What documentation is required for Defence Cyber Certification (DCC) Level 0?

Defence Cyber Certification Level 0 is the starting point within the UK Ministry of Defence Cyber Security Model, but even at this foundation level, a business needs to show more than good intentions.

The documentation does not need to become a huge library of policies. Level 0 contains only three controls, and IASME makes clear that evidence should remain proportionate to the organisation. What matters is that your business can explain how it meets each requirement and provide evidence showing that the relevant security arrangements operate in practice.

Under Defence Standard 05-138 Issue 4, Level 0 is the Basic Cyber Risk Profile and contains three controls. The standard also states that suppliers must have documented and implemented controls in place with auditable evidence.

For Level 0, those three controls are:

• Cyber Essentials
• UK GDPR compliance
• Resilient networks and systems

The Ministry of Defence has also asked industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials for applicable business-critical systems within scope.

UK Cyber Security Group provides Cyber Essentials certification and Defence Cyber Certification services for organisations preparing for Level 0 and further levels of DCC. UK Cyber Security Group Ltd is currently listed in IASME’s DCC Certification Body directory for Level 0 assessments.

Start with the three Level 0 controls

The easiest way to understand the documentation requirement is to work directly from the three controls rather than creating documents at random.

Control 0001 covers Cyber Essentials.

Control 2314 covers UK GDPR compliance.

Control 2500 covers resilient networks and systems.

These requirements come directly from Defence Standard 05-138 Issue 4. Control 0001 requires Cyber Essentials certification covering the required scope and a commitment to maintain it. Control 2314 requires the processing of personal data to comply with UK GDPR requirements. Control 2500 requires resilience against cyber attack and system failure to form part of the design, implementation, operation and management of systems supporting business functions and protecting information.

Your documentation should therefore demonstrate these three things clearly.

You do not need to create unnecessary documents simply to make the assessment pack look larger.

Your Statement of Scope comes first

Before collecting evidence, define what your DCC certification covers.

IASME requires applicants preparing for DCC to review their organisational scope and complete a Statement of Scope. It strongly recommends discussing scope with your chosen Certification Body early so that under-scoping does not create difficulties later.

What should your Statement of Scope describe?

A useful Statement of Scope should identify the legal entity seeking certification and the business operations that support its secure and resilient operation.

Consider documenting:

• Legal entity name
• Business locations
• Critical business functions
• Important IT services
• Business-critical systems
• Cloud services
• Relevant employees
• Key external services
• Important suppliers
• Networks
• Information required for business operation
• Any justified boundaries

DCC uses a broad organisational approach.

The MOD clarified in 2026 that the standard applies across the supplier’s business-critical operations as a single legal entity rather than only the systems directly supporting one MOD contract.

IASME similarly states that DCC scope must include the processes, systems and business areas required for the organisation to function and deliver securely and resiliently.

That makes the Statement of Scope one of the most important pieces of Level 0 preparation.

Do not scope DCC around one Defence laptop

A common misunderstanding is that DCC should cover only the computer or department working directly on an MOD contract.

That is not the current approach.

Defence Standard 05-138 states that its scope covers the supplier’s overarching corporate or enterprise environment and includes the systems, processes, procedures and information needed for effective protection and operation.

For a small business, that could mean considering:

• Microsoft 365
• File storage
• Identity systems
• Business laptops
• Backup services
• Accounting systems
• Customer management services
• Internet connectivity
• IT administration
• Business communications
• Relevant suppliers

If failure of a system could prevent the company from continuing its critical operations, it deserves consideration when defining DCC scope.

Cyber Essentials provides the technical foundation

Cyber Essentials is mandatory at DCC Level 0.

The current Cyber Essentials technical requirements are Requirements for IT Infrastructure v3.3, which became effective on 27 April 2026.

Cyber Essentials focuses on five core technical control areas:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

A valid Cyber Essentials certificate provides important evidence for the first Level 0 control.

However, simply holding any Cyber Essentials certificate may not automatically be enough.

The scope needs to align appropriately with the DCC scope.

