Defence Cyber Certification Level 0 - Medium Organisation (50-249 Staff)

What happens next

1. After checkout, you receive your portal login details.
2. You then complete the questions.
3. You then create a shared read-only drive where your assessor can review your supporting documentation.
4. An IASME-licensed assessor reviews the documentation against the Def Stan 05-138 issue 4 Level 0 control set. On a favourable outcome the DCC Level 0 certificate is issued, valid for three years, with annual attestation at the end of Year 1 and Year 2 completed by the certificate holder.

Eligibility and scope checks

• The three Level 0 controls cover Cyber Essentials scope and maintenance, UK GDPR compliance, and resilient networks and systems. Preparation checklists are engagement guidance, not additional scheme controls.
• DCC certification does not replace the full SAQ at the required level in contractual risk assessment and procurement. Check current MOD Cyber Security Model guidance.
• A current, same-scope Cyber Essentials certificate is required before formal Level 0 assessment. Arrange certification separately if needed, and maintain annual renewal.
• Select DCC Level 0 where your contracting authority requires CSMv4 Level 0. Legacy CSMv3 labels cannot be mapped automatically; confirm the applicable version and level with your customer.
• The Level 0 assessor reviews your answers and evidence against the three controls in Def Stan 05-138 issue 4, then verifies that the controls are in place.
• The certificate is valid for three years from issue. The certificate holder must complete annual attestation at the end of Year 1 and Year 2.
• Agree the organisational scope with your assessor, including the functions and services essential to resilience. Confirm legal entities, sites and existing certification scope before assessment.