DCC Level 0 checklist: the six questions and the evidence for each

What Level 0 checks.

Defence Cyber Certification Level 0 has three controls: Cyber Essentials (0001), UK GDPR compliance (2314) and resilient networks and systems (2500). They’re the same for every organisation.

Each control has two questions, so there are six in total. A certification body marks every answer and its evidence in the IASME portal, and all three controls must be fully met to pass.

Agree the scope first.

The DCC scope is your whole organisation and the systems it needs to run, not just your MOD work. It covers devices that aren’t connected to the internet as well as those that are.

Your Cyber Essentials scope must cover every internet-connected device and network inside the DCC scope. If it doesn’t, IASME treats it as an automatic fail.

• A list of the systems, sites and services the organisation needs to run.
• A network diagram of the DCC scope.
• A diagram showing which parts fall inside your Cyber Essentials scope, which every applicant must supply.
• A note explaining any difference between the two scopes, such as offline equipment.

Control 0001: Cyber Essentials.

Question 0001.1

Does the organisation hold Cyber Essentials certification(s) that cover(s) the required scope for this activity?

• Your Cyber Essentials certificate number.
• Your Cyber Essentials self-assessment questionnaire or report.
• The diagram showing your Cyber Essentials scope against the DCC scope.

Question 0001.2

Does the organisation commit to maintaining Cyber Essentials certification for the duration of any function related to this activity or DCC certification?

• An attestation, or a history showing you renew Cyber Essentials every year.

If you don’t hold Cyber Essentials yet, start there. We’re a Cyber Essentials Certification Body too, and our Cyber Essentials checklist covers each of its five controls.

Control 2314: UK GDPR compliance.

Question 2314.1

Does the organisation have documented policies and procedures which ensure compliance with obligations under the UK General Data Protection Regulation (GDPR)?

• Your data protection policy, or the documents where your UK GDPR procedures are written down.
• Supporting records such as a risk register that covers risks to the people whose data you hold.

Question 2314.2

Does the organisation conduct Data Protection Impact Assessments (DPIAs) against data types it stores or processes?

• The procedure you follow to carry out a DPIA.
• The template or tool you use.
• A completed assessment, or a report of their results.

A small organisation can show simpler documents than a large one. IASME notes that DCC doesn’t certify that you comply with UK GDPR, and recommends following the ICO’s guidance.

Control 2500: resilient networks and systems.

Question 2500.1

Has the organisation assessed the degree to which its systems must be resilient to cyber-attack and system failure?

• A risk assessment showing which systems are essential and what could disrupt them.
• A risk register, if your size calls for one. A micro organisation can show a short document instead.

Question 2500.2

Has the organisation built resilience into its systems to meet its resilience needs?

• Evidence of the measures themselves, such as automated backups, redundant network links or uninterruptible power supplies.
• A link from each measure back to a need you identified in 2500.1.

IASME asks for practical evidence here and says to avoid pointing at policy documents or high-level plans.

Sources.

• IASME, DCC Applicant Guide, Levels 0-3, version 2.2, October 2026 (opens in a new tab)