Document how Cyber Essentials and DCC scopes align

Cyber Essentials focuses primarily on internet-connected systems.

DCC takes a broader organisational resilience view.

IASME states that internet-connected networks and devices falling within the DCC scope need appropriate Cyber Essentials coverage. The DCC assessor reviews both scopes to check that they align adequately.

Your preparation records should therefore make the relationship easy to understand.

A simple scope mapping can identify:

• Business-critical system
• Whether it sits inside DCC scope
• Whether it connects to the internet
• Whether Cyber Essentials covers it
• Reason for any difference
• Relevant owner

This can save considerable time when the assessor begins reviewing the organisation.

Cyber Essentials and DCC scopes do not always need identical wording.

For example, DCC may include an important system that has no internet connectivity, while Cyber Essentials may include additional internet-connected equipment that does not represent a critical DCC business function.

The important point is being able to explain the relationship clearly.

What are the key requirements for achieving Cyber Essentials certification?

Cyber Essentials requires organisations to meet the current technical requirements across the five core controls.

Firewalls should protect devices and networks from unnecessary connections.

Secure configuration reduces unnecessary services, accounts and insecure settings.

Security update management requires supported software and prompt application of important vulnerability fixes.

Under the current v3.3 requirements, relevant vulnerability fixes must generally receive application within 14 days where the vendor identifies the vulnerability as critical or high risk, where the vulnerability has a CVSS v3 score of 7 or above, or where the vendor provides no severity information for the vulnerabilities addressed by the update.

User access control restricts access according to legitimate business need.

Malware protection reduces the chance of malicious software compromising systems.

For DCC Level 0, keep your current Cyber Essentials certificate available as evidence and ensure that responsible staff understand its scope.

Maintain a Cyber Essentials commitment record

Defence Standard 05-138 does not simply require the organisation to hold Cyber Essentials on assessment day.

Control 0001 also requires the supplier to commit to maintaining Cyber Essentials for the relevant period.

DCC maintenance reinforces this requirement.

IASME states that organisations need to recertify to Cyber Essentials or Cyber Essentials Plus annually, complete an annual DCC attestation, and complete full DCC recertification every three years.

It therefore makes sense to retain a documented management commitment confirming that Cyber Essentials will remain maintained.

This might record:

• Responsibility for annual renewal
• Renewal date
• Certificate reference
• Current Cyber Essentials scope
• Management commitment to maintain certification
• Responsibility for monitoring material changes
• Review arrangements

Keep this proportionate.

A concise approved statement can provide clearer evidence than a long policy that nobody uses.

Can I renew my Cyber Essentials certification through an online service?

Yes. Cyber Essentials uses an online assessment process delivered through authorised Certification Bodies.

Cyber Essentials certificates remain valid for 12 months. Government management information confirms that certificates awarded under the scheme have a twelve-month validity period.

This is particularly important when Cyber Essentials supports DCC Level 0.

Set a renewal reminder well before expiry.

Do not allow the underlying certificate to lapse while the DCC certification remains active.

Review your IT environment during renewal rather than automatically repeating the previous year’s answers.

New laptops, cloud applications, employees, administrator accounts and suppliers may change the scope.

The second Level 0 area is UK GDPR compliance

Control 2314 requires suppliers to ensure that processing of personal data complies with UK GDPR requirements.

IASME’s current Level 0 guidance specifically refers to policies and procedures and appropriate Data Protection Impact Assessment evidence as examples relevant to this control.

This does not mean every small business needs an enormous data protection manual.

The assessor wants to understand how your organisation manages personal data and whether the relevant arrangements operate.

Build a practical data protection evidence set

Your Level 0 evidence might include:

• Data Protection Policy
• Privacy information
• Data processing records
• Data retention arrangements
• Personal data breach procedure
• Data subject request process
• Data processor agreements where relevant
• Staff data protection responsibilities
• Training records where appropriate
• Data Protection Impact Assessments where required
• Records demonstrating review

The exact documents should reflect what your business actually does.

Do not create records that have no relationship with your processing activity.

