Be ready for defence opportunities
Prepare your organisation for evolving Ministry of Defence cyber requirements with independent certification from C3IA. We assess all four DCC levels, helping you demonstrate resilience, strengthen buyer confidence and compete for future defence contracts.
Defence Cyber Certification
What is Defence Cyber Certification?
Defence Cyber Certification provides independent assurance that your organisation meets the cyber security and resilience requirements expected across the UK defence supply chain.
DCC supports the Ministry of Defence’s approach to managing cyber risk across its supply chain. It gives buyers greater confidence that suppliers have appropriate security controls in place and can continue operating through cyber disruption.
DCC is relevant to current and prospective defence suppliers. Your required level may be stated in a tender or contract, but organisations can also apply proactively to prepare for future opportunities.
DCC assesses your organisation against the controls associated with one of four risk-based levels. C3IA independently reviews your evidence through remote and, where required, on-site assessment activity.
DCC applies at an organisational level rather than to a single contract. Once achieved, it can support multiple defence opportunities up to your certified level, helping to reduce repeated assurance activity.
Defence Cyber Certification
3 key benefits
Achieving DCC with C3IA can help your organisation prepare for future defence opportunities, reduce repeated assurance and demonstrate independently verified cyber resilience.
Question?
Frequently asked questions
Defence Cyber Certification is still relatively new, so it is natural to have questions about how it applies to your organisation. Here are answers to some of the questions we are asked most often.
DCC is not currently mandatory for every organisation bidding for Ministry of Defence work.
However, suppliers should expect certification to be requested more frequently in future tenders and contracts. Where a particular DCC level is required, this should be stated in the procurement documentation.
Organisations can also apply voluntarily to prepare for future opportunities.
The required level may be specified by the Ministry of Defence in a tender or contract.
If you are applying proactively, the most suitable level will depend on the type of defence work you plan to pursue, the associated cyber risk and your current security position.
C3IA can explain the requirements of each level and help you understand the most appropriate assessment route.
DCC has four certification levels. You do not need to complete them in sequence and can apply directly for the level that meets your needs.
Level 0: Baseline
The entry level of DCC, covering essential cyber security measures and awareness. Cyber Essentials certification is required.
Level 1: Low
Designed for organisations undertaking work with a lower cyber risk profile. Cyber Essentials is required.
Level 2: Medium
Intended for organisations involved in work with a moderate cyber risk profile. Cyber Essentials Plus certification is required.
Level 3: High
The highest level of DCC, intended for critical capabilities and work with a high cyber risk profile. Cyber Essentials Plus certification is required.
The Cyber Security Model version 4 is the Ministry of Defence’s approach to managing cyber risk across its supply chain.
DCC is the independent certification scheme used to assess whether an organisation meets the security controls associated with a particular level.
In simple terms, CSMv4 sets the requirements and DCC provides independent assurance that they have been met.
Yes. You do not need to wait until a tender or contract asks for DCC.
Applying proactively can give your organisation more time to prepare, gather evidence and address any areas that could delay certification. It can also help demonstrate that your organisation takes defence cyber security seriously.
Yes. A current Cyber Essentials certification is required for every DCC level, while Levels 2 and 3 require Cyber Essentials Plus.
C3IA is also an authorised Cyber Essentials Certification Body, so we can help you achieve the certification you need before progressing with your DCC assessment.
Your Cyber Essentials or Cyber Essentials Plus certification must remain current throughout the validity of your DCC certification. Other standards, such as ISO 27001, may provide useful supporting evidence, but they do not automatically demonstrate compliance with every DCC requirement.
The process begins by confirming the level you are applying for and the scope of the organisation being assessed.
You will then need to show how you meet the relevant controls and provide supporting evidence. C3IA will independently review this evidence through remote and, where required, on-site activity.
You can apply directly for the level you need without completing the lower levels first.
DCC is an organisation-wide certification rather than a separate assessment for each contract.
Once achieved, it can support multiple defence contracts up to the level certified. The assessment scope must accurately reflect the people, systems, locations and activities covered by your organisation.
DCC certification is valid for three years, subject to annual attestation and continued maintenance of the required Cyber Essentials or Cyber Essentials Plus certification.
Your organisation will need to confirm each year that the relevant controls remain in place.
The cost depends on the level being pursued and the size and complexity of your organisation.
Factors may include the number of sites in scope, the assessment activity required and your readiness to provide the necessary evidence.
The total cost includes the scheme fee and C3IA’s assessment fee. We will confirm the scope and provide a clear quotation before assessment begins.
C3IA is an assured DCC Certification Body authorised to assess organisations at all four levels.
We have also achieved DCC Level 2 ourselves, giving our team first-hand experience of preparing for and completing the assessment process.
Our assessors combine cyber security expertise with experience of the defence environment, providing a service that is thorough, practical and straightforward.