What DCC is
Defence Cyber Certification is the MOD's scheme for checking the cyber security of its supply chain. It sits on top of Cyber Essentials: you need a current Cyber Essentials certificate before any DCC level, and you need to keep it valid throughout.
There are several levels. Most suppliers will deal with Level 0 or Level 1, which are the two we provide.
Who decides which level you need
You don't choose your level. The MOD or the prime contractor sets it for each contract, based on how much risk the contract carries. Check the tender or contract wording, or ask the contracting team directly.
Level 0
Level 0 is for contracts rated very low risk. It has two requirements:
- A current Cyber Essentials certificate covering the systems that matter to delivering the contract.
- A completed supplier assurance questionnaire, assessed against the defence standard.
The MOD has asked its suppliers to hold at least Level 0, so if you do any defence work at all, it's worth starting here.
Level 1
Level 1 covers low to moderate risk, which includes most standard MOD contracts. Typical examples are IT support, standard software, training and consultancy, and logistics, where you have some access to MOD systems or data.
On top of Cyber Essentials, Level 1 involves an assessment against a much wider set of defence controls. It takes more preparation than Level 0, so leave time before a bid deadline.
Things that catch suppliers out
- Scope is organisation-wide. Unlike Cyber Essentials, where you can sometimes carve out part of the business, DCC usually covers all the operations that matter to delivery.
- Certificates last three years, with yearly checks in between. Let your Cyber Essentials lapse and you put DCC at risk too.
- Deadlines are set by the contract, not by you. If a bid asks for DCC, the clock is already running.
What to do next
- Find out which level your current and upcoming contracts require.
- Check that your Cyber Essentials certificate is current and covers the right systems.
- For Level 1, run a readiness check against the wider control set well before you need the certificate.
How Zarco helps
We provide DCC Level 0 and Level 1, alongside the Cyber Essentials certification they depend on. Send us the tender wording and we'll tell you which level applies, what you need to do and how long it should take.