Defence Cyber Certification for MOD Suppliers and Subcontractors

Defence Cyber Certification (DCC) is the UK Ministry of Defence's cyber security certification for its suppliers, developed with IASME and launched in May 2025. It has four levels, from Level 0 to Level 3, matched to the Cyber Risk Profile of each contract. It is the way suppliers evidence the controls in Def Stan 05-138 Issue 4 that DEFCON 658 places in defence contracts, and it is assessed by an independent, IASME-accredited certification body rather than by self-assessment alone.

Not in law. The Ministry of Defence has asked all industry partners to achieve Level 0 by 31 December 2026, and MOD buyers have been instructed to accept a valid DCC certificate as satisfying the Def Stan 05-138 controls required under DEFCON 658. Where DEFCON 658 is in your contract or subcontract, the underlying controls are already a contractual obligation, and DCC is the recognised way to prove you meet them. In practice, if your prime has asked, you need it.

Three controls, all of which must be fully met. First, a current Cyber Essentials certificate that covers every internet-connected device inside your DCC scope, with a commitment to keep it current. Second, UK GDPR evidence: ICO registration, data protection policies sized to your business, and a Data Protection Impact Assessment procedure. Third, business resilience: a documented assessment of your essential systems and their cyber risks, plus proof that your backups and recovery actually work, such as tested restore logs. It is a documentation-led review by the certification body.

Level 0 is the baseline for very-low-risk contracts and the level MOD has asked everyone to reach by December 2026. Level 1 covers 101 controls across governance, identity and access, devices, secure configuration, incident response, training and supply chain, and is verified by interview, demonstration and review of operational evidence. Suppliers of IT support, software, consultancy, training and logistics with access to MOD systems or OFFICIAL data are typically Level 1. You do not choose the level: your contract's Cyber Risk Profile sets it, so ask your prime in writing. MOD has said Level 1 and above at lower tiers should be scheduled after December 2026.

Levels 0 and 1 require Cyber Essentials. Levels 2 and 3 require Cyber Essentials Plus. In every case the scope of the certificate must cover every internet-connected device inside your DCC scope, so a certificate that covers only part of the business will not do. If you already hold Cyber Essentials, the first job is to check the scope lines up.

No. HGC is not a certification body. We scope your environment, close the gaps, build and maintain the evidence, and manage the assessment on your behalf. Your certificate is assessed and issued by CyberSmart, an IASME-accredited DCC certification body for Levels 0 and 1. You get a properly accredited certificate, managed end to end by one UK team.

It depends on three things: whether you already hold Cyber Essentials with the right scope, how many evidence gaps there are, and certification body availability, which is expected to tighten towards December 2026. We will not put a number on it before we understand your setup, but on the readiness call we will tell you honestly whether your deadline is realistic and what has to happen first.

There are three parts. The certification body charges an assessment fee for the level you need. Cyber Essentials, the prerequisite, carries its own assessment fee tiered by organisation size. And there is whatever remediation your business needs to get the controls and evidence into the passing state, which is the part that varies most. We scope all three after a short readiness call and tell you what is involved before you commit to anything, so there are no surprise bills.

Three years, provided you complete an annual attestation in years one and two confirming the controls are still in place, and keep your Cyber Essentials certificate renewed every year throughout. Keeping the controls and evidence current between those points is exactly what our ongoing service does.

Very likely, yes. DEFCON 658 and the DCC requirement flow down the supply chain, so if your prime or the company above you has included them in your subcontract terms, you are in scope whether or not MOD is your customer. MOD has specifically asked primes to push Level 0 down the chain and set realistic timescales for their subcontractors. If you are not sure, the readiness call is the place to find out.

Not yet. A valid DCC certificate can be submitted as assured evidence that the corresponding Def Stan 05-138 controls are met, and MOD buyers have been told to accept it as such, but the Supplier Assurance Questionnaire process still exists alongside it. We help you keep both consistent so the story you tell your prime is the same in every document.

No. We are based near Dorchester and we already support businesses in the defence supply chain, but Defence Cyber Certification work is delivered remotely first and we work with suppliers anywhere in the UK. Where an on-site visit is useful, for example to look at a workshop network, we arrange it.