Your Data Protection Policy should reflect reality

A Data Protection Policy can provide a useful central document.

It might describe:

• Responsibility for data protection
• Data protection principles
• How personal information receives protection
• Access responsibilities
• Data retention
• Secure disposal
• Handling data subject requests
• Data breach reporting
• Supplier responsibilities
• Training
• Review

The assessor may then ask for evidence that the organisation follows these arrangements.

A policy stating that all personal information receives review against a retention schedule will be far more convincing when you can also show the retention process operating.

Keep evidence of Data Protection Impact Assessments where appropriate

IASME specifically highlights DPIA evidence within its recent Level 0 guidance.

A DPIA helps an organisation assess high-risk personal data processing before or during relevant activity.

Not every processing activity automatically needs a DPIA.

Where a DPIA is required, the record should generally explain:

• Proposed processing
• Purpose
• Personal information involved
• Necessity and proportionality
• Risks to individuals
• Safeguards
• Actions
• Responsibility
• Approval
• Review

If your organisation has assessed its operations and reasonably determined that no DPIA is currently needed, retain enough information to explain your reasoning if the assessor asks.

Create a simple personal information map

A basic information map can significantly improve your Level 0 preparation.

Record where personal information exists and who can access it.

Consider:

• Employee records
• Customer information
• Supplier contacts
• Recruitment information
• Email
• CRM platforms
• Accounting systems
• Cloud storage
• Backup information

This helps demonstrate that the organisation understands its data rather than simply possessing a generic privacy policy.

It also supports resilience planning because you know which services contain important information.

The third control concerns resilient networks and systems

Control 2500 requires the supplier to build resilience against cyber attack and system failure into the design, implementation, operation and management of systems supporting business functions and protecting information.

This is broader than having a backup product.

The assessor needs confidence that you have considered how the organisation will remain operational or recover when something fails.

IASME describes Level 0 resilience evidence as practical measures across the lifecycle of systems and specifically gives tested restores as an example of meaningful evidence.

Document your critical systems

Start by identifying what your business cannot operate without.

A Critical Systems Register can be simple.

Record:

• System or service
• Business function supported
• Owner
• Supplier
• Main dependency
• Information handled
• Impact of failure
• Recovery method
• Backup status where relevant
• Alternative arrangements

For a small business, critical services might include Microsoft 365, file storage, accounting, customer management, internet connectivity and an important line-of-business application.

The assessor needs to understand how your resilience arrangements relate to your real operation.

Maintain appropriate backup evidence

Backups often provide important evidence for the resilience requirement.

Useful records can include:

• Backup policy or procedure
• Systems receiving backup
• Backup frequency
• Retention information
• Backup status reports
• Failed backup actions
• Recovery responsibilities
• Restore test records

Do not rely entirely on screenshots showing successful backup jobs.

Backups have value only when information can be recovered.

IASME’s current Level 0 guidance specifically notes that assessors want evidence that resilience measures are real and uses tested restores as an example.

A restore test record might contain:

• Date
• System
• Information recovered
• Person performing the test
• Result
• Recovery time
• Problems discovered
• Follow-up action

This can provide strong practical evidence without creating excessive documentation.

Create an appropriate recovery record

A small organisation does not necessarily need an enormous continuity manual.

It does need to understand how important services will recover.

Your recovery information might identify:

• Critical service
• Responsible person
• Supplier contact
• Recovery process
• Required credentials
• Backup location
• Dependencies
• Alternative working arrangement
• Communication responsibilities
• Escalation

Keep sensitive recovery information protected.

The objective is to show that recovery has been considered before an incident happens.

Incident records can strengthen resilience evidence

If your organisation has experienced a security incident or significant service failure, retain appropriate records.

These can demonstrate that resilience exists in practice.

An incident record may include:

• Date
• What happened
• Systems affected
• Business effect
• Action taken
• Recovery
• Lessons identified
• Follow-up action

Do not invent incidents for the assessment.

If no significant incident has occurred, resilience exercises and recovery tests can provide valuable evidence instead.

Record who owns Level 0 responsibilities

Even with only three controls, responsibility needs clarity.

