Defence Cyber Certification, consultant-led and platform-supported.

DCC is the UK Ministry of Defence's independent cybersecurity certification framework for its supply chain, administered by IASME and delivered through a network of IASME-licensed Certification Bodies. Four levels - L0, L1, L2, L3 - cover the four Cyber Risk Profile tiers that MOD contracts are assessed against. It replaces the self-assessed Supplier Assurance Questionnaire (SAQ) approach under DCPP.

Effectively yes. Under DCPP the SAQ was self-assessed. DCC replaces that self-declaration with formal independent certification. DCC uses DEFSTAN 05-138 and the MOD Cyber Security Model (CSM v4) as its underlying specifications.

If you want to bid on MOD contracts, yes - at the level matched to the contract's Cyber Risk Profile. Transition arrangements remain for existing contracts with prior SAQ attestation, but the direction of travel is that all MOD supplier contracts will require DCC certification.

The MOD (or the prime contractor in a subcontract scenario) specifies the required level based on the contract's Cyber Risk Profile. Suppliers do not choose their level arbitrarily. If your pipeline includes contracts with varying CRPs, certify at the highest level required.

Fig is accredited at Level 0 and Level 1. For L2 and L3 engagements we refer suppliers to IASME-accredited bodies operating at those higher levels, typically NCC Group, Bridewell, or C3IA. We are honest about this rather than trying to take engagements we are not accredited to deliver.

Yes. L0 and L1 require a valid Cyber Essentials certificate. L2 and L3 require Cyber Essentials Plus. Fig includes the Cyber Essentials prerequisite within the DCC engagement if you do not already hold it - no separate invoice.

Level 0 is flat-priced from £999.99 + VAT (micro) to £4,999.99 + VAT (large). Level 1 is priced as ranges from £9,999.99 – £14,999.99 + VAT (micro) up to £25,000 – £49,999 + VAT (large). Both include the Cyber Essentials prerequisite, three years of certificate validity, and annual attestation support.

L0 is a documentation-led review of a constrained requirement set; the work is predictable. L1 involves scoping, evidence preparation, consultant engagement, platform gap analysis, formal assessment, and remediation support - and the last four scale materially with organisation complexity. We publish the ranges and name the drivers openly rather than quoting bespoke numbers.

Yes. Every L1 engagement includes a dedicated consultant throughout scoping, evidence preparation, remediation, and formal assessment. Consultancy is not a separate line item after engagement begins.

No. Platform access is included in L1 pricing. The platform also remains active across the three-year certificate period so annual attestations are faster and re-certification at three years is substantially quicker than the initial engagement.

Two to three weeks end-to-end for a prepared organisation (already holds Cyber Essentials, governance documentation in place, clear scope). Four to eight weeks for organisations starting from a lower baseline.

Six to ten weeks end-to-end for a prepared organisation. Twelve to twenty weeks for organisations starting from a lower baseline. Most of the variance is driven by supplier preparation, not by the Certification Body.

Annual attestation is included within the original engagement fee. We do not charge separately for each year's attestation.

Somewhat. Having a dedicated internal lead, engaging a consultant early, already holding Cyber Essentials, and being able to provide evidence quickly all compress the timeline. Tell us about your tender deadline at quote stage and we will prioritise engagement sequencing where possible, though DCC is not a same-day product like Cyber Essentials.

Automated gap analysis across your in-scope systems. It identifies unpatched CVEs, cloud misconfigurations, identity gaps (MFA coverage, dormant privileged accounts), endpoint posture issues, public-facing attack surface, and credential exposure. You fix issues before the assessor arrives rather than during audit.

Much of it, yes. Documentation you produced for SAQ attestation is reusable for DCC - governance policies, access control evidence, technical attestations. A Fig consultant can work through your existing pack with you and identify what maps across versus what needs updating.

Yes. Fig Group is an IASME-licensed Certification Body accredited to assess Defence Cyber Certification at Level 0 and Level 1, and to assess Cyber Essentials and Cyber Essentials Plus as prerequisites. Our assessors hold the relevant IASME and defence-sector credentials.