Where to start with DCC (Defence Cyber Certification)

If a Ministry of Defence (MOD) contract, prime contractor or customer has mentioned Defence Cyber Certification (DCC), it can be hard to tell what to do first. The simplest route is to confirm the required level, agree what the assessment covers, and then prepare evidence against that scope. You do not need to begin by buying new software or rewriting every policy.

This guide is an orientation for UK defence suppliers. It draws on IASME scheme guidance, but it is not a substitute for the current official applicant and scoping guides or advice from your chosen Certification Body.

Defence Cyber Certification is the UK MOD cyber assurance scheme for suppliers. Its requirements are based on Defence Standard 05-138. The scheme has four levels, and the required level is driven by the contract's Cyber Risk Profile. DCC certification can support assurance across eligible contracts, but it does not remove separate contract-specific assurance obligations such as a required Supplier Assurance Questionnaire (SAQ).

The assessment is delivered by an IASME-licensed Certification Body with the right level of authorisation. Check the current scheme guidance and the assessor's licence scope before you commit. The IASME DCC help and resources page links to current scheme materials and official guides.

Ask the contracting authority, prime or customer to confirm the CRP and DCC level for the contract. Keep the written requirement with your procurement records. If the wording is unclear or refers to an older profile, ask the buyer to clarify how it maps to the current scheme rather than translating it yourself.

The assessment level is a contract requirement. A Level 0 scope is not a shortcut for a contract that requires another level. If you support several customers, requirements may differ; list the relevant contracts and discuss how the requested level and certification scope relate.

Scoping is about making the boundary understandable and defensible. Begin with the legal entity and describe the business service or function that supports the contract. Then trace the people, sites and dependencies needed to deliver and protect it. Consider shared identity and collaboration services, devices, cloud services, operational technology where relevant, backups, data stores and third parties.

The Level 0 guide supplied with this request recommends documenting what is in and out of both the DCC and Cyber Essentials boundaries, listing sites and their functions, and using organisational and network diagrams to explain how the boundaries relate. These are preparation prompts from that guide; agree the required scope and format with your assessor using the current IASME guidance.

Do not assume that a system is out of scope only because it does not hold MOD data. Equally, do not include every group company or unrelated service without a reason. Explain the boundary, record dependencies and exclusions, and ask the Certification Body to review uncertain cases.

Cyber Essentials is a DCC prerequisite. Review the certificate expiry date, certified legal entity, scope statement and any material changes to the estate since certification. Compare those details with the proposed DCC boundary and ask the assessor whether anything needs to be updated before the formal DCC assessment. Higher DCC levels have additional prerequisite requirements; check the current official rules for the level assigned to your contract.

Do not treat a current certificate as proof that the whole DCC scope is ready. It covers its own defined requirements and boundary. DCC has additional scheme controls and evidence expectations.

Level 0 is the entry DCC level and has three controls. The supplied scoping guide describes preparation around the applicable Cyber Essentials certificate and scope, senior responsibility for cyber security, and assessment of cyber risks to essential systems and resilience measures. Confirm the exact control wording and evidence against the current IASME Level 0 Applicant Guide before submitting.

For a first preparation pass, locate the current Cyber Essentials certificate and report; identify the senior official responsible for reviewing and attesting the scope; and gather the organisation's risk assessment and evidence of relevant resilience measures. Keep documents current and consistent with the boundary you have agreed. The guide's checklist is a starting aid, not a guarantee of certification.

Before the call, assemble a short pack rather than trying to complete the whole assessment:

• The contract or customer wording that names the CRP or DCC level.
• Your legal entity name and a short description of the contracted service.
• A first-pass list of sites, teams, systems, key suppliers and shared services.
• Your current Cyber Essentials certificate and the scope it covers.
• A simple organisational diagram and network or service diagram, if available.
• A list of boundaries or dependencies you are unsure about.
• For Level 0, the likely senior signatory and the current risk and resilience material.

The Certification Body can explain the scheme, verify scope, describe evidence expectations and provide blank templates. Scheme impartiality rules mean the assessing body cannot write your answers or evidence for you. Confirm the role boundaries with the body you choose.

Use the latest official IASME applicant and scoping documents for the current requirements. Confirm that you have the correct level and agree scope and evidence expectations with your chosen Certification Body.

For the detailed process, continue to How to get Defence Cyber Certification: a step-by-step guide, compare DCC Level 0 and Level 1, and review DCC scoping mistakes that can delay certification. You can also read the Fig Group DCC scoping guide and the official IASME help and resources.