Identify who owns:

• DCC certification
• Cyber Essentials
• Data protection
• Business resilience
• Backups
• Evidence
• Annual attestation
• Scope review

One person may own several areas in a small organisation.

That is perfectly reasonable.

The important point is that responsibilities are understood.

A simple responsibility record or organisational chart can help.

How can I prepare my small business for Cyber Essentials assessment?

Begin with an accurate inventory of your internet-connected environment.

Identify:

• Laptops
• Desktop devices
• Servers
• Mobile devices
• Network equipment
• Cloud services
• Operating systems
• Relevant applications
• Administrator accounts

Check that software remains supported.

Apply required security updates.

Review firewall controls.

Remove unnecessary administrator rights.

Check malware protection.

Review secure configuration.

Confirm cloud authentication arrangements.

Most importantly for DCC, compare the resulting Cyber Essentials scope against your DCC Statement of Scope.

A small business can have a relatively simple IT environment and still depend on several critical cloud services.

Do not overlook them merely because another company hosts the infrastructure.

What software solutions support compliance with Cyber Essentials standards?

Cyber Essentials does not require every organisation to purchase the same products.

Technology should support the required security outcomes.

Useful solutions can include:

• Endpoint protection
• Patch management
• Asset management
• Identity management
• Multi-factor authentication
• Mobile device management
• Backup services
• Vulnerability management
• Security monitoring

Microsoft environments may use Microsoft Entra and Intune to support identity and endpoint management.

Microsoft Defender, SentinelOne and comparable endpoint security platforms can support malware protection when properly managed.

The product itself does not provide compliance automatically.

Configuration, monitoring and ongoing management matter.

For DCC Level 0, technology can also provide useful evidence.

Reports from endpoint management, backup services or security platforms can demonstrate that claimed controls actually operate.

Do not build a forty-page policy library for three controls

IASME explicitly recognises that Level 0 evidence should scale with the organisation.

Its September 2026 guidance notes that a micro organisation does not need a forty-page policy suite. Assessors want evidence showing that the business has considered the requirements, documented the fundamentals and implemented the relevant resilience measures.

This is important for smaller defence suppliers.

A concise, accurate document backed by operational evidence often provides more value than a generic document containing promises the company does not actually follow.

Focus on clarity.

What should your Level 0 evidence folder contain?

A practical Level 0 evidence set could include:

• Statement of Scope
• Current Cyber Essentials certificate
• Cyber Essentials scope details
• Mapping between CE scope and DCC scope
• Commitment to maintain Cyber Essentials
• Data Protection Policy
• Relevant privacy records
• DPIA records where appropriate
• Personal information handling procedures
• Critical systems information
• Resilience arrangements
• Backup records
• Restore testing evidence
• Responsibility records
• Supporting technical evidence
• Relevant supplier information
• Review records

This is a practical preparation list rather than a universal requirement that every applicant must produce every item as a separate document.

Your assessor may accept different evidence when it demonstrates the same control effectively.

Level 0 does not require an Assessment Submission Record

This is a useful difference between Level 0 and the higher DCC levels.

IASME’s current Help and Resources page states that no Assessment Submission Record is necessary for Level 0. Assessment Submission Records are available for Levels 1 to 3.

You still need to answer the relevant assessment questions and provide supporting evidence when requested.

IASME states that applicants need to describe how the organisation meets each control and have evidence readily available for the assessor.

DCC is not a self-assessment scheme.

IASME confirms that no DCC level operates as self-assessment.

Keep the Applicant Guide and Scoping Guide nearby

IASME publishes scheme documentation to help applicants prepare.

Before assessment, review:

• DCC Applicant Guide
• DCC Scoping Guide
• DCC Process Guide
• Defence Standard 05-138 Issue 4

The MOD also publishes the Cyber Security Model guidance and blank Supplier Assurance Questionnaire sets.

Use these sources rather than relying on old DCC or Cyber Security Model material.

CSM version 4 is now live, and the previous Issue 3 Defence Standard is archived for CSM v3 purposes.

DCC certification and the MOD questionnaire remain separate

Holding DCC does not currently remove every MOD Supplier Assurance Questionnaire obligation.

The MOD states that suppliers with a valid DCC certificate are not yet exempt from completing the required elements through the Supplier Cyber Protection Service.

At present, completion of the full SAQ at the required level remains mandatory within contractual risk assessment and procurement processes.

This distinction is important when organising documentation.

Your DCC evidence pack supports independent certification.

Your contract-related CSM obligations may still require information through the MOD service.

Keep both processes organised.

A Cyber Improvement Plan is different again

Where a defence supplier does not hold the DCC certification required for a procurement, the MOD may require a Cyber Improvement Plan.

The government publishes the current Cyber Improvement Plan template separately.

A CIP should not be confused with the normal Level 0 evidence pack.

If you already meet the three Level 0 controls and achieve certification, your focus should be maintaining those controls.

Where gaps exist in a contractual setting, follow current MOD guidance and the requirements attached to that procurement.

Which companies provide Cyber Essentials certification services in the UK?

Cyber Essentials certification is provided through Certification Bodies licensed within the official scheme.

For businesses preparing for DCC, choosing a provider that understands both Cyber Essentials and DCC can make scope alignment easier.

UK Cyber Security Group provides Cyber Essentials certification and Defence Cyber Certification services.

IASME’s current DCC directory lists UK Cyber Security Group Ltd among the Certification Bodies qualified to deliver DCC Level 0 assessment.

When selecting a provider, confirm that it is currently authorised for the service you require.

Certification status and assessor availability can change.

Which UK-based firms offer Cyber Essentials consultancy services?

UK businesses can obtain Cyber Essentials support from specialist cyber security companies, managed service providers and Certification Bodies.

For a Defence supplier, useful support should go beyond simply completing the Cyber Essentials questionnaire.

Look for experience with:

• Cyber Essentials scoping
• DCC scope alignment
• Security update requirements
• Cloud services
• Administrator access
• Malware protection
• Resilience
• Data protection
• Audit evidence
• DCC preparation

A provider familiar with DCC can help the organisation understand how Cyber Essentials evidence fits into the wider Level 0 assessment.

UK Cyber Security Group provides Cyber Essentials and DCC services for organisations working towards defence supply-chain assurance.

Level 0 comes at an important time for UK suppliers

The MOD has asked all industry partners to achieve DCC Level 0 by 31 December 2026.

This comes against a wider cyber security backdrop in which 43 per cent of UK businesses reported identifying a breach or attack during the previous twelve months, equivalent to approximately 612,000 businesses.

The proportion reached 65 per cent for medium businesses and 69 per cent for large businesses.

Phishing remained the most commonly identified attack, affecting 38 per cent of businesses.

These figures help explain why Defence is looking beyond the protection of individual contract files and increasingly focusing on organisational resilience.

A supplier that cannot keep its own business operational may struggle to fulfil Defence obligations even when the MOD information itself remains protected.

Cyber Essentials adoption is also growing

Government data published in September 2026 shows that 61,430 Cyber Essentials certificates were awarded during the twelve months from July 2025 to June 2026.

Of those, 46,245 were Cyber Essentials and 15,185 were Cyber Essentials Plus.

This means many defence suppliers may already have one important part of the Level 0 requirement in place.

The next task becomes confirming scope alignment and assembling evidence around UK GDPR and organisational resilience.

Keep documentation current after certification

DCC Level 0 does not end when the certificate arrives.

IASME requires annual attestation and full DCC recertification every three years.

Cyber Essentials also needs annual renewal.

Create a simple compliance calendar covering:

• Cyber Essentials expiry
• DCC annual attestation
• Scope review
• Data protection review
• Resilience review
• Recovery testing
• DCC recertification date

This prevents certification from becoming a one-off project.

Scope changes need attention

Your organisation may change significantly during the certification period.

You might introduce a new cloud platform.

Another company may acquire your business.

You might move offices.

A critical supplier could change.

New employees may join.

A previously minor system could become business-critical.

