RightCue has been appointed by the UK Ministry of Defence (MOD) and IASME as an official Certification Body for the Defence Cyber Certification (DCC), authorised to deliver Levels 0, 1, 2 and 3. This guide explains what the DCC scheme is, who needs it, how the four levels work, what the assessment involves, and how to prepare. It is written for business owners, bid teams and security leads in the UK defence supply chain who want a clear, practical reference. 

The Defence Cyber Certification (DCC) is a cyber security certification framework for UK defence suppliers. It was developed by the UK Ministry of Defence (MOD) and is delivered through IASME, the MOD's official cyber certification partner. The scheme is part of a wider national effort to strengthen the cyber resilience of the UK's defence sector and its supply chain. 

In simple terms, DCC gives your organisation a single, recognised way to demonstrate that you take cyber security seriously. It provides a visible badge of assurance that you can present in support of UK defence procurements, and that gives buyers confidence in how you protect your business. 

The MOD owns the requirement and IASME delivers the scheme on its behalf. IASME manages the framework through a network of approved Certification Bodies. RightCue is one of those Certification Bodies, authorised across all four levels. As your Certification Body, we assess your submission and award the certificate when the requirements are met. 

Previously, cyber security for defence suppliers was assessed contract by contract. Every new contract could mean another round of separate, often duplicated, cyber checks. That approach was slow, repetitive and focused narrowly on protecting MOD Identifiable Information rather than the health of the supplier as a whole. 

DCC brings together several established defence and cyber security standards into one assessable scheme. It is built on the uplifted UK Defence Standard DefStan 05-138 issue 4, which sets out the cyber controls suppliers must achieve at each level. It aligns with the National Cyber Security Centre’s Cyber Assessment Framework (CAF) and the MOD’s Cyber Security Model, and the question set is drawn from the MOD Supplier Assurance Questionnaire (SAQ). Cyber Essentials sits at the core of every level. 

DCC is aimed at organisations in the UK defence supply chain. This includes current defence contractors who already bid for and deliver MOD work, and potential defence contractors who want to start bidding for MOD contracts. If your organisation supplies, or wants to supply, goods or services into the defence sector, DCC is relevant to you. 

DCC is not yet a formal contractual requirement to bid for MOD contracts. However, this is changing. In May 2026 the MOD’s Director of Cyber Defence & Risk asked all defence industry partners to achieve DCC Level 0 by 31 December 2026 – a requirement that includes holding Cyber Essentials for all applicable business-critical systems within scope.

Higher levels (1–3) are not mandated for this deadline. The level you need for a given piece of work continues to be assigned by the MOD or your Prime based on cyber risk, and where higher levels are required lower in the supply chain, these are expected to follow after 31 December 2026.

In short: Level 0 should now be treated as a near-term baseline expectation across the MOD supply chain, even where it is not yet written into an individual contract. Certifying early demonstrates maturity, reduces friction in future bids and puts you ahead of defence partners who have not yet acted, so we strongly recommend starting now rather than waiting.

There are four levels, from Level 0 to Level 3. The level you need depends on the cyber risk associated with the work you do. As the assessed risk increases, so does the number of controls, the depth of evidence required and the seniority of the assessor. The number of controls rises from 3 at Level 0 to 144 at Level 3. Every level begins with Cyber Essentials. 

The level is driven by the cyber risk of the defence work you deliver. Each defence project carries a cyber risk assessment that defines the security measures required of its suppliers. Lower-risk work points to Level 0 or 1, while higher-risk work calls for Level 2 or 3. If you are unsure, we can help you interpret the requirement and identify the right level before you commit. 

No. The scheme is flexible. You can jump straight to the level you need, upgrade later, or progress through the levels over time. You do not need Level 0 before pursuing Levels 1 to 3. We will recommend the most sensible route based on your situation.

Note that a certificate is only valid for the level it is awarded at, a Level 0 certificate does not satisfy a contract that requires Level 2, for example.

Level 0 is the baseline the MOD has asked all defence partners to reach, while the specific level for a given contract is assigned by the MOD or your Prime.

Yes. Cyber Essentials is the first requirement for every DCC level, and it sits at the core of the scheme. Levels 0 and 1 require Cyber Essentials, while Levels 2 and 3 require Cyber Essentials Plus. You do not have to complete Cyber Essentials at exactly the same time as DCC, but you must hold a valid certificate that covers the right scope, and you must commit to maintaining it. 

