DCC scoping guide, written by Fig assessors.
Fig assessors scope dozens of DCC engagements every quarter. The same handful of rejection patterns recur, the same boundary questions decide cost and timeline, and the same evidence kit moves an engagement from quote to certificate without avoidable delay. This guide is what we tell suppliers in the first thirty minutes of a scoping call - written down, in the order it matters.
What scoping decides
Not whether you certify - that the contract has already decided. What scoping decides is what the next 6-10 weeks will cost, in time and money.
A DCC engagement has three large costs to a supplier: the certification fee, the internal time to prepare evidence, and the opportunity cost of the elapsed time between contract clause and certificate. Of those, the fee is the smallest. The other two are decided almost entirely at scoping.
Scoping decides four things in concrete terms: which legal entity is being certified, which estate is in scope, which supply-chain depth is being evidenced, and which prerequisite position you are starting from. The CRP your contract carries determines the level (see the CRP glossary); scoping determines the size and shape of the engagement at that level.
Two suppliers with the same DCC level can have engagements that differ by 4x in effort. The difference is rarely the controls themselves. It is whether scoping drew the right boundary and whether evidence collection started on day one or week three.
Six rejection patterns Fig sees at scoping
Each one shifts cost and timeline materially. Each one is fixable in the first conversation.
Over-scoping the in-scope estate
Treating "everything we own" as in-scope for DCC. Fig sees this most often from organisations with mature ISO 27001 or NIS2 muscle memory. DCC scope is the set of systems, sites, people, and suppliers that touch the MOD contract - not the whole organisation. Over-scoping inflates evidence cost, lengthens remediation, and pushes the engagement to the upper end of the L1 range without changing the certificate outcome.
How Fig fixes this at scoping
At scoping, draw the boundary around the contract: which legal entity, which sites, which cloud accounts, which device classes, and which supplier tier-1 list are in contact with MOD information. Anything outside that boundary is out of scope and stays out of evidence collection.Under-scoping by excluding adjacent systems
The mirror image. Drawing the scope boundary so tightly that systems that genuinely touch MOD information are excluded - e.g. excluding the corporate identity provider when MOD-handling staff authenticate via it, or excluding the corporate file-share when MOD-derived documents traverse it. This is the failure mode that gets caught at formal assessment, not at scoping, and it triggers expensive late-stage rescoping.
How Fig fixes this at scoping
Trace the data path. For each MOD information artefact (contract documents, project communications, derived deliverables) walk through every system it lives in, transits through, or is processed by. If an adjacent system is on that path, it is in scope.Treating CE as a shortcut to DCC
Holding a current Cyber Essentials certificate is a prerequisite for DCC L0 and L1, but it is not a substitute for the DCC control set. Fig regularly sees suppliers assume that because CE evidence is in place, DCC evidence is essentially done. The L1 control set covers 101 controls; CE covers five. The overlap on technical controls is partial, and the governance, supply-chain, and risk-management evidence required for L1 is not in the CE evidence pack at all.
How Fig fixes this at scoping
Treat CE as a foundation, not a passport. Use the Fig platform (or your own gap analysis) to map what CE evidence already covers, then identify what L0 or L1 still requires. Plan the gap, not the headline.Underestimating supply-chain depth
L0 and L1 both require evidence of direct-supplier security controls in proportion to risk. Suppliers who treat the supply chain as "we have a list of names somewhere" find that the formal assessment expects flow-down clauses, CE evidence from contractually-bound suppliers, and (at L1) a documented supplier readiness review. The supply-chain section is where Fig sees engagements lose two to three weeks to chasing supplier responses that should have been gathered at week one.
How Fig fixes this at scoping
Pull the supplier readiness review forward. At scoping, identify which direct suppliers handle MOD information or its derivatives. Send the readiness review the day evidence collection begins, not the day before formal assessment.Retained legacy systems with no migration plan
A retained Windows Server 2012, an unsupported network device, or a bespoke application without a documented patch path will not be excluded from scope by being uncomfortable. If it touches MOD information, it is in scope and it requires either a documented migration plan or a documented compensating-controls case. Legacy systems are the variance driver that pushes L1 engagements to the upper half of the published range.
How Fig fixes this at scoping
Decide the legacy posture before formal assessment, not during it. Either commit to a migration with a date, or build a compensating-controls case (segmentation, additional monitoring, documented risk acceptance signed at the right level). Either is acceptable to an assessor; ambiguity is not.Late evidence collection
Treating evidence collection as something that happens after scoping is the single most common reason DCC engagements run long. Fig's consultant + platform model is designed to run evidence collection in parallel with remediation - if the supplier waits to collect evidence until remediation is "done", the formal assessment slips by two to four weeks.
