DCC Deadline: What UK Defence Suppliers Must Do Before 31 December 2026 (Simple Guide)

What is Defence Cyber Certification?

DCC is the MOD's organisation-wide cyber assurance scheme for defence suppliers.

It is built on Defence Standard 05-138 Issue 4 and aligned with the NCSC Cyber Assessment Framework (CAF). The scheme replaces the previous reliance on self-assessment questionnaires and Cyber Implementation Plans with independently assessed certification.

DCC is managed by IASME, the MOD's official scheme partner. Assessments are delivered by IASME-licensed Certification Bodies.

Certification is:

Organisation-level, rather than limited to one contract.
Valid for three years.
Subject to annual attestation at the end of years one and two.
Re-assessed fully in year three.
Dependent on maintaining a current underlying Cyber Essentials or Cyber Essentials Plus certificate.

DCC certification can provide useful evidence across multiple procurements. However, it does not automatically replace every contract-specific SAQ. Your customer or contracting authority may still request additional information.

Step one: Confirm your Cyber Risk Profile

You do not choose your DCC level.

The MOD's Cyber Security Model v4 assigns a Cyber Risk Profile (CRP) to each contract. The current model uses numeric Levels 0 to 3, which map to the DCC levels.

DCC level	Controls	Prerequisite	Assessment approach
Level 0	3	Cyber Essentials	Documentation review; no site visit
Level 1	101	Cyber Essentials	Documentation review and clarification rounds
Level 2	139	Cyber Essentials Plus	Hands-on technical verification
Level 3	144	Cyber Essentials Plus	Currently delivered as an L2 and L3 hybrid pilot

Level 3 includes more than 300 Requirement Statements across the wider assessment process. It is significantly more demanding than Level 0.

If your contract clause does not clearly name a DCC level, confirm the required CRP in writing with the contracting authority before spending money on an assessment.

Choosing the wrong level is one of the most common ways suppliers waste time and budget.

Step two: Understand the three Level 0 controls

DCC Level 0 is the immediate priority for most suppliers affected by the MOD's 31 December deadline.

The three Level 0 controls are:

Cyber Essentials, including making sure your Cyber Essentials scope aligns with your DCC scope and maintaining Cyber Essentials throughout the DCC certificate period.
UK GDPR compliance, with appropriate policies, procedures and DPIA evidence for your organisation.
Resilient networks and systems: practical measures across the lifecycle of your systems so they can withstand cyber attacks or failures and recover quickly.

This may sound straightforward. The difficult part is usually proving that the controls apply across the right organisational scope.

Level 0 is not simply an online Cyber Essentials questionnaire. You need to show that the three controls are in place and supported by practical evidence.

Good practice still matters here. Board-level ownership, an organisation-wide cyber risk assessment and risk-based decision making all help support these controls, even though they are not the three controls themselves.

Step three: Get your scope right

Scoping is the most important part of DCC preparation.

Under Defence Standard 05-138 Issue 4, the scope is your overarching corporate or enterprise environment. It includes all systems, processes, procedures and data needed to protect the information and functions within the MOD contract.

That means corporate systems can be in scope even if they do not store MOD information.

For example, the following may be relevant:

Email and collaboration platforms.
Finance and customer relationship systems.
Identity and access management.
Laptops and mobile devices used by contract staff.
Cloud services supporting the business.
Backup and recovery systems.
HR, onboarding and offboarding processes.
Supplier management activities.
Business processes essential to delivering the contract.

Do not define scope as "the laptop used by the MOD project manager" without looking at the wider business environment supporting that person.

You should document:

Systems and services included in scope.
Systems and services excluded from scope.
The reasons for exclusions.
Business functions supporting the MOD contract.
Data flows and dependencies.
The relationship between your DCC scope and Cyber Essentials scope.

Your DCC scope and Cyber Essentials scope may not be identical. Cyber Essentials focuses on internet-connected systems, while a DCC scope may also include non-internet-connected or air-gapped elements. Equally, your Cyber Essentials scope may include internet-connected systems that are not business-critical and so sit outside DCC scope. The two scopes will not always be identical, but assessors will look closely at how they relate, so map the overlap and be able to explain it clearly.

Defining organisational scope for DCC certification

The seven-step path to DCC Level 0

Use this sequence to keep the project focused.

1. Confirm your CRP

Check your contract, framework documentation or prime contractor requirements. If the level is unclear, ask the contracting authority for written confirmation.

2. Hold current Cyber Essentials certification

Cyber Essentials is the entry prerequisite for DCC Level 0 and Level 1.

Check:

The certificate expiry date.
The organisation and systems covered.
Whether business-critical systems are included.
Whether the scope matches your DCC position.
Whether the certificate will remain valid throughout the engagement.

For DCC Levels 2 and 3, you need Cyber Essentials Plus.

3. Arrange a scoping call with an IASME-licensed Certification Body

Discuss the intended scope before committing to the assessment. A good scoping conversation can identify problems before they become expensive remediation work.

4. Document the scope

Create clear in-scope and out-of-scope lists. Include overlap diagrams showing how your DCC and Cyber Essentials scopes relate.

