Defence Cyber Certification (DCC) Certification Body for Levels 0 to 3
Certified to Strengthen Cyber Resilience in the UK Defence Supply Chain
RightCue is an IASME-licensed Defence Cyber Certification (DCC) certification body for Levels 0 to 3, under the UK Ministry of Defence (MOD) and administered by the IASME Consortium. We assess MOD suppliers against Defence Standard 05-138 and provide readiness support to help you prepare.
RightCue Knowledge Hub
The complete DCC guide for UK Defence Suppliers
Everything you need to know — levels, scoping, the assessment process and how to prepare.
Official Certification Body · Levels 0–3
Read the full guide →Action required
DCC Level 0 deadline: 31 December 2026
The MOD has asked all industry partners to hold Defence Cyber Certification Level 0 by 31 December 2026. Level 0 covers three controls, built on a valid Cyber Essentials certificate. IASME confirms DCC is not yet required on every contract, but Level 0 is now a baseline expectation across the MOD supply chain. RightCue can assess you against this requirement and help you prepare.
IASME-licensed DCC certification body · Levels 0 to 3
Book a DCC scoping call →What is a Defence Cyber Certification?
The Defence Cyber Certification (DCC) is a comprehensive cybersecurity framework developed by the UK Ministry of Defence and delivered by IASME. It aims to strengthen the cyber resilience of the UK’s defence sector by providing a structured certification process for suppliers.
DCC offers a single, organisation-level assurance that suppliers can present in support of UK Defence procurements. Certifications are subject to annual check-ins and re-certification every three years. To keep your certificate valid you also maintain your underlying Cyber Essentials or Cyber Essentials Plus certification and complete an annual attestation.
Being certified against this standard ensures suppliers meet and maintain robust cybersecurity across their organisation.
Key objectives:
This certification is part of a broader national effort to bolster cyber resilience in industries critical to national infrastructure.
What are the Different Levels of the Certification?
The DCC framework comprises four levels, each corresponding to the assessed cyber risk associated with a supplier’s output:
Each level builds on the one below it, so the number of controls grows with the assessed risk. You do not have to start at Level Zero. You can apply for the level you need and move up later through a fresh assessment at the higher level.
| Level | Who it is for | Controls | Foundation required |
|---|---|---|---|
| Level 0 | Low assessed cyber risk | 3 controls | Cyber Essentials |
| Level 1 | Low to moderate assessed cyber risk | 101 controls | Cyber Essentials |
| Level 2 | High assessed cyber risk | 139 controls | Cyber Essentials Plus |
| Level 3 | Substantial assessed cyber risk | 144 controls | Cyber Essentials Plus |
The Certification Process
As an official Certification Body for Levels 0 to 3, RightCue guides you through the whole DCC process. The four steps below describe a Level Zero assessment. Levels 1 to 3 follow the same path in greater depth, with the scope agreed up front and, at Levels 2 and 3, a likely physical site visit:
What This Means for You
“Although we aren’t permitted to write publicly for the company, I appreciate the strong and continuing relationship we have with RightCue. From my personal perspective, we worked extensively with RightCue since 2023 and It’s consistently been a pleasure working with the team. I genuinely look forward to working with the team each year as we renew our Cyber Essentials+ certification as they consistently makes what can be a challenging process much more manageable and even enjoyable.”
Large MOD Supplier
The Defence Cyber Certification (DCC) is a cyber security certification framework for UK defence suppliers, developed by the UK Ministry of Defence (MOD) and delivered through IASME. It gives suppliers a single, organisation-level way to demonstrate cyber resilience in support of UK defence procurements.
The cost of DCC certification depends on the level you need and the size of your organisation, as both affect the depth of assessment. We give you a clear, fixed price once we understand your scope and target level.
RightCue is an IASME-licensed Defence Cyber Certification body for all four levels, Levels 0 to 3. We have been an IASME Cyber Essentials certification body since 2014, are CREST accredited for penetration testing, and hold five NCSC accreditations, including NCSC Assured Service Provider status. We assess MOD suppliers against Defence Standard 05-138 and provide practical readiness support to help you prepare.
DCC is not yet required on every MOD contract, and you can still tender through the normal process. However, the MOD has asked all industry partners to hold DCC Level 0 by 31 December 2026, and IASME confirms it is not yet mandatory on every contract. Certifying early demonstrates cyber maturity and prepares you ahead of the deadline.
There are four levels matched to assessed cyber risk: Level 0 (3 controls), Level 1 (101 controls), Level 2 (139 controls) and Level 3 (144 controls). All levels start with Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus.
Yes. Cyber Essentials is the first requirement for every level. Levels 0 and 1 require Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus, covering the right scope.
DCC certification is valid for three years. You complete an annual attestation and maintain your Cyber Essentials or Cyber Essentials Plus certification, then recertify every three years.
No. You can apply for the level you need without completing lower levels first, and you can move up later through a fresh assessment at the higher level.
Knowledge Hub
To see how we work with clients, ensuring data privacy compliance for their specific industries read our useful articles, guides and customer success stories:
