Defence Cyber Certification (DCC) Level 0 — the entry-level certification for UK defence supply chain organisations assessed at Very Low cyber risk. Assessed against Def Stan 05-138 (Issue 4) by Vincent Cyber Defence, an IASME Approved Certification Body.
All MOD defence industry partners must achieve DCC Level 0 by 31 December 2026 — mandated by Eleanor Fairford, Director of Cyber Defence & Risk. Read the full breakdown →
The Defence Cyber Certification (DCC) is a comprehensive cyber security certification framework for UK defence suppliers, developed jointly by the Ministry of Defence (MOD). It strengthens the cyber resilience of the UK's defence supply chain, with Cyber Essentials at its core.
DCC Level 0 is the entry-level certification, designed for organisations with a Very Low assessed cyber risk profile. It is suitable for suppliers providing low-risk goods or services — requiring compliance with three basic controls.
As an IASME Approved Certification Body, Vincent Cyber Defence is authorised to deliver DCC Level 0 assessments and issue DCC certificates directly. Once certified, your organisation is published on the IASME public registry and receives a digital certificate and verifiable digital badge.
DCC is currently not mandatory. Applicants may still tender for MOD contracts via the normal process at this stage. However, Eleanor Fairford, Director of Cyber Defence & Risk at the MOD, has mandated that all defence industry partners achieve at least DCC Level 0 by 31 December 2026 — so early certification is strongly advised. Read our full breakdown of the December 2026 deadline →
DCC certification is expected to become mandatory across all Defence procurement. Certifying now means you're ready when the requirement lands — not scrambling to catch up.
With the Cyber Security Model (CSM) in place, a DCC certificate also replaces the ad-hoc supplier questionnaires that MOD and prime contractors previously used — proving your cyber posture once, to a recognised standard, rather than answering bespoke requests for every contract.
Start Your Assessment →The cornerstone of the DCC scheme. Issue 4 expands scope to enhancing overall organisational resilience, aligned to the CAF framework and NIST and ISO standards.
A valid Cyber Essentials certificate — with scope aligned to your DCC scope — is a prerequisite. Misalignment between scopes will result in certification failure. CE Plus is not required at Level 0.
Valid for three years with annual Cyber Essentials recertification and an annual attestation confirming controls are maintained and scope is unchanged.
Once certified, your organisation is published on the IASME public registry and you receive a digital certificate and verifiable digital badge for use on your website or email footer.
Ensure you hold a valid Cyber Essentials certificate with a scope that aligns with your intended DCC assessment scope — misalignment will cause certification failure.
We review your scoping statement — covering what is included, excluded, and your rationale — and challenge it to ensure it is logical and clearly documented.
We assess your organisation against the Def Stan 05-138 (Issue 4) controls, reviewing evidence and confirming compliance as an IASME Approved Body.
Your DCC Level 0 certificate is issued. You receive a digital certificate and verifiable badge. Your organisation is published on the IASME public registry. Valid for 3 years.
Level 0 covers three controls drawn from Def Stan 05-138 (Issue 4). All three must be met — there is no partial pass.
You must hold a current Cyber Essentials certificate issued to your organisation, with a scope that aligns to your DCC assessment scope. If CE is not in place or the scopes do not align, certification fails automatically — no further controls are assessed.
You must demonstrate that personal data is processed lawfully — with a named DPO, a clear privacy notice, consent records, and DPIA evidence where processing carries risk. You do not need to be perfectly GDPR-compliant, but no clear non-compliance should be evident.
Resilience must be built into how your systems are designed, operated, and managed across their full lifecycle. Backup is central to this — you must back up critical data regularly, store copies offsite or in the cloud, and be able to demonstrate a successful restore.
Automatic Failure Conditions
A missing or expired Cyber Essentials certificate, or a CE scope that does not adequately cover your DCC scope, results in immediate failure — no further controls are assessed.
Before reaching out, confirm you hold a valid Cyber Essentials certificate with a scope that covers your intended DCC scope. Then contact our UK team — no jargon, no hard sell.
New auto-fail MFA rules and cloud scoping changes are now live. Complete guide from an IASME Approved Body.
Cyber Essentials · 5 minEverything UK businesses need to know about the Government-backed Cyber Essentials scheme.
DCC Level 0 · 7 minA clear breakdown of Defence Cyber Certification Level 0 and how to get certified.
DCC Level 0 · 8 minDEFCON 658, CSM v4, and DCC Level 0 explained — everything MOD suppliers need to stay tender-ready.