You have had the letter. Possibly two. The first asked for Cyber Essentials. The second asks for Defence Cyber Certification Level 0 by 31 December 2026, and it may have come from the same prime or from further up the chain.
If you already hold Cyber Essentials, the natural reaction is relief. But whether that certificate does the job for Defence Cyber Certification depends on what it covers, not on how well you passed.
This article is about that one thing: scope. It is the decision that determines whether the first control of DCC Level 0 is a formality, or a repeat of a project you thought you had finished.
The first DCC control is a certificate you may already hold
Defence Cyber Certification is the Ministry of Defence's organisation-wide cyber security certification for its suppliers, developed with IASME and launched in May 2025. Level 0, the entry level, has three controls, and the first of them is Cyber Essentials.
Control 0001 asks for a current Cyber Essentials certificate covering every internet-connected device inside the DCC scope, together with a commitment to keep that certificate current for the three-year DCC period. The other two cover data protection and business resilience; all three, with the evidence that passes and the mistakes that fail, are in our post on the DCC Level 0 controls.
Read the wording carefully. Not "a Cyber Essentials certificate". A certificate covering every internet-connected device in the DCC scope. Where the two boundaries do not line up, the control is not met, and at Level 0 every control has to be fully met. A scope mismatch is an automatic fail.
That wording is not an accident of the standard. When the MOD's Director of Cyber Defence and Risk set out the December 2026 ask on the Defence Digital blog in May, the request for Level 0 explicitly included "a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope". The scope point was in the original ask.
What "every internet-connected device in the DCC scope" means
The phrase has two halves, and both matter.
The DCC scope is the whole organisation's essential functions. In practice the certification body will be looking at:
- Corporate IT: servers, the office network and the business applications your people use every day.
- Identities: user accounts and the directory or identity platform behind them, for most small suppliers Microsoft 365.
- Endpoints: the laptops, desktops, tablets and phones that touch company data, wherever they are used.
- Connectivity: internet connections, firewalls, Wi-Fi and any remote access into the building.
- Cloud: every cloud service the business relies on, not only the ones your MOD work happens in.
- Backup and continuity: the systems and processes that get you running again after an incident.
The second half, "every internet-connected device", is the Cyber Essentials boundary: the devices an attacker can reach. So Control 0001 asks a simple question. Does your Cyber Essentials certificate cover everything with an internet connection inside those essential functions?
Two things follow, and suppliers regularly get both wrong.
You cannot carve out the team that does the MOD work. A supplier with sixty staff, of whom eight work on defence contracts, does not get to certify the eight. The DCC scope is the organisation, because a compromised laptop in the finance team is as much a route to the defence data as one on an engineer's desk.
A standalone SaaS product cannot satisfy the scope on its own. Some suppliers assume that because their defence work lives inside one hosted platform, certifying the use of that platform is enough. It is not. The platform is one cloud service among several, and the people logging into it use endpoints, identities and connections that sit inside the scope too.
Whole organisation or a defined subset
Under Cyber Essentials you have a choice. A certificate can cover the whole organisation, or it can cover a defined subset: a part of the business segregated from the rest by a firewall or VLAN, with the boundary agreed with your certification body before assessment begins.
We set out our position on that choice for engineering and manufacturing firms in Cyber Essentials for engineering suppliers, and it has not changed. Aim for whole-organisation scope, with legacy production equipment properly segregated so it sits outside the boundary. The certificate then answers a procurement question cleanly, without an appendix explaining what it leaves out, and the segregation work limits what a ransomware incident on the office side can reach. That post makes the argument in full and we will not repeat it here.
Defence Cyber Certification removes most of the remaining room for debate. A subset certificate that leaves out part of the corporate estate, a group of users, or a cloud service the business depends on does not cover every internet-connected device in the DCC scope. It fails Control 0001, and because Level 0 is all or nothing, good work on the other two controls cannot compensate.
The practical consequence is worth stating plainly. Scope Cyber Essentials narrowly to hit a customer deadline, then find during the DCC assessment that the boundary is too small, and you go back to the start of the Cyber Essentials process with a wider scope, in the final quarter of 2026, when every supplier who left it late is competing for the same certification body capacity. A subset that fails the DCC scope test does not save you a quarter. It costs you one.
So the sequencing advice is simple. If you have not yet certified, scope Cyber Essentials to the DCC boundary from day one. If you already hold a certificate, get it out and read what it says it covers before you assume anything.
If your certificate already names a subset
Do not tear it up. Three questions tell you where you stand.
- What does the subset exclude, and is any of it an internet-connected device inside the organisation's essential functions?
- Was the excluded equipment segregated with no internet traffic at all, in which case it may well sit outside the DCC scope too, or excluded for convenience while still connected?
- When is the certificate due for renewal, and can that renewal be re-scoped to the whole organisation?
