Defence Cyber Certification
Defence Cyber Certification Level 0
DCC Level 0 shows the MOD and the primes above you that you meet the Def Stan 05-138 controls, and it's the level the MOD has asked industry to hold by the end of 2026. We're an IASME-assured certification body, so we assess you and issue the certificate ourselves.
- IASME-assured and listed on the public register of certification bodies
- We assess your submission and issue the certificate ourselves
- We certify Cyber Essentials too, which Level 0 requires
Licensed by IASME to assess and certify at Level 0. Check the IASME register (opens in a new tab)
31 Dec
2026
The MOD has asked all industry partners to hold DCC Level 0 by 31 December 2026.
DCC isn't mandatory yet, and IASME says so directly. The MOD or your prime decides the level each contract asks for, and 31 December is the MOD's request to industry, not a legal requirement.
Even so, the MOD's Cyber Improvement Plan template says every invitation to tender should ask for at least Level 0. A supplier short of the level a tender asks for must submit that plan, and it should go in with the bid. Industry Security Notice 2026/02 also tells MOD buyers to accept a valid DCC certificate at the right level as evidence of the Def Stan 05-138 Issue 4 controls under DEFCON 658.
The four levels
Which level do you need?
The MOD's risk assessment for the contract sets a Cyber Risk Profile from Level 0 to Level 3, and DCC uses the same four levels. Under Industry Security Notice 2026/02, a DCC certificate at that level or higher counts as evidence that you meet its controls.
The level usually appears in the invitation to tender, next to a Risk Assessment Reference. If you're a subcontractor, the supplier above you runs its own risk assessment and gives you your level, as the MOD's Cyber Security Model guidance (opens in a new tab) explains.
We assess Level 0 only. At Levels 1 to 3, a certification body licensed at that level assesses you.
Level 0
3controls
We assess your submission and issue the certificate
Levels 1 to 3
101 to 144controls
We implement the controls, and a certification body licensed at that level assesses you
Every level needs Cyber Essentials, and Levels 2 and 3 also need Cyber Essentials Plus.
If a buyer has given you one of the older CSMv3 profiles, from Very Low to High, the MOD's guidance says those aren't consistent with the new levels. Ask them for a CSMv4 level instead.
What Level 0 assesses.
There are three controls, the same for every organisation, and all three must be fully met.
- 01
Cyber Essentials
A current Cyber Essentials certificate that covers the internet-connected devices and networks in your DCC scope, kept in place for as long as the DCC certificate runs. We certify Cyber Essentials too if you don't hold it yet.
- 02
UK GDPR compliance
Your data protection policies and procedures, and the impact assessments behind them, with enough evidence to show they're used day to day.
- 03
Resilient networks and systems
A resilience risk assessment and the measures that follow from it, covering how your systems keep running, automated backups and tested restores.
The certificate lasts three years, with an annual attestation in between.
Where a Level 0 submission falls short.
Each point below comes from IASME's DCC Applicant Guide and FAQ (opens in a new tab).
Cyber Essentials doesn't cover the DCC scope
Your Cyber Essentials scope must cover the internet-connected devices and networks inside your DCC scope. IASME's Applicant Guide treats a Cyber Essentials scope that doesn't adequately line up as an automatic fail.
The DCC scope stops at your MOD work
The scope is your whole organisation and the services it needs to run, whether they serve MOD contracts or not. If the assessor finds the scope, or how it's documented, inadequate, the whole assessment fails.
The two scopes aren't mapped
Every applicant must supply a diagram showing which parts of the organisation fall inside Cyber Essentials and how they relate to the DCC scope. The two rarely match exactly, so your answer should explain where and why they differ.
A control is only partly met
Level 0 has a 100% pass mark, so all three controls must be fully met. Partial compliance doesn't count.
How we work with you
Where you start depends on whether you hold Cyber Essentials.
Cyber Essentials is the first of the three Level 0 controls, so it must be in place and correctly scoped before a Level 0 submission can pass.
- DCC Level 0 assessment
You already hold Cyber Essentials
We assess your Level 0 submission and issue the certificate. First we check your Cyber Essentials scope covers the internet-connected side of your DCC scope, because IASME treats a poor fit there as an automatic fail.
- Cyber Essentials and DCC Level 0 together
You don't hold Cyber Essentials yet
We certify Cyber Essentials directly as an IASME certification body, so we handle both as one piece of work: Cyber Essentials first, then Level 0.
We don't publish a price list, because the cost depends on the size of your organisation and what the scope covers. We quote once we know what we're assessing.
We're based in Norwich and assess organisations anywhere in the UK through the IASME portal. You can also see the rest of our cyber security work.
How the assessment runs.
- 01
Scope
We agree what the assessment covers before anything is submitted: the whole organisation and the services it needs to run, MOD work or not.
- 02
Cyber Essentials
Cyber Essentials must be in place and cover the internet-connected side of the DCC scope. If it's missing or scoped differently, it's put right here, and we can certify it.
- 03
Submit
You answer the six Level 0 questions in the IASME portal and share the evidence that supports each one.
- 04
Assess
We mark each answer against the standard, come back to you if anything falls short, and issue the certificate once it passes.
DCC questions.
Does Osiris issue the DCC certificate?
Yes. IASME licenses us as a Defence Cyber Certification Body at Level 0, so we carry out the assessment and issue the certificate to your organisation. You can check our listing on the IASME register.
What if our contract requires Level 1, 2 or 3?
We do the implementation and readiness work, and a certification body licensed at that level assesses you. Certification bodies are licensed level by level, and ours covers Level 0.
Is DCC mandatory?
Not at the moment, and IASME says so directly. The MOD decides which contracts ask for it, and in practice it reaches suppliers through tenders and the primes above them.
Does DCC replace the Supplier Assurance Questionnaire?
No. The MOD's Cyber Security Model guidance says a DCC certificate doesn't yet exempt you from the full SAQ in the Supplier Cyber Protection Service. IASME says DCC uses the same questions, with small differences, so most of the evidence carries across.
Is Level 0 a self-assessment?
No, IASME is clear that no level of DCC is self-assessed. A certification body marks your Level 0 submission in the IASME portal question by question, and all three controls must be fully met to pass.
Does the assessment cover our MOD work, or the whole organisation?
The whole organisation, and the services it needs to run, whether they serve MOD contracts or not. Def Stan 05-138 Issue 4 moved the focus from protecting MOD information to the security and resilience of the whole organisation, so the scope can't be cut down to the systems on the MOD contract.
How long does a Level 0 certificate last?
Three years. During that time you renew Cyber Essentials every year and complete an annual attestation that you still meet the controls and your scope hasn't changed significantly.
Can the certification body that helped us prepare also assess us?
Only if it helped you identify gaps, not if it implemented or managed your security defences. That's IASME's rule for a DCC assessor, and it's why we run preparation and assessment for different clients.
What if our Cyber Essentials scope doesn't match?
An exact match is rare, because Cyber Essentials only covers internet-connected devices and DCC also takes in the ones that aren't. Your Cyber Essentials scope must still cover the internet-connected devices and networks inside the DCC scope, so if it falls short, update it before the DCC assessment and we can certify the change.