Head east out of Dorchester and you reach Bovington, the Lulworth ranges and Winfrith in quick succession. Head south and you reach Portland. Head north east and you reach Blandford. Dorset does not talk about itself as a defence county, but the Ministry of Defence has a heavier footprint here than most people who live here realise, and behind each of those sites is a supply chain of small firms that make, fix, code, test and deliver things for it.
Those firms are the reason for this article. MOD has asked every industry partner to hold Defence Cyber Certification Level 0 by 31 December 2026, and the primes are passing that request down to their subcontractors. If you run a small engineering, composites, electronics, software or services business anywhere in Dorset and a defence contract is part of your order book, the letter is either in your inbox already or on its way. Here is what it means and what to do about it.
A county that supplies defence quietly
Bovington is home to the Armoured Trials and Development Unit, and the Lulworth ranges sit alongside it. Blandford is home to the Royal Signals. Portland, on the coast, has a defence footprint of its own. And at Winfrith, the Dorset Innovation Park hosts the MOD Defence BattleLab.
None of those sites runs on its own. Each one draws on a web of businesses across Dorset, and over the county line into Somerset, Wiltshire and Hampshire, that most people would never connect with defence:
- precision engineering and machining shops making components and fixtures
- composites firms producing lightweight structures and enclosures
- electronics and cabling businesses building assemblies, harnesses and test equipment
- software and systems firms writing and supporting code that sits in or alongside MOD systems
- services firms: logistics, calibration, training, technical consultancy, facilities and IT support
Most are small businesses. Most have a quality system and take it seriously. Very few have anyone whose job is cyber security. And nearly all of them sit one or two tiers below the company that actually holds the MOD contract, which is exactly where the December ask lands hardest.
The letter that is landing in Dorset inboxes
On 8 May 2026 Eleanor Fairford, MOD's Director of Cyber Defence and Risk, wrote on the Defence Digital blog: "I have also recently asked all industry partners to achieve Level 0 DCC certification by 31st December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope."
Note the word. MOD has asked. Nothing in the scheme itself makes DCC a legal requirement. But where DEFCON 658, the MOD contract condition on cyber security, is in your contract or subcontract, the underlying controls in Def Stan 05-138 are contractual already. Industry Security Notice 2026/02, issued on 30 March 2026, tells MOD buyers that a current DCC certificate at or above the level the contract requires is to be treated as satisfying those controls. So DCC is now the recognised way to evidence an obligation you have very probably already signed up to.
A follow-up post on 13 July 2026 made the flow-down explicit. Primes should push the Level 0 ask down their supply chains and set timescales for their subcontractors, and where higher levels are needed at lower tiers, those "should be scheduled for delivery after 31 December 2026". The same post told subcontractors directly: "If you are a subcontractor to a Prime, engage with your Prime and discuss what level you should be looking to achieve."
That is why the letter reaching a composites firm near Wareham or an electronics shop outside Blandford is short. The prime is passing on a request it received itself, to a timetable it did not set. It is entirely reasonable to reply asking them to confirm in writing the level they need and the Cyber Risk Profile of the contract, and we would encourage you to do that this week. What you should not do is assume the requirement can be negotiated away, because DEFCON 658 leaves the prime very little room.
If you want the full background, including what the four levels are and how the Cyber Risk Profile decides which one you sit in, we have written a plain English explainer on Defence Cyber Certification.
What the smaller firms are being asked for
For nearly every subcontractor in the county the December ask is Level 0. It is the baseline for the whole chain, it has three controls, and all three must be fully met.
Cyber Essentials, scoped to match
The first control is a current Cyber Essentials certificate that covers every internet-connected device in the DCC scope, together with a commitment to keep it current for the three years the DCC certificate runs. Many Dorset suppliers already hold Cyber Essentials because a prime asked for it. The question the assessor will ask is whether its scope matches. A certificate covering the office but not the workshop, or one that names a defined subset of the business, does not pass this control.
UK GDPR and data protection
The second control asks for documented data protection policies, sized to the business rather than copied from a corporate template, registration with the Information Commissioner's Office, and evidence that you have a process for Data Protection Impact Assessments. The scheme also expects a named individual to be responsible for cyber security. For a small firm this is not a large job, but it is easy to leave until the last fortnight, and lapsed ICO registrations turn up more often than you would think.
Business resilience you can prove
The third control is the one that surprises well-run firms. It asks for a documented resilience needs assessment naming your essential systems and the cyber risks to them, and then for evidence that the controls protecting those systems actually run: backup logs, reports from tested restores, records of any redundancy you rely on. A backup policy on its own does not pass. The assessor wants to see that you restored something and that it worked.
