prepare management for DCC questions

Senior management should understand why the organisation seeks DCC and what it commits to maintain.

Leaders may need to explain:

Who owns cyber security

How significant risks receive escalation

How the organisation allocates resources

How cyber incidents reach senior management

How resilience receives review

How supplier risk is managed

How legal and contractual requirements receive attention

How improvement actions receive oversight

The assessor should see a management system that operates throughout the business.

A senior leader should not encounter the DCC controls for the first time shortly before the assessment.

Treat DCC as an ongoing business control

Passing the assessment should not mark the end of the work.

Keep Cyber Essentials current.

Maintain your evidence.

Continue reviewing access.

Test backups.

Exercise incident response.

Monitor vulnerabilities.

Review important suppliers.

Update policies when business activity changes.

Keep risk records current.

Maintain training.

Review the scope when the organisation changes significantly.

The annual attestation creates an important checkpoint, but strong organisations maintain the controls throughout the year rather than rebuilding them before each declaration.

Prepare for the level you genuinely need

Defence Cyber Certification can look demanding, particularly at Levels 1, 2 and 3, but preparation becomes manageable when you break it into scope, controls, ownership, evidence and remediation.

Start by confirming the required Cyber Risk Profile.

Secure the correct Cyber Essentials foundation.

Use IASME’s current guidance.

Build an honest view of the organisation.

Collect evidence from real business activity.

Fix weaknesses before assessment.

Involve leadership.

Work with an assured Certification Body early.

IASME states that DCC gives organisations one organisation-level assurance that can support UK Defence procurement, subject to annual attestation and full recertification every three years.

UK Cyber Security Group provides both Cyber Essentials certification and DCC services and appears within IASME’s current DCC Certification Body network.

For organisations planning to work within the UK defence supply chain, preparation should deliver more than a certificate. Done properly, it creates clearer governance, stronger technical controls, better supplier oversight, stronger resilience and evidence that the organisation can protect the services and information on which defence delivery depends.

UK Cyber Security Group Ltd is here to help

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us