Defence Cyber Certification: What you need to do before the end of 2026

Cyber threats within the UK Defence sector are escalating and a weakness in one supplier is a weakness across the wider defence supply chain.

In response, the Ministry of Defence (MoD) has requested all industry partners to achieve at least DCC Level 0 by the end of 2026. Certification gives the MoD independent assurance of each supplier’s cyber resilience, assessed consistently against one standard. 

Eleanor Fairford, the MoD’s Director of Cyber Defence & Risk said that “assured cyber resilience across suppliers will help UK Defence rise to the challenge of the escalating cyber threat”.

There are four DCC levels determined by the MoD, based on the contract risk:
•    Level 0: Low-risk contracts
•    Level 1–3: Increasing levels of risk

The level that applies to you is set by your Cyber Risk Profile, which your contracting authority assigns to the contract. 

You may be tempted to aim for a higher level than you need to cover all bases, but at the moment, based on our research, the majority of tenders requesting a certification are satisfied with level 0 or 1. So, unless your contracts require higher levels, the cost and effort won’t have a positive ROI.

However, that doesn’t mean you can’t prepare for higher levels to undertake certification at a later stage when deemed necessary. That’s where we can help.

We’ve answered some common client questions to help you get prepared for certification.

Scoping is the most critical part to get right

Before you answer any questions about controls, you need to define your scope. This is where many organisations go wrong: Scope is unclear or doesn’t cover everything it should.

Your assessor needs to see everything your scope covers in practice. This includes your legal entities, sites, systems, cloud services and MSPs.

Start with the services your organisation provides. Then map the functions that support them, the locations they operate from and your technology stack. Work through your organisation function by function and ask the question: If this failed tomorrow, could we still operate?

It’s also important to ensure your Cyber Essentials scope lines up with your DCC scope. Any internet-connected devices, networks and cloud services in your DCC scope must be covered by Cyber Essentials, and assessors will look closely at how the two relate. Record your scope in a Statement of Scope, then agree it with your Certification Body before you submit.

If you’re starting your DCC journey now

The most valuable thing you can do before engaging an assessor is perform an honest gap assessment. Map your current controls against the requirements for your desired level. From there you can identify what needs addressing ahead of any formal assessment.

The earlier you get started with the process, the better. 

Most organisations underestimate how long DCC takes. Depending on your level, the complexity of your scope and how much needs fixing, the certification process can take several months. For first-time applicants starting from scratch, a full programme typically takes 6 to 12 months.

Your DCC questions answered

Does the end of 2026 deadline apply to me?

The MoD’s request is aimed at all industry partners. If you deliver products or services directly or indirectly to the defence sector, then you are in scope for meeting this certification. DCC is also open to any organisation, whether or not you currently bid for defence contracts. If you’re unsure, check with your contracting authority.

Can I choose my level?

The right level for your business is set by the Cyber Risk Profile of the contracts you intend to bid for. Level 0 is the minimum the MoD has asked for by the end of 2026. Individual contracts can require a higher level, but we recommend starting with the fundamentals. 

Is Level 0 enough?

It meets the MoD’s request, but it may not be enough for every contract you want to bid for. Level 0 has 3 controls and 6 questions. Level 1 has 101 controls and 202 questions. Check what your current and target contracts require.

Do I need Cyber Essentials first?

Yes. Levels 0 and 1 require Cyber Essentials across all systems in your DCC scope. Levels 2 and 3 require Cyber Essentials Plus. If you don’t hold Cyber Essentials yet, start there.

How long does certification last and what does it cost?

Certification lasts three years, with an annual check-in. IASME doesn’t have a fixed rate for DCC assessments, so each Certification Body quotes based on your size, scope, complexity and readiness. Every scope is different, and so is the work needed to verify your answers. You’ll also need to renew Cyber Essentials every year while you hold DCC. Clear, well-organised evidence keeps both time and cost down.

How long does the certification process take?

It depends on your starting point and your level. For first-time applicants starting from scratch, a full DCC programme typically takes 6 to 12 months. Level 0 is a much smaller assessment, but you still need your scope, your Cyber Essentials and your evidence in place. Unclear scoping causes delays in applications, especially if your assessor needs to clarify answers, so getting it right the first time around can significantly speed up the process.

What happens if I’m not certified by 31 December?

The MoD hasn’t published specific consequences alongside its request, but as the scheme is fast becoming the industry standard, it’s expected that more tenders will request a certification. 

What is clear is that if you don't hold the level a contract requires, you may not be eligible to bid for it. 

To avoid losing opportunities, get certified early.

Can someone complete the assessment for us?

No. You must complete your Assessment Submission Record in-house, but you can get external support along the way. DCC experts can help you understand the requirements and identify gaps in your compliance. But the same organisation can’t also act as your assessor and certifying body because it needs to be able to independently assess your controls.

We need hands-on help implementing controls. How do we avoid juggling two suppliers?

If you need implementation support, it has to come from a different firm to the one assessing you. That protects the integrity of your certificate. But separate doesn’t have to mean disconnected.

We work with a trusted partner Certification Body. Where we provide implementation consultancy, they assess you. Where they do, we assess you. We plan the work together from the start, so scoping happens once and handovers are agreed before they’re needed. You get one combined plan and one estimate.

The boundary stays firm. You contract with each firm separately, and no fees pass between us. We never assess work we’ve implemented and our partner never advises on work it assesses.

What’s happening in the market

DCC uptake is accelerating as the deadline approaches. Of the DCC certificates our market intelligence has tracked, more than a third were issued in September and October 2026 alone.

There are 125 Certification Bodies on IASME’s approved list. Not all of them can certify above Level 0. And contracts are already starting to ask for more than the baseline. Of the MoD tender notices we’ve tracked—that state a DCC level—Level 1 is the most common requirement.
 

For more information, including every step to prepare your organisation for certification, download our DCC readiness guide.

How we can help

We work with defence suppliers across the supply chain on DCC readiness, from scoping and gap analysis to audit-ready submission. 

If you want to understand where your organisation stands, or need help closing gaps to prepare for your assessment, let’s talk.