Defence Cyber Certification Levels 0 and 1.

DCC provides independent assurance against the MOD Cyber Security Model and is delivered by IASME. The current scheme has numeric Levels 0 to 3. It supports, rather than replaces, contract-specific supplier assurance: the full Supplier Assurance Questionnaire remains required under current MOD guidance.

No. Current MOD guidance requires the full contract-specific Supplier Assurance Questionnaire through the Supplier Cyber Protection Service, including for DCC certificate holders. DCC independently evidences organisational assurance against Def Stan 05-138 Issue 4; the buyer-assigned risk profile and contractual process still apply.

Check the written MOD or prime-contractor requirement and its transition date. IASME guidance says DCC is not currently mandatory across all contracts; the MOD’s published 8 May 2026 request for industry partners to reach Level 0 by 31 December 2026 is a separate request, not a universal legal rule. Ask the contracting authority to confirm the numeric Cyber Risk Profile, Risk Assessment Reference and applicable tender clause.

Use the numeric Cyber Risk Profile assigned by the MOD or contracting customer, its Risk Assessment Reference and the current contract version. CSM v4 uses Levels 0 to 3; older Very Low, Low, Moderate and High labels do not convert automatically. If a tender still uses verbal wording or two buyers require different levels, obtain written authority clarification before selecting an assessment scope or package.

Fig Group delivers DCC Level 0 and Level 1 through its licensed certification body. For Level 2 or Level 3, use the IASME DCC Certification Body directory to find a body licensed for the required level; Fig Group can refer you to an appropriately authorised provider. Check the assigned level and licence before buying.

Current Cyber Essentials is a prerequisite for DCC Levels 0 and 1, with Plus required at Levels 2 and 3. Arrange Cyber Essentials certification separately if you do not hold a current, same-scope certificate before formal assessment. Maintaining the underlying annual certification remains your responsibility during DCC validity.

Published Level 0 prices run from £499.99 + VAT for Micro to £799.99 + VAT for Large. Level 1 published ranges run from £9,999–£14,999 + VAT for Micro to £25,000–£49,999 + VAT for Large, depending on agreed scope. Years 1 and 2 include annual attestation support within the package; Year 3 reassessment is separately priced. Arrange Cyber Essentials certification and annual renewal separately, and check any work outside the Order Form before purchase.

Level 0 has a published staff-band price from £499.99 to £799.99 + VAT. Level 1 ranges from £9,999–£14,999 + VAT for Micro to £25,000–£49,999 + VAT for Large because scope, evidence gaps and assessor effort vary. The published package includes scoped consultancy and assessment; optional work outside the accepted Order Form may cost extra. Request a written Level 1 quote rather than treating a range endpoint as a fixed checkout price.

The published Level 1 package includes consultant support for the agreed scoping, evidence preparation and assessment programme. The applicant implements required controls and supplies accurate evidence. Confirm deliverables, feedback and remediation rounds, any extension charges and separately requested work in the accepted written Order Form; the package is not unlimited consultancy.

The published Level 1 offer includes scoped platform support for evidence mapping and annual attestations. Confirm the actual access duration, included integrations and functionality, support, post-certification charges and any separate consultancy retainer in a written Order Form. Evidence mapping alone does not prove an unconditional three-year platform entitlement. Year 3 reassessment is separately purchased.

As at 29 September 2026, Fig Group estimates two to three weeks end to end for a prepared Level 0 applicant and four to eight weeks where prerequisite certification, governance documents or scope need work. These are indicative supplier estimates, not an IASME deadline. Confirm the numeric level, current Cyber Essentials, three-control evidence, written assessment schedule and buyer deadline before relying on a target date.

As at 29 September 2026, Fig Group estimates six to ten weeks end to end for a prepared Level 1 applicant and twelve to twenty weeks from a lower baseline. Scope, 101-control evidence, remediation, assessor availability and current prerequisite certification affect timing. Obtain a written scope and schedule against the tender deadline; neither estimate guarantees certificate issue.

The published DCC package includes annual attestation support for Years 1 and 2. Year-three reassessment is separate. Underlying Cyber Essentials needs annual renewal, and additional work outside the accepted scope may be chargeable under your Order Form. Existing signed terms continue to apply.

Share the written tender deadline and required numeric level with Fig Group at quote stage. Check current Cyber Essentials, assessment scope, evidence readiness and whether an assessor can agree a written schedule. Preparation may be shortened, but assessment findings and remediation still determine certification; no deadline guarantee applies.

Fig Group’s platform can organise scoped DCC evidence and highlight gaps from supported data sources such as connected identity, endpoint and cloud systems. Available checks depend on the agreed integrations, permissions and data quality; a detected issue is reviewed by the applicant and assessor, not automatically certified. Confirm included Level 1 access and functionality in the Order Form.

Some dated SAQ policies and technical records can be reused if they cover the same organisation, systems and control period. For example, map an access-control policy dated June to the applicable DCC control, note missing MFA enforcement evidence, then arrange independent review of the gap. The contract-specific SAQ still remains due; reuse does not replace the DCC assessment.

Fig Compliance Ltd holds separate IASME licences for DCC Level 0 and Level 1, and Cyber Essentials and Plus. Verify each scheme and authorised level through the relevant registry and IASME DCC directory; a Cyber Essentials badge alone does not prove a DCC licence. Fig Group does not assess DCC Levels 2 or 3.

An IASME-licensed DCC Certification Body authorised for the required level can issue a certificate following a successful assessment. Fig Group delivers Levels 0 and 1 through its licensed body; see the IASME DCC directory for level-specific verification and other providers. Cyber Essentials certification and annual renewal are arranged separately. For Levels 2 and 3, use a body authorised for those levels.