Skip to content

How to get Defence Cyber Certification in the UK

Six-step process from scoping to certificate. For service scope, levels, pricing and eligibility, start with the DCC certification options and prices.

What is Defence Cyber Certification

Defence Cyber Certification (DCC) is the UK Ministry of Defence's independent cybersecurity certification framework for MOD suppliers. It covers four levels (L0, L1, L2, L3) mapped to four Cyber Risk Profiles that MOD contracts are assessed against.

DCC provides independent evidence of compliance. It does not replace the full Supplier Assurance Questionnaire (SAQ): the full SAQ at the required level remains mandatory in contractual risk assessment and procurement under current MOD guidance. It is delivered by IASME through an approved network of IASME-licensed Certification Bodies.

Step-by-step guide

  1. 1

    Confirm your contract's Cyber Risk Profile

    Your contracting authority specifies the applicable CSM version and required level. CSMv4 uses numeric Level 0 to Level 3; legacy CSMv3 labels do not map automatically. Check the contract schedule and confirm the required numeric level before choosing certification.

  2. 2

    Hold Cyber Essentials first

    DCC L0 and L1 require a current, same-scope Cyber Essentials certificate before formal assessment. Arrange certification separately if needed and maintain annual renewal.

  3. 3

    Choose an IASME-licensed DCC body

    Fig Group is the IASME-licensed UK body for DCC Level 0 and Level 1. For L2 and L3 we refer MOD suppliers to specialist IASME-licensed bodies. Check the IASME directory (iasme.co.uk) to verify any provider's licence.

  4. 4

    Scope the engagement

    Work with your assessor to define what systems, services, and documentation are in scope. L0 is documentation-led and typically requires 2-3 weeks of preparation. L1 involves technical evidence and typically 6-10 weeks.

  5. 5

    Submit evidence and complete assessment

    At L0, submit evidence documentation (policies, configuration records, access logs) and the assessor reviews them. At L1, evidence preparation is supported by a Fig consultant, then the assessor conducts a formal technical review.

  6. 6

    Receive your certificate

    Following a successful assessment, you receive a three-year DCC certificate. Complete annual attestations, maintain the applicable Cyber Essentials certification each year and recertify for DCC before expiry. Reassessment timing depends on your scope and readiness.

Timeline and cost

DCC L0 typically completes in 2-3 weeks (prepared organisations) to 4-8 weeks (starting from a lower baseline). DCC L1 takes 6-10 weeks (prepared) to 12-20 weeks (comprehensive remediation needed).

See detailed pricing by organisation size and level.

Common questions

Who can issue Defence Cyber Certification at Level 0 and Level 1?

An IASME-licensed DCC Certification Body authorised for the required level can issue a certificate following a successful assessment. Fig Group delivers Levels 0 and 1 through its licensed body; see the IASME DCC directory for level-specific verification and other providers. Cyber Essentials certification and annual renewal are arranged separately. For Levels 2 and 3, use a body authorised for those levels.

What is Defence Cyber Certification?

DCC provides independent assurance against the MOD Cyber Security Model and is delivered by IASME. The current scheme has numeric Levels 0 to 3. It supports, rather than replaces, contract-specific supplier assurance: the full Supplier Assurance Questionnaire remains required under current MOD guidance.

How do I know which DCC level I need?

Use the numeric Cyber Risk Profile assigned by the MOD or contracting customer, its Risk Assessment Reference and the current contract version. CSM v4 uses Levels 0 to 3; older Very Low, Low, Moderate and High labels do not convert automatically. If a tender still uses verbal wording or two buyers require different levels, obtain written authority clarification before selecting an assessment scope or package.

Do I need Cyber Essentials before DCC?

Current Cyber Essentials is a prerequisite for DCC Levels 0 and 1, with Plus required at Levels 2 and 3. Arrange Cyber Essentials certification separately if you do not hold a current, same-scope certificate before formal assessment. Maintaining the underlying annual certification remains your responsibility during DCC validity.

Ready to start your DCC engagement?

Fig Group is IASME-licensed for DCC L0 and L1 in the UK. Talk to a DCC specialist about your timeline and requirements.