Zarco / Compliance
Cyber Essentials, CE+ and DCC, without the guesswork.
We provide Cyber Essentials, Cyber Essentials Plus and Defence Cyber Certification. We check your setup, help fix whatever would fail, and see you through to the certificate. Then we remind you well before it lapses.
- Certificates
- Cyber Essentials, CE+, DCC Level 0 and Level 1
- Before you submit
- A readiness check, so nothing fails
- Valid for
- 12 months for CE and CE+, 3 years for DCC
- Renewals
- Reminders in good time, every year
01Cyber Essentials
Five controls. Every certificate checks them.
Cyber Essentials is the UK government-backed baseline. It's built around five technical controls that stop most common attacks.
Firewalls
Boundary firewalls and routers set up so only the traffic you need can get in.
Secure configuration
Default passwords changed, unused software and accounts removed, nothing running that doesn't need to be.
Security updates
Only supported software, with high-risk and critical updates applied within 14 days of release.
User access control
Accounts only for people who need them, admin rights kept separate, and multi-factor authentication on cloud services.
Malware protection
Anti-malware or application allow-listing on every device in scope.
02Which certificate
Which certificate do you need?
Usually the customer, tender or insurer asking will tell you. Here's how they compare.
Read the full comparison| Certificate | How it's checked | Usually asked for by | Valid for |
|---|---|---|---|
| Cyber Essentials | Self-assessment questionnaire, reviewed by an independent assessor | Public sector contracts, larger customers, cyber insurers | 12 months |
| Cyber Essentials Plus | The same questionnaire, plus a hands-on technical audit of your devices and an external scan | Contracts involving sensitive data, and customers who want proof the controls work | 12 months |
| DCC Level 0 | A current Cyber Essentials certificate, plus a short supplier assurance questionnaire | Ministry of Defence contracts rated very low risk | 3 years, checked yearly |
| DCC Level 1 | A current Cyber Essentials certificate, plus an assessment against the defence standard's wider set of controls | Most standard MOD contracts with some access to MOD data or systems | 3 years, checked yearly |
03How it works
How we get you certified.
Nothing is submitted until we're confident it will pass.
Readiness check
We go through your setup against the current question set and list anything that would fail.
Fix the gaps
We help close them, hands-on or alongside your IT provider, and agree what's in scope.
Assessment
Your assessment is submitted and reviewed. For Cyber Essentials Plus, we arrange the technical audit too.
Renewal
Certificates last 12 months. We get in touch in good time, so a lapse never costs you a contract.
04Defence Cyber Certification
Supplying the Ministry of Defence? You'll need DCC.
Defence Cyber Certification is the MOD's scheme for its supply chain. We provide Level 0 and Level 1.
- Level 0For contracts rated very low risk. You need a current Cyber Essentials certificate and a completed supplier assurance questionnaire.
- Level 1For low to moderate risk, which covers most standard MOD contracts. Cyber Essentials plus an assessment against a wider set of defence controls.
- Organisation-wideUnlike Cyber Essentials, DCC usually covers the whole business, not one part of it.
- Three yearsCertificates last three years, with yearly checks and a valid Cyber Essentials certificate kept up throughout.
DCC level check
Which DCC level are you likely to need?
Six quick questions, no email needed. Pick the closest answer; you don't need to know the scheme to use it.
- Level 0Very low riskNeeds Cyber Essentials
- Level 1Low to moderateNeeds Cyber Essentials
- Level 2High riskNeeds Cyber Essentials Plus
- Level 3Substantial riskNeeds Cyber Essentials Plus
Your likely starting point
Why
What to do next
Guidance only. The level that counts is the one the MOD or your prime contractor sets for the contract, so check the tender wording before committing to an assessment.
05Questions
Questions about certification.
What's the difference between Cyber Essentials and Cyber Essentials Plus?
Both check the same five controls. Cyber Essentials is a self-assessment that an independent assessor reviews. Plus adds a hands-on technical audit: an assessor tests a sample of your devices and scans your systems from outside to confirm the controls work as described. You need Cyber Essentials before you can go for Plus.
What happens if we'd fail?
That's what the readiness check is for. We find the problems before anything is submitted and help you fix them, so the assessment itself is a formality rather than a gamble.
Are home workers and personal phones in scope?
Usually, yes. Devices that access company data or services, including staff's own phones and laptops, are normally in scope. We'll help you decide what to include and set it up so it passes.
Which DCC level do we need?
The MOD or your prime contractor sets the level for each contract, so check the tender or contract wording. A higher-level certificate also covers lower-level contracts. Send us what you've been given and we'll tell you what applies.
What does it cost?
Certification is fixed-price and quoted after a short call, once we know your size and what needs to be in scope. Any fixes we help with are quoted separately and up front.
Talk to us about AI, compliance or testing.
A 30-minute call, a straight answer, and a fixed quote if there's work to do.
→Contact
Tell us what you need.
A tender deadline, an insurer's questionnaire, a system you want tested, or a job you'd like AI to take off your team's hands. We reply within one working day, UK hours.
- A 30-minute first call, with no obligation
- A fixed quote before any work starts
- A UK-based team you can talk to directly