Cyber Security · 5 min read
Is DCC Level 0 mandatory by 31 December 2026?
No law requires DCC Level 0 by 31 December 2026, but the MOD has asked suppliers to hold it. What that means for tenders and the SAQ, and what Level 0 involves.
Certified and accredited
See our trust centre
Built for the defence supply chain.
Many MOD suppliers are engineering, manufacturing and services firms working for a prime contractor. The cyber checks reach you through that contract, under DEFCON 658.
We run your IT so the evidence is ready when those checks arrive, and we tell you where you stand before a tender does.
How the MOD Cyber Security Model works.
How the MOD's cyber checks reach a supplier, step by step, and where we come in.
The contract
Your contract or subcontract carries DEFCON 658, the condition that sets the MOD's cyber terms and passes them down the supply chain.
We go through the cyber clauses with you.
Risk assessment
The MOD, or the company above you, assesses the contract and gives you a reference number.
We tell you what to ask for if it hasn't arrived.
Cyber Risk Profile
The assessment sets a profile from Level 0 to Level 3, with the Def Stan 05-138 controls for that level.
We check your setup against those controls.
Supplier Assurance Questionnaire
You answer it in the MOD's Supplier Cyber Protection Service, and it's scored straight away. You answer a new one every year.
We gather the evidence behind each answer.
Defence Cyber Certification
Buyers accept a DCC certificate at the contract's level or higher as evidence the controls are met. For now, you still answer the questionnaire too.
We get you ready for assessment at any level.
Cyber Improvement Plan
If you fall short, you send a plan with your bid saying when you'll comply, and the buyer weighs it up.
We write the plan with you and do the work in it.
From the MOD's Cyber Security Model guidance on GOV.UK, updated 6 March 2026, and Industry Security Notice 2026/02. In May 2026 the MOD asked its suppliers to hold DCC Level 0 by 31 December 2026.
How the checks reach subcontractors.
Each company in the chain sets the level for the work it passes down. Your customer's level becomes your starting point.
The prime contractor
Assesses the work it passes down and sends you a reference number and profile level.
Your company
Answers the questionnaire against that profile, then assesses any work you pass down in turn.
Your subcontractors
Answer their own questionnaire, at the level you set for the work they do.
If a subcontractor falls short, the two companies agree a Cyber Improvement Plan and share it with the MOD delivery team.
What we look after.
Day-to-day IT and cyber security, run with your contracts' controls in mind.
Day-to-day IT support
Your team calls our service desk, and every support request is picked up within one business hour.
Managed IT servicesCyber Essentials
We certify it ourselves, with the scope set to cover everything in your DCC scope, as DCC expects.
Cyber Essentials certificationMicrosoft 365 and devices
Set up and run Microsoft 365, laptops and backups against the controls your profile asks for.
Microsoft 365 setupReadiness for Levels 1 to 3
Get a gap analysis against the controls at your level, then close the gaps with our engineers, Cyber Essentials Plus included.
How we get you ready.
Scope
We find out which contracts you hold or bid for, and the profile level each one sets.
Check
We compare your setup with the controls at that level and list the gaps, worst first.
Fix
Our engineers close the gaps with your team, starting with Cyber Essentials.
Evidence
You answer the questionnaire with the evidence to hand, ready for another certification body to assess your DCC.
Certifying your Level 0.
IASME licenses us to assess DCC Level 0 and issue the certificate. If we implement or manage your security controls, another certification body assesses your submission instead.
Defence Cyber CertificationDefence supplier questions.
What is the MOD Cyber Security Model?
It's how the MOD builds cyber security into its supply chain. Each contract gets a risk assessment and a Cyber Risk Profile, and suppliers show they meet it through the questionnaire.
What is DEFCON 658?
The MOD contract condition that sets out the Cyber Security Model's terms. It also lists the obligations you must pass on to your own subcontractors.
How do we get a Risk Assessment Reference?
From your customer. The MOD usually gives it in the tender, and a prime contractor gives you one for the work it passes down. If you haven't had one, ask for it.
Who answers the Supplier Assurance Questionnaire?
Your organisation does, in the MOD's Supplier Cyber Protection Service, against the profile your customer set. We help you gather the evidence behind each answer.
What happens if we don't meet the level a tender asks for?
You send a Cyber Improvement Plan with your tender, saying when you'll meet it. The MOD weighs it up when choosing a supplier.
How does DEFCON 658 affect subcontractors?
It flows down the supply chain. Your customer gives you a Risk Assessment Reference and profile level, and you do the same for any subcontractor you bring in.
We're new to the defence supply chain. What comes first?
Cyber Essentials, because every DCC level needs it. Then ask your customer for the contract's Cyber Risk Profile.
Do we need Cyber Essentials Plus?
Only for DCC Levels 2 and 3, or where a contract asks for it. We certify Cyber Essentials and Cyber Essentials Plus directly.
Do you work with defence suppliers outside Norfolk?
Yes. We work with suppliers anywhere in the UK, remotely and on site.
Guides for defence suppliers.
Cyber Essentials · 3 min read
Cyber Essentials v3.3 (Danzell): what changed in April 2026
What changed in Cyber Essentials v3.3 (Danzell) in April 2026, including the MFA and patching questions that now fail automatically, and what it means at renewal.
Cyber Essentials · 5 min read
How much does Cyber Essentials cost?
What sets the cost of Cyber Essentials and Cyber Essentials Plus, from IASME's size bands and your scope to the work to get ready, and how to get an accurate quote.
Other services.
Find out what your contracts need.
Tell us which contracts you hold or bid for and the profile level they set. We'll reply within one working day.