These are two separate schemes with different objectives, and their scopes must line up. Cyber Essentials focuses on the internet-connected IT that supports your business. DCC is broader and includes systems that Cyber Essentials does not reach, such as air-gapped devices, entry control systems and HVAC systems. 

The rule to remember is that your DCC scope must either contain or overlap with your Cyber Essentials scope. Any internet-connected component inside your DCC scope is automatically part of your Cyber Essentials scope. If the two scopes do not align, the assessment will fail, so it is worth planning your Cyber Essentials scope with DCC in mind. If you hold multiple Cyber Essentials certificates, they can be considered together. 

Determining the correct scope is the first and most important step of certification. DCC scope is based on your whole organisation, meaning the company or legal entity responsible for delivering the service to the MOD. That does not mean every single part of the business, but it does mean every essential service and function needed to keep the organisation running. 

In practice, systems such as HR, IT and stock management are usually in scope, because the business depends on them. Non-essential areas, such as a staff cafeteria or vending machines, are usually out of scope, unless your organisation genuinely relies on them to function. A useful test is to ask what would happen if a system were unavailable for a day, a week or a month, and whether the business could continue to operate effectively without it. 

Operational Technology should be in scope when it is essential to your operations. For example, if you run CNC machines continuously as a core service, those systems belong in scope. If a machine is only used occasionally for non-essential tasks, it may be excluded. The deciding factor is always how important the system is to your ability to function. 

Where OT is in scope, not every control may be technically possible. If anti-malware software cannot be installed on a particular machine, for example, the assessor can take that limitation into account. You would then need to explain why the control cannot be applied and show the alternative or compensating measures you have put in place. 

Once you have determined your scope, you must document it in a formal attestation. This is a signed statement, made by an authorised person such as the CEO or CISO, confirming that all essential services and functions are within scope and that the information provided is accurate and complete. It should list your sites and their functions, your IT and OT networks and systems, your devices and data storage, and include scoping diagrams showing what is inside and outside the DCC scope, along with Cyber Essentials coverage. 

Scoping mistakes are the most common reason certification fails. If you under-scope, leaving out something essential, you will fail even if every required control has been met. Your scope will be reviewed and discussed with your assessor, who may challenge it to make sure it is appropriate and sufficient. This is exactly why it pays to get scoping right at the start, and why we discuss and agree scope with you before you submit. Your scope should also stay consistent across all levels. 

The Level 0 journey follows four clear stages: 

You get in touch with RightCue and we help you understand the scope for your assessment. A valid Cyber Essentials certificate that covers the right scope needs to be in place.

You complete your answers on the assessment platform and gather supporting evidence covering your Cyber Essentials scope, data security basics, GDPR practices, and network and system resilience.

Our assessor holds a video session with you to discuss the evidence, clarify any scope differences and review your documentation. 

Based on your evidence, we determine the outcome. A successful Level 0 assessment results in a certificate valid for 36 months.

Level 0 concentrates on the broad goal of resilience. The assessment looks at four areas: your Cyber Essentials certification and scope, your UK GDPR and data governance practices, your data security basics, and the resilience of your networks and systems. Level 0 carries a 100 percent pass mark, so every required control must be met. 

You are responsible for demonstrating that you meet each control, describing how you meet it and providing supporting evidence. Evidence can include policy and process documents, screenshots, asset registers and similar records. Most of it should come from documents you already have, which keeps the workload down. The amount of detail expected scales with the size of your organisation and the level you are seeking. 

Your Certification Body can guide you, but cannot do the work for you, because we later assess that same work. We may explain the scheme and its levels, explain the controls and how to meet them, clarify questions, describe the evidence needed and verify your scope. We may not implement policies for you, answer questions on your behalf, prepare your answers or evidence, or supply completed documentation. This separation keeps the certification credible and independent. 

RightCue is an official DCC Certification Body across Levels 0 to 3, and we believe cyber security should enhance your business rather than obstruct it. We help suppliers across regulated industries put in place meaningful security programmes that meet evolving standards like the DCC. 

Whether you are bidding for your first MOD contract or strengthening your position for larger work, we can help you choose the right level, get your scope right the first time, and move through assessment smoothly. The biggest hurdle for most applicants is scoping, and that is exactly where our early guidance saves you time and avoids a failed submission. 

If you would like to understand which DCC level is right for you, or to begin the certification process, we are happy to have a quick conversation. Please get in touch and we will help you plan the most sensible route.