Take the answers to your certification body before you book the DCC assessment. They set the boundary, and their view is far cheaper to get early than during the review.
The shop-floor traps
For an office business, "whole organisation" is a list of laptops and a Microsoft 365 tenant. For an engineering or manufacturing supplier, which describes a great deal of the defence supply chain, it is harder, for reasons familiar to anyone who has walked a machine shop with a clipboard.
- The controller PC on a machine tool, CMM or test rig, running an operating system the OEM will not let you update.
- Engineering software, from CAD and CAM to the MRP system, running versions behind because the newer release breaks something.
- Remote access set up by the machine supplier, the ERP vendor or the access control installer at commissioning and never reviewed since.
- Shared operator logins on the goods-in terminal, the shop-floor tablet and the cell controller.
Each of these can fail a Cyber Essentials assessment on its own, and each has a workable answer that does not involve scrapping a working machine. The engineering suppliers post walks through all four, including the route for taking legacy equipment out of scope properly by preventing all traffic to and from the internet, and the vendor conversations that set your real finish date.
What changes under Defence Cyber Certification is the cost of getting these wrong. Under Cyber Essentials alone, a forgotten remote access route or an unsegregated controller PC is a failed assessment and a retest. Under DCC it is also a failed Control 0001, a failed Level 0, and a conversation with your prime about a December date you no longer expect to meet. The traps have not changed. The consequences have.
Cyber Essentials Plus and Levels 2 and 3
The prerequisite depends on the level your contract requires, and the contract's Cyber Risk Profile decides that. You do not choose it.
- Level 0 and Level 1 require Cyber Essentials.
- Level 2 and Level 3 require Cyber Essentials Plus.
Cyber Essentials Plus takes the same requirements and adds independent hands-on technical testing by an assessor, in place of the verified self-assessment. The scope rules are the same: a Plus certificate covering a subset of the business fails the DCC scope test exactly as a basic one does.
For most suppliers reading this, Level 0 is the December 2026 priority and Level 1 is a 2027 conversation, and both need Cyber Essentials rather than Plus. But if your prime has indicated that a higher level is coming, scope Cyber Essentials Plus to the whole organisation now rather than doing the scoping work twice. Ask your prime in writing which level and which Cyber Risk Profile applies. It is a reasonable question and the answer shapes everything else.
Keeping the two certificates in step for three years
Passing is one date. Staying certified is a calendar.
A Defence Cyber Certification certificate is valid for three years, with an annual attestation in years one and two. Cyber Essentials is renewed every year, and Control 0001 includes a commitment to keep it current throughout the DCC period. So over a single DCC cycle you will renew Cyber Essentials three times and attest to DCC twice, and the scope of each Cyber Essentials renewal has to keep matching the DCC scope.
That last part is where it drifts. Businesses change over three years. You take on a new cloud service, open a second unit, bring in a subcontractor with their own laptops, or connect a new machine with a controller PC that quietly has internet access. Each of those changes the population of internet-connected devices inside the DCC scope. If the Cyber Essentials renewal is done from last year's answers, the certificate stops covering the scope and Control 0001 stops being met.
Three habits keep the two in step.
- Put both dates in one place, owned by one person. DCC requires a named individual responsible for cyber security. Make the Cyber Essentials renewal that person's job as well.
- Re-scope at every renewal, deliberately. Walk the asset list, the cloud services list and the remote access list before answering the questionnaire, not after.
- Treat new equipment and new services as a scope question at the point of purchase. A controller PC or a new SaaS tool is a Cyber Essentials question before it is a procurement one.
Do this and the annual renewal becomes a check rather than a scramble. Miss it and you can hold both certificates at the same time and still be out of step with the first control, which is not a position you want to explain to a prime.
Where we fit
HGC IT Solutions is a UK managed service provider based near Dorchester, and we already support businesses in the defence supply chain. We run Cyber Essentials as a dedicated service: scoping the boundary with you, closing the gaps that cause automatic failures, and managing the assessment through to certificate. We hold our own in-date Cyber Essentials certificate, so we are asking you to do something we have done ourselves. We are also a Microsoft Cloud Solution Provider (CSP) partner, which matters when Microsoft 365 is a large part of your scope.
For Defence Cyber Certification we do the same job across all three Level 0 controls, and Level 1 where your contract requires it. We scope, remediate, build the evidence and manage the assessment. The assessment itself is carried out and the certificate issued by CyberSmart, the IASME-accredited DCC certification body for Levels 0 and 1 that we certify you through. HGC does not issue, assess or certify DCC. You deal with one UK team throughout.
If you hold a Cyber Essentials certificate and want to know whether it covers your DCC scope, send us a copy. If you have not certified yet and have a December date, send us the requirement. Either way we will tell you what the scope needs to be and what it will take.
