DCC Level 0 by 31 December 2026: What Defence Suppliers Need to Know

If your organisation supplies the UK defence sector, Defence Cyber Certification (DCC) is worth prioritising now. The Ministry of Defence has asked all industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials for all applicable business-critical systems within scope.

That does not mean every supplier is subject to an identical legal deadline or needs the same DCC level for every contract. It does mean organisations should understand their position, confirm the right scope and begin preparing evidence rather than leaving it until the end of December.

Explore Secarma’s DCC Level 0 and Level 1 certification services

DCC Level 0: key facts at a glance

• MOD request: all industry partners have been asked to achieve Level 0 by 31 December 2026.
• Purpose: demonstrate an organisation’s cyber security and resilience in support of UK Defence procurement.
• Assessment: three control areas, with seven Level 0 questions plus scoping requirements.
• Cyber Essentials: a prerequisite; the relevant scope must align with the DCC assessment.
• Evidence: documented arrangements and real examples of controls working in practice.
• Certification: three years, with annual attestation and ongoing Cyber Essentials certification.

What is Defence Cyber Certification (DCC)?

Defence Cyber Certification is an organisation-level cyber security assurance scheme developed for the UK defence supply chain. It assesses how effectively a supplier protects its business and maintains resilience, rather than focusing only on an individual project or contract.

DCC has four levels, from Level 0 to Level 3, with the level required for a contract determined by the MOD or the relevant Prime contractor based on its cyber risk profile. A certificate can support defence procurement at the certified level or below, where applicable.

Is DCC Level 0 mandatory by 31 December 2026?

The MOD has asked all industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials for applicable business-critical systems in scope. This is a clear expectation, but it should not be confused with a universal statutory requirement that applies identically to every supplier. A specific contract or customer may set its own assurance conditions. Read the MOD’s published announcement.

If a Prime contractor or customer has contacted your organisation about DCC, establish what level it is asking you to achieve and by when. If you are considering future defence work, you can also explore certification before winning a contract.

What are the DCC Level 0 requirements?

Level 0 covers three core areas. The assessment is relatively focused, but applicants need to provide clear, proportionate answers and evidence showing that the controls are actually in place.

1. Cyber Essentials and the right assessment scope

Your Cyber Essentials certification must cover the relevant DCC scope, and your organisation must commit to maintaining it throughout the DCC certification period. A mismatch in scope can prevent a successful assessment.

2. Data protection and UK GDPR

You need to explain your documented approach to data protection, including relevant policies and procedures and how you consider Data Protection Impact Assessments (DPIAs). The assessor needs to see what you do, not just the name of a policy.

3. Organisational resilience

You need to show that you have assessed how resilient essential systems need to be, then demonstrate measures that meet those needs. For example, naming a backup policy is different from showing that backups are running and restores have been tested.

See how Secarma assesses DCC Level 0

What evidence should suppliers prepare for DCC Level 0?

Based on practical assessment guidance produced by Secarma’s consultants, the questions most likely to need clarification often concern existing documentation and the ability to reference it clearly. The following is a useful starting checklist, not a substitute for the scheme’s full assessment guidance.

• Scope: a clear statement of scope, relevant systems and supporting diagrams.
• Cyber Essentials: certification covering the correct scope and a plan for keeping it current.
• Data protection: a policy or procedure with a version or review date, relevant sections and named accountability.
• DPIAs: a documented approach and, where relevant, a completed example or an explanation of when one is required.
• Resilience assessment: a dated risk assessment identifying essential systems and appropriate recovery objectives.
• Implemented controls: evidence that protections work, such as backup results and successful restore testing.

A useful rule is to answer the question directly, point to the relevant document and show that the evidence reflects how your business actually operates. A short, specific response is usually more valuable than a long list of policies with no clear connection to the assessment.

Do I need Cyber Essentials if I already have other security certifications?

Yes. Cyber Essentials is a foundational requirement for DCC Levels 0 and 1, even if your organisation holds other certifications. For Levels 2 and 3, Cyber Essentials Plus is required. The important practical point is that your Cyber Essentials scope must support the DCC scope.

What is the difference between DCC Level 0 and Level 1?

Level 0 is designed for very low assessed cyber risk and has three controls. Level 1 addresses low-to-moderate risk and has 101 controls, with a much more detailed evidence-based assessment covering areas such as governance, access, assets and incident response.

The required level is driven by the contract’s cyber risk profile, not simply by company size. You do not necessarily have to complete Level 0 before pursuing the Level 1 appropriate to your organisation or contract.

How should a defence supplier prepare now?

• Confirm whether your MOD customer or Prime contractor has specified a DCC level and timescale.
• Check your Cyber Essentials status and whether its scope aligns with the proposed DCC scope.
• Identify the systems and functions that will be covered by the assessment.
• Review existing data protection, DPIA, resilience and backup evidence.
• Allow time for clarification and any genuine gaps to be addressed before assessment.

If you have most of these foundations in place already, DCC Level 0 may be more achievable than you expect. The main task can be bringing together clear evidence that reflects existing practice.

Join Secarma’s free DCC webinar on 11 November

For a practical introduction, join our webinar, Defence Cyber Certification: Preparing for Levels 0 and 1, on Wednesday 11 November 2026 at 2pm GMT. We will cover how the levels work, the role of Cyber Essentials, scope and the type of evidence organisations should understand before assessment.

Register for the free DCC webinar

Frequently asked questions about DCC

Is Defence Cyber Certification a legal requirement for every defence supplier?

Not as a blanket legal requirement for every supplier today. The MOD has asked all industry partners to achieve Level 0 by 31 December 2026, and individual customers or contracts may impose specific requirements.

How many controls and questions are in DCC Level 0?

Level 0 covers three control areas and seven assessment questions, alongside the scoping requirements. All applicable Level 0 controls must be satisfied.

Can I apply for DCC without an existing MOD contract?

Yes. Organisations can pursue DCC certification before being awarded a MOD contract, which may help them prepare for future procurement requirements.

Is Cyber Essentials enough for DCC Level 0?

No. Cyber Essentials is a prerequisite, but Level 0 also requires evidence relating to data protection and organisational resilience, with an appropriate DCC scope.

How long does DCC certification last?

DCC certification lasts three years. Organisations must maintain the required Cyber Essentials certification annually and complete the scheme’s annual attestation requirements.

Can Secarma write our policies or prepare evidence and assess them?

Secarma can explain DCC requirements, discuss scope and assess evidence as a Certification Body. To preserve impartiality, we cannot create the same applicant’s policies or evidence, or implement the controls that we subsequently assess.

How can Secarma help with DCC Level 0 and Level 1?

Secarma is a Defence Cyber Certification Body and an IASME-licensed Cyber Essentials Certification Body. We can explain the scheme and assessment process, help clarify scope and provide independent assessment for DCC Level 0 and Level 1. Where Cyber Essentials certification is also required, we can discuss the appropriate route.

Whether you have received a DCC request from a Prime contractor or are planning for future opportunities in defence, get in touch. We can help you understand the certification path and what your organisation should consider next.

Get in touch about DCC Level 0 or Level 1

Further reading: IASME Defence Cyber Certification overview and the MOD’s 2026 DCC update.