In short: Defence Cyber Certification (DCC) is the MOD's cyber security certification scheme for its supply chain, developed with IASME and delivered through IASME's Assured Certification Bodies. It has four levels assessed against Def Stan 05-138. Every level starts with Cyber Essentials, and Levels 2 and 3 also require Cyber Essentials Plus.
What Defence Cyber Certification is
Defence Cyber Certification, usually shortened to DCC, was developed by the Ministry of Defence together with IASME, the organisation that also delivers Cyber Essentials for the NCSC. IASME runs the scheme, and assessments are carried out by Certification Bodies it has approved for DCC, known as Assured Certification Bodies.
DCC assesses a supplier against the UK Defence standard for cyber security, Def Stan 05-138. Because the scheme has levels, a supplier on lower-risk work is not asked to do the same as one on higher-risk work: DCC is how a supplier proves it meets the level its contract requires.
For many defence suppliers the most important practical point is simple: you cannot get DCC at any level without first holding Cyber Essentials, and the upper levels need Cyber Essentials Plus as well.
The four DCC levels
DCC has four levels. Each adds controls to the one below, and each has a Cyber Essentials prerequisite:
| DCC level | Controls assessed | Cyber Essentials prerequisite |
|---|---|---|
| Level 0 | 3 | Cyber Essentials |
| Level 1 | 101 | Cyber Essentials |
| Level 2 | 139 | Cyber Essentials Plus |
| Level 3 | 144 | Cyber Essentials Plus |
The number of controls rises sharply after Level 0, so moving up a level is a project in its own right rather than a small extension. Levels 2 and 3 also need the independent technical testing of Cyber Essentials Plus underneath.
Your contract, invitation to tender or prime contractor will tell you which level applies. If it is not clear, ask the buyer before you start, because the level decides both the effort and whether you need Plus.
How the assessment and certificate work
DCC follows a familiar pattern for anyone who has done Cyber Essentials:
- Get the Cyber Essentials foundation in place. A current Cyber Essentials certificate for Levels 0 and 1, or Cyber Essentials Plus for Levels 2 and 3.
- Prepare against Def Stan 05-138 for your level, gathering evidence for each control.
- Assessment by an Assured Certification Body. DCC is a point-in-time assessment of whether the controls for your level are in place.
- Annual attestation. Between full assessments you confirm each year that you still meet the requirements.
- Recertification every three years with a fresh assessment.
Bear in mind that the Cyber Essentials or Plus certificate underneath has its own 12-month cycle. Keeping DCC means keeping your Cyber Essentials renewal on time every year as well, so plan both calendars together.
Where Cyber Essentials fits for MOD suppliers
IASME's guidance also says Cyber Essentials is required for MOD suppliers whose supply chain handles defence information, so even suppliers not yet asked for DCC are likely to be asked for a certificate. Treat Cyber Essentials as the entry ticket to defence work.
The five Cyber Essentials controls (firewalls, secure configuration, security update management, user access control and malware protection) are the technical core that the higher DCC levels build on. Weaknesses that fail Cyber Essentials, such as unsupported software, missing MFA on cloud services or late critical updates, will also block progress through DCC. Getting the foundation right first saves rework later.
For Levels 2 and 3, plan the Cyber Essentials Plus audit carefully. Under the Danzell rules introduced in April 2026 the verified self-assessment must be final, and cannot be changed in response to test results, before Plus testing begins, and testing has to happen within three months of the Cyber Essentials certificate. Our Cyber Essentials Plus audit guide explains the steps.
Preparing the Cyber Essentials foundation for DCC
A practical order of work for a defence supplier:
- Confirm the level your contract needs, and whether you need Cyber Essentials or Cyber Essentials Plus beneath it.
- Set a sensible scope. A whole-organisation scope is simplest; if you use a sub-set, make sure it covers every system that will handle defence work. See defining your scope.
- Close the technical gaps: MFA on every cloud service that offers it, critical and high-risk updates within 14 days, separate admin accounts, malware protection on every in-scope device and a properly configured firewall.
- Certify Cyber Essentials, then Plus if needed, inside the three-month window.
- Then prepare for the remaining Def Stan 05-138 controls for your level, ahead of the DCC assessment.
Alongside the technical work, people remain a common route in for attackers, so staff training is worth planning early; see security awareness training.
How we help defence suppliers
Forever Systems is not a DCC Assured Certification Body and does not carry out DCC assessments. What we do is build the Cyber Essentials and Cyber Essentials Plus foundation that every DCC level depends on: a gap analysis, remediation of devices, cloud services and accounts, and support through assessment with the IASME-licensed Certification Body we work alongside, including a rehearsal before any Plus audit.
Pricing depends on your size, scope and the level you are working towards, so ask us for a quote. Contact us and tell us which DCC level your contract requires.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Defence Cyber Certification?
Defence Cyber Certification (DCC) is the MOD's certification scheme for cyber security in its supply chain. It was developed by the MOD with IASME, is delivered through IASME's Assured Certification Bodies and assesses suppliers against Def Stan 05-138 at one of four levels.
Do I need Cyber Essentials for Defence Cyber Certification?
Yes. Every DCC level starts with Cyber Essentials, and Levels 2 and 3 also require Cyber Essentials Plus. You need the relevant certificate in place before your DCC assessment.
How many levels does DCC have?
Four: Level 0 with 3 controls, Level 1 with 101, Level 2 with 139 and Level 3 with 144. Your contract or prime contractor tells you which level applies.
How long does Defence Cyber Certification last?
DCC is a point-in-time assessment with an annual attestation and recertification every three years. Your underlying Cyber Essentials or Cyber Essentials Plus certificate must still be renewed every 12 months.
Can Forever Systems certify us for DCC?
No. DCC assessments are carried out by IASME's Assured Certification Bodies. We prepare the Cyber Essentials and Cyber Essentials Plus foundation and help you close the technical gaps before your assessment.