These changes can affect DCC scope or supporting evidence.

IASME states that annual attestation includes confirmation that the controls remain maintained and the scope has not significantly changed.

Review major changes when they happen rather than waiting for the annual attestation date.

Use evidence from other frameworks where useful

Many defence suppliers already hold security certifications or operate established management systems.

IASME confirms that evidence from other schemes can support a DCC assessment, although other certifications do not automatically provide direct compliance with Defence Standard controls.

The MOD also publishes a mapping document linking Defence Standard 05-138 with frameworks including ISO 27001:2022, NIST CSF, NIST SP 800-171, Cyber Essentials and others.

Reuse appropriate evidence.

Do not reproduce the same process several times purely because different standards ask similar questions.

Make every document prove something

Good Level 0 documentation has a clear purpose.

Your Cyber Essentials certificate demonstrates the technical baseline.

The Statement of Scope explains what DCC covers.

The scope mapping demonstrates how Cyber Essentials aligns with DCC.

Data protection records demonstrate how personal information receives appropriate management.

DPIA evidence demonstrates that higher-risk processing receives consideration where necessary.

Critical systems information demonstrates that the organisation understands what it depends on.

Backup and restore records demonstrate practical resilience.

Responsibility records show who owns these activities.

Together, these documents form a clear evidence trail.

A practical DCC Level 0 document checklist

Before your assessment, ask whether you have the following readily available where relevant:

• Completed Statement of Scope
• Current Cyber Essentials certificate
• Cyber Essentials scope record
• DCC and Cyber Essentials scope comparison
• Management commitment to maintain Cyber Essentials
• Data Protection Policy
• Relevant privacy records
• Personal data handling processes
• DPIA records where required
• Data breach arrangements
• Critical business systems information
• Resilience evidence
• Backup information
• Restore test records
• Relevant continuity arrangements
• Responsibility assignments
• Supporting supplier evidence where relevant
• Current review records
• Evidence supporting statements made to the assessor

Do not treat this as a demand for nineteen separate documents.

Several items can sit within the same controlled record.

A smaller organisation should keep the evidence proportionate and easy to understand.

Prepare the evidence before booking the assessment

The assessment becomes much easier when supporting information already exists.

Ask yourself:

Can we clearly explain our scope?

Does our Cyber Essentials certificate cover the necessary internet-connected environment?

Can we explain any differences between CE and DCC scope?

Can we demonstrate appropriate personal data compliance?

Do we have DPIA evidence where relevant?

Do we know which systems support critical business functions?

Can we demonstrate resilience against system failure?

Have we tested recovery where appropriate?

Can we find the evidence quickly?

Does management understand its responsibility for maintaining certification?

If several answers remain uncertain, complete those actions before formal assessment.

Level 0 documentation should be simple, accurate and useful

Defence Cyber Certification Level 0 does not require a business to create a vast compliance bureaucracy.

It requires evidence against three important control areas.

Maintain Cyber Essentials across the appropriate scope.

Demonstrate compliance with UK GDPR requirements.

Show that resilience against cyber attack and system failure forms part of the way critical systems are managed.

The supporting documentation should make those controls easy for an assessor to verify.

Start with the Statement of Scope.

Align Cyber Essentials.

Document data protection responsibilities.

Identify business-critical systems.

Retain practical resilience evidence.

Test recovery where appropriate.

Assign ownership.

Keep everything current.

Most importantly, make sure the documentation matches what actually happens inside the business.

Defence Standard 05-138 requires documented and implemented controls with auditable evidence. That means an impressive policy without operational proof will not provide the same assurance as a short, clear record supported by real evidence.

For organisations preparing for Level 0, UK Cyber Security Group can provide Cyber Essentials certification and Defence Cyber Certification assessment services, helping suppliers understand the relationship between the technical baseline, DCC scope and the evidence required for certification.

With the MOD asking industry partners to achieve Level 0 by 31 December 2026, building that evidence now gives organisations time to correct scope issues, test resilience and make sure the required controls have become normal business practice before assessment.

UK Cyber Security Group Ltd is here to help

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us