5. Collect evidence

For Level 0, this should include evidence of:

Current Cyber Essentials certification.
UK GDPR policies, procedures and DPIA evidence where relevant.
Resilience measures for networks and systems.
Board-level ownership and accountability.
Your organisation-wide cyber risk assessment.
Relevant governance records and decisions.
Actions addressing identified risks.

Evidence should scale with your organisation's size. A micro or small business does not need a 40-page policy suite. Assessors want to see that you have thought it through, documented the basics, and can show the resilience measures are real, for example, tested restores rather than just a policy saying backups happen. At Level 0, clarity and consistency matter more than volume.

6. Complete remediation and assessment

Address gaps before the formal assessment where possible. Certification Bodies can explain requirements, clarify questions, verify scope and provide blank templates.

They cannot implement your policies, make changes for you, answer assessment questions on your behalf or draft evidence they will later assess.

7. Maintain certification

Once certified, keep your Cyber Essentials certificate current and prepare for annual attestation. DCC should become part of your normal governance rhythm, not a one-off compliance exercise.

How long does DCC preparation take?

Timelines depend on your size, scope, existing controls and readiness.

Typical guidance from Certification Bodies suggests:

Level 0: Around two to three weeks for an organisation that is already prepared.
Level 1: Around six to ten weeks, often including two or three remediation cycles.
Levels 2 and 3: Longer and more complex, particularly where technical verification, Cyber Essentials Plus and extensive evidence are required.

These estimates do not remove the need to book assessment capacity early.

Starting now matters. Certification takes time even when the control set is small, prime contractors often set their own earlier internal deadlines for suppliers, and IASME's network of UK Certification Bodies can only assess so many organisations before the December deadline.

If your organisation has unclear scope, unsupported legacy systems or an expired Cyber Essentials certificate, the project can take much longer.

Common reasons suppliers stall or fail

The same issues appear repeatedly across DCC preparation projects.

The wrong level was assumed

The supplier prepared for Level 0, but the contract required Level 1 or higher.

Solution: Confirm your CRP in writing before beginning.

The scope was too narrow

Only systems holding MOD data were included, while business-critical corporate systems were ignored.

Solution: Scope the organisation supporting the contract, not just the contract data.

Cyber Essentials expired mid-project

The supplier began preparation with a current certificate but allowed it to lapse before DCC certification.

Solution: Track Cyber Essentials renewal dates and plan early.

Supply-chain evidence was weak

Direct suppliers were not assessed properly, or Supplier Capability Assessments were incomplete.

Solution: Maintain a documented supplier due diligence process and record follow-up actions.

Legacy systems were included without a plan

Older systems remained in scope but had no supported upgrade path or risk treatment plan.

Solution: Identify legacy technology early. Agree owners, deadlines and compensating measures where appropriate.

Collecting evidence for cyber certification

Where a virtual CISO can help

Many UK defence SMEs do not need a full-time security executive. They do need someone who can coordinate the work, translate the requirements and keep the project moving.

An independent virtual CISO or fractional security consultant can support preparation by providing:

Scoping workshops and evidence mapping.
Gap analysis against your assigned DCC level.
A remediation roadmap with owners and deadlines.
Board-level cyber responsibility and reporting.
Organisation-wide cyber risk assessment support.
Cyber Essentials readiness and scope alignment.
Supplier due diligence and evidence collection.
Policy and governance development.
Ongoing support to remain attestation-ready.

This preparation support must remain independent from the formal assessment. The organisation or consultant helping you implement improvements should not be the Certification Body making the final assessment decision on that evidence.

SimpleCyber provides Virtual CISO support, Cyber Essentials guidance and DCC preparation services for growing businesses.

Do not aim for a higher level than your contract requires

DCC is risk-based.

You should meet the level assigned to your contract. You do not need to pursue Level 3 simply because it is the highest available level.

That said, higher-risk work may require higher assurance. Levels 2 and 3 require Cyber Essentials Plus and involve stronger technical verification.

The first Level 3 certification was achieved by Lockheed Martin in 2026. This shows that the scheme is achievable, but it does not mean every SME should follow the same route.

Start with your assigned requirement. Then build a proportionate security roadmap for future contracts.

Your next actions this week

Before the end of this week, you should:

Identify every MOD, prime contractor and defence subcontracting relationship.
Check which contracts reference DCC or Defence Standard 05-138.
Confirm your assigned CRP or request it in writing.
Check your Cyber Essentials expiry date.
List your business-critical systems and supporting processes.
Identify legacy systems and key suppliers.
Contact an IASME-licensed Certification Body about assessment capacity.
Decide whether you need independent preparation support.
Set board ownership for the DCC project.

The December deadline is close, but Level 0 is achievable for a prepared organisation.

The main risk is not the number of controls. It is starting too late, misunderstanding your scope or assuming Cyber Essentials alone is enough.

Sources and further reading

If you are unsure which DCC level applies, how to scope your organisation or what evidence you need, contact SimpleCyber for a practical conversation about your next steps.