Level 1 for some of you in 2027
If your business is IT support, software, consultancy, training or logistics, and your work gives you some access to MOD systems or OFFICIAL data, the level your contract points to is more likely to be Level 1. Level 1 has 101 controls and is verified through interviews, demonstrations and operational evidence, not just documents. MOD's own guidance is that higher levels at lower tiers should be scheduled after 31 December 2026, so for most Dorset services suppliers the sensible plan is Level 0 by December and a Level 1 conversation with your prime in the new year. Both levels start from Cyber Essentials, so nothing you do now is wasted.
Control by control detail, including the evidence that passes and the mistakes that fail, is in our guide to the DCC Level 0 controls.
Why local suppliers fail on scope and resilience
From working with engineering and manufacturing firms across the county, we can tell you where Level 0 catches Dorset businesses, and it is almost never the paperwork.
The workshop network
An office business has laptops and cloud email. A Dorset engineering firm has those, plus a CNC controller running an operating system that stopped receiving updates years ago, a measuring machine with a vendor remote access link set up at commissioning and never reviewed, a shared login on the shop floor tablet, and a test rig on the same flat network as the accounts PC. There are ways to handle that kind of equipment within Cyber Essentials, but they have to be designed and evidenced, and the DCC scope has to be drawn around the same boundary. Firms that scoped their original Cyber Essentials to "the office" to avoid the problem now find that certificate fails the first DCC control.
The backup nobody has restored
Almost every business we meet has backups. Far fewer have ever restored from them, and fewer still can produce a dated report proving it. For a machining firm whose job files, CAM programmes and ERP live on one server in a cupboard, that server is an essential system by any definition. A cloud backup that runs nightly and has never been tested is a policy, and a policy does not pass.
Nobody owns it
Small firms run on people who wear several hats. That is fine until an assessor asks who is responsible for cyber security and three people look at each other. Name someone. It does not have to be a technical person. It has to be a person.
None of these are hard to fix. All of them take longer than a fortnight, and certification body capacity is expected to tighten as December approaches, because every supplier who waited will be looking for a slot at the same time.
A local plan with a national scheme
Defence Cyber Certification is a national scheme, assessed by IASME-licensed certification bodies, and it does not matter to the assessor whether you are in Portland or Preston. What does matter is having someone alongside you who understands both the scheme and the way a small Dorset workshop actually runs.
HGC IT Solutions is based near Dorchester, in the middle of the Bovington, Blandford, Portland and Winfrith footprint, and we already support businesses in the defence supply chain. We hold Cyber Essentials ourselves. Our delivery is remote-first, and we visit sites across Dorset where it is useful, which for workshop networks and shop floor equipment it often is. We work with defence suppliers across the UK on the same basis.
We check what your prime has actually asked for and which level your contract points to. We get Cyber Essentials in place, or rescoped, so it covers the DCC boundary. We build the data protection evidence and the resilience evidence, including tested restores with the logs to prove it. We assemble the evidence pack and manage the assessment through CyberSmart, the IASME-accredited DCC certification body for Levels 0 and 1. Then we keep you current: the DCC certificate runs for three years with an annual attestation, and Cyber Essentials has to be renewed every year throughout.
What we do not do is issue the certificate. HGC does not assess or certify DCC. The certification body does that, independently, and that independence is the point of the scheme. We also will not tell you December is achievable if it is not. If a machine tool dependency or a vendor lead time makes it unrealistic, the right answer is to tell your prime that, with the specifics. A supplier with a plan and a date is treated very differently from one who goes quiet.
You can read more about how we work with firms across the county on our IT support in Dorset page.
Where to start
Three things this week.
- Reply to your prime. Confirm you have received the requirement, say you are working towards Level 0, and ask them to confirm in writing the level and the Cyber Risk Profile for your contract.
- Check your Cyber Essentials certificate. Is it current, and does its scope cover the whole business, workshop included? If either answer is no, that is your first job.
- Find out when your backups were last restored, and whether anyone can produce a report to prove it.
Then work through the Level 0 readiness checklist on our Defence Cyber Certification page. It covers the Cyber Essentials scope check, ICO registration, data protection policies, the DPIA procedure, essential systems, the restore test log, the named cyber owner and the questions to put to your prime. If the checklist turns up gaps, book a readiness call from the same page and we will tell you honestly which level you need, what the gaps are, and whether December is realistic for your business.
Dorset's defence supply chain has been getting on with the job quietly for decades. This is one more requirement, and it is a manageable one, provided you start before the queue forms.
