Defence Cyber Certification Level 0 - Micro Organisation (1-9 Staff)

What happens next

1. After checkout, you receive your engagement intake template and book a 30-minute scoping call with your assigned Fig consultant.
2. Fig confirms the in-scope estate, supplier list, applicable CSM version and authority-required numeric level.
3. You assemble the evidence pack using the structured template; the Fig Technology platform pre-maps your evidence against the Level 0 control set.
4. The IASME-licensed assessor reviews the evidence pack. On a favourable outcome the DCC Level 0 certificate is issued, valid for three years.

Eligibility and scope checks

• The three Level 0 controls cover Cyber Essentials scope and maintenance, UK GDPR compliance, and resilient networks and systems. Preparation checklists are engagement guidance, not additional scheme controls.
• DCC certification does not replace the full SAQ at the required level in contractual risk assessment and procurement. Check current MOD Cyber Security Model guidance.
• A current, same-scope Cyber Essentials certificate is required before formal Level 0 assessment. Arrange certification separately if needed, and maintain annual renewal.
• Select DCC Level 0 where your contracting authority requires CSMv4 Level 0. Legacy CSMv3 labels cannot be mapped automatically; confirm the applicable version and level with your customer.
• The Level 0 assessor reviews your answers and evidence against the three controls in Def Stan 05-138 issue 4, then verifies that the controls are in place.
• The certificate is valid for three years from issue, subject to annual attestation at the end of Year 1 and Year 2 (included in the price).
• Agree the organisational scope with your assessor, including the functions and services essential to resilience. Confirm legal entities, sites and existing certification scope before assessment.