How Fig fixes this at scoping
Run evidence collection from day one. Patch records, configuration baselines, identity reports, supplier readiness responses - all of it can be gathered while remediation work is in flight. The formal assessor does not care whether evidence was collected before or after remediation, only that the evidence is current at submission.The four boundary tests
The questions a Fig consultant will ask in the first scoping call. Run these against your own estate before the call to compress it.
The data-path test
For each MOD information artefact, list every system it touches. If a system is not on any data path, it is out of scope. If a system is on a data path, it is in scope - regardless of whether the supplier "considers" it MOD-relevant.
The contract-perimeter test
Which legal entity is the contracting party? Which sites operate the contract? Which staff populations have access? The legal-entity / site / staff intersection is the contract perimeter, and DCC scope sits inside it.
The MFA-coverage test
Multi-factor authentication enforced across admin and remote access is required for L1, and MFA gaps are a frequent assessment failure. At scoping, list every identity surface that grants access to in-scope data: corporate IdP, secondary IdPs, vendor admin portals, support tooling. Each must be MFA-protected at submission.
The evidence-currency test
Evidence must be current at the formal assessment, not at the start of the engagement. Patch reports older than the assessment-cycle SLA, supplier responses older than 12 months, configuration baselines that pre-date a known infrastructure change - any of these will be challenged. Refresh evidence in the 14 days before submission.
The readiness kit
The evidence Fig asks for, grouped by control family. If you can produce these before the engagement starts, the engagement lands at the lower end of the L0 fee or the L1 range.
Governance and risk
- Information security policy or policy framework, dated within the last 12 months
- Documented RACI or named ownership for cyber security responsibilities
- Risk register with named risks, owners, and treatment status (L1; lighter for L0)
- Incident response plan and contact tree, including notification routes for MOD-handling incidents
Identity and access
- Joiner / mover / leaver process documentation with example evidence (tickets, IdP audit logs)
- Privileged access list, with review cadence
- Multi-factor authentication enforced across all admin and remote access (L1 mandatory)
- Service-account inventory with documented isolation where MFA cannot apply
Device and configuration
- Device inventory aligned to the in-scope estate (a maintained list is acceptable; real-time tooling not required at L0)
- Patch management cadence: SLA for high / critical updates, with evidence of last cycle
- Endpoint protection coverage report across in-scope devices
- Documented baseline configuration for OS, cloud, and network components (L1)
Supply chain
- Direct-supplier list filtered to those handling MOD information or its derivatives
- Standard supplier security clauses or DPA template, with signed copies where applicable
- Cyber Essentials evidence from suppliers where contractually required
- Fig supplier readiness review responses (L1; sent week one of evidence collection)
The readiness kit is Fig’s evidence framework, not a verbatim copy of any source-pack document. For the canonical scoping rules of Def Stan 05-138 issue 4 and the IASME-administered DCC scheme, see the IASME directory and the published IASME guidance at iasme.co.uk/defence-cyber-certification.
Two scoping decisions worth pre-deciding
Fig recommends suppliers reach an internal answer on these before the scoping call.
Decision one: are you certifying the legal entity, or a subset of it? If your organisation has multiple operating divisions and only one touches the MOD contract, certifying the whole entity inflates scope unnecessarily. A scoping statement that names the contracting entity and the in-scope division is normal and acceptable. Pre-decide this. The scoping call is faster and the boundary is cleaner.
Decision two: what is the prerequisite position? L0 and L1 require Cyber Essentials. L2 and L3 require Cyber Essentials Plus. If you do not currently hold a current CE certificate, Fig issues one within the engagement at no additional fee. If you hold one but it expires within the engagement window, plan renewal before formal assessment. If you hold CE but the in-scope estate has changed materially since issue, the assessor will want the renewed CE evidence to reflect the current estate.
Both decisions are reversible after scoping, but reversing them costs a week. Pre-deciding them costs nothing.
For the buyer-facing FAQ on scope, prerequisites, timelines and pricing structure, see the DCC FAQ. Each question has its own deep-link URL for citation and reference.
Open the full DCC FAQScope it once, scope it right.
Send Fig the contract clause and the four boundary-test answers. We will issue a fixed price (L0) or a quote within the published range (L1) and book the scoping call within one working day.