And it’s not just big contractors that need to have DCC Level 0. The MOD has asked every organisation in its supply chain to get certified, so if you’re not, you’ll run the risk of missing out on key contracts. It’s not a formal contractual requirement just yet, but the MOD has made it clear that not having DCC in place could be a deal breaker when it’s choosing future suppliers.
What is DCC Level 0?
The Defence Cyber Certification (DCC) launched in May 2025 and was developed by the MOD alongside IASME. It’s an organisation-wide certification that aligns with the MOD’s DEFSTAN 05-138 guidelines, which were updated under the Cyber Security Model version 4 (CSMv4) in December 2025. DCC builds on Cyber Essentials – in other words, you need to have Cyber Essentials before you can get DCC.
There are four levels of DCC, going from 0 to 3, and the level you need depends on the cyber risk profile of the contract you’re working on or bidding for. DCC Level 0 is fairly straightforward to obtain compared to Level 3, which requires greater cyber maturity, more evidence and additional assurance activities. Many organisations will only ever need Level 0 – and for now, it’s the one everyone should be focusing on.
To get DCC Level 0, you need to be assessed by an IASME certification body against three baseline controls: having Cyber Essentials in place for all your business-critical systems, being GDPR compliant and operating a resilient business.
That first one is really important – if your Cyber Essentials certification only covers part of your business, you’ll need to make sure it covers every business-critical system that’s in scope before you apply.
Once you’ve got it, DCC is valid for three years, with an annual check-in to confirm you’re still meeting the standard.
Who needs to have DCC Level 0?
The MOD has asked all of its industry partners to achieve Level 0, and if you plan on working with them in future, you need to make sure you also have it. You don’t need to have a defence contract already, either – any organisation can apply.
You may be working with a prime contractor who works with the MOD, and in that case, you’ll likely need to have Level 0 as well. Primes have been asked to pass the requirement down their supply chain, so they’ll let you know if that’s the case – and if you’re not sure, it’s worth asking them.
What if I need a higher level?
Good news – you don’t need to rush it. The MOD has said that if suppliers further down the chain need a higher level of certification, it should be scheduled for after 31 December 2026. So get Level 0 sorted first, then move on to the next step.
Do I have enough time?
If you have an active Cyber Essentials certification that covers your business-critical systems, yes – as long as you start now. You’ll need to book an assessment and get your evidence together, and certification bodies are likely to get busier the closer we get to December. Leave it too late and your application could end up stuck in a queue.
If you don’t have Cyber Essentials, then you need to get your skates on! Luckily, Pokkit x CyberSmart gives you access to the Cyber Essentials portal in a matter of hours, with all the resources you need to get your assessment completed – so you can get qualified quicker without having to wait for a consultant to come.
And if you get stuck along the way, Pokkit’s there to help. Just message our digital companion on WhatsApp with your cyber security questions and you’ll get an instant answer, 24/7.
Ready to start your DCC journey?
Our Defence Readiness Package has everything you need to meet DCC standards, giving you the tools to protect your systems, give your people the right skills, and retain key contracts.
