Defence Cyber Certification (DCC): What UK Defence Suppliers Need to Know
A neutral guide for defence-focused advisories, consultancies and MSPs, and the suppliers they serve: the four levels, how DCC relates to Def Stan 05-138 Issue 4 and DEFCON 658, and what is still unclear. Facts link to their MOD, NCSC or IASME source. The level you need is set by your contract's Cyber Risk Profile, not by your own assessment. The MOD has asked all suppliers for Level 0 by 31 December 2026 (a request, not by itself a contract clause).
What Defence Cyber Certification Is
Defence Cyber Certification (DCC) is a UK Ministry of Defence (MOD) certification scheme. It was created in partnership with industry and IASME, which is the scheme's Certification Authority (Cyber Security Model guidance, gov.uk (opens in a new tab)). The MOD's Directorate of Cyber Defence & Risk (CyDR) issues the DCC Industry Security Notices and is the MOD point of contact. DCC launched in May 2025 (ISN 2026/02 (opens in a new tab)).
IASME describes it as a single, organisation-level assurance that suppliers can present in support of UK defence procurements, subject to annual attestation and re-certification every three years. It is a point-in-time assessment against a UK defence standard: applicants describe how they meet each control and provide evidence (IASME DCC page (opens in a new tab)).
The standard behind it is Def Stan 05-138 Issue 4, Cyber Security for Defence Suppliers. DCC assures compliance with that standard. It is open to any organisation, whether or not it currently holds a defence contract (MOD Defence Digital blog, 8 May 2026 (opens in a new tab)).
Not to be confused with the Saudi National Cybersecurity Authority's Data Cybersecurity Controls, also abbreviated “DCC”. They are unrelated; see NCA ECC and the other Saudi frameworks.
Next steps for a supplier
- Check your contract, or ask your MOD buyer, for the Cyber Risk Profile level and risk assessment reference (RAR) assigned to it (CSM guidance (opens in a new tab)).
- Get Cyber Essentials for the systems in scope. Every level starts with it.
- Scope the legal entity that will be certified, because certification applies only to that entity (ISN 2026/01, Annex A (opens in a new tab)).
- Choose an IASME-assured certification body for the level you need.
The Four DCC Levels: DCC Level 0, 1, 2 and 3
Issue 4 of Def Stan 05-138 replaced the five Cyber Risk Profiles of the earlier issue with four levels, Level 0 to Level 3. A higher level satisfies all the lower ones.
The level a supplier needs is set by the Cyber Risk Profile assigned to the contract, not by the supplier's own internal risk assessment (ISN 2026/01, Annex A (opens in a new tab)).
| Level | Name | Controls | Assessed risk | Cyber Essentials requirement | Source |
|---|---|---|---|---|---|
| Level 0 | Basic | 3 | Very low | Cyber Essentials | Def Stan 05-138 Issue 4, clause 2.2 and Table 1 (opens in a new tab) |
| Level 1 | Foundational | 101 | Low to moderate | Cyber Essentials | Def Stan 05-138 Issue 4, clause 2.2 and Table 1 (opens in a new tab) |
| Level 2 | Advanced | 139 | High | Cyber Essentials Plus | Def Stan 05-138 Issue 4, clause 2.2 and Table 1 (opens in a new tab) |
| Level 3 | Expert | 144 | Substantial | Cyber Essentials Plus | Def Stan 05-138 Issue 4, clause 2.2 and Table 1 (opens in a new tab) |
Every level starts with Cyber Essentials. Cyber Essentials Plus is required at Level 2 and Level 3 (IASME DCC page (opens in a new tab)). For the base scheme, see Cyber Essentials for MSPs.
Level 0 is three controls: Cyber Essentials covering the contract scope, UK GDPR compliance, and resilient networks and systems. Control wording is Crown copyright, so this page summarises and links rather than reproducing it.
DCC, Def Stan 05-138, CSMv4, DEFCON 658 and the SAQ
- Def Stan 05-138 Issue 4 sets the controls. ISN 2026/01 (30 March 2026) is a covering-text update and scope clarification for it. It says compliance is further assured through certification to the matching DCC level (ISN 2026/01 (opens in a new tab)).
- DEFCON 658 is the contract condition that flows the requirement down. ISN 2026/02 (30 March 2026) tells MOD buyers to treat a current DCC certificate at the required level or higher as satisfying the Def Stan 05-138 control requirement under DEFCON 658 (ISN 2026/02 (opens in a new tab)). The public gov.uk copy of DEFCON 658 is Edition 10/17 12/22, and ISN 2026/01 refers to an update that is not publicly visible (DEFCON 658 on gov.uk (opens in a new tab)).
- CSMv4 and the Cyber Risk Profile. The Cyber Security Model (CSM) is MOD's risk tooling, and CSMv4 went live on 27 October 2025. From 3 December 2025 new risk assessments and Supplier Assurance Questionnaires (SAQs) must use the gov.uk tooling, and, for existing contracts containing DEFCON 658, the annual SAQ review on the contract anniversary was reinstated (ISN 2025/07 (opens in a new tab)). The old Cyber Risk Profiles, Very Low to High, are not consistent with CSMv4, so this page does not map them to the new levels (CSM guidance (opens in a new tab)).
- Cyber Improvement Plan (CIP). A supplier that cannot yet comply must submit a CIP setting out when it will reach the required level (CSM guidance (opens in a new tab)).
Open question: does a DCC holder still complete the SAQ?
Public guidance does not give one answer. The CSM guidance (6 March 2026) says suppliers with a valid DCC certificate are not yet exempt from completing elements of the SAQ. ISN 2026/02 (30 March 2026) tells buyers to accept DCC as satisfying the control requirement. The NCSC's 2026 annual review (3 November 2026) says DCC puts independent assurance in place of reliance on supplier self-attestation (NCSC annual review 2026 (opens in a new tab)).
Until the MOD says otherwise, treat it as open and ask your buyer or CyDR ([email protected]) which SAQ elements apply to your contract.
Timeline: What Has Been Asked, and What Is Required
- May 2025: DCC launches (ISN 2026/02 (opens in a new tab)).
- 27 October 2025: CSMv4 goes live. 3 December 2025: CSMv4 tooling becomes mandatory for new risk assessments and SAQs (CSM guidance (opens in a new tab)).
- 30 March 2026: ISN 2026/01 (Def Stan 05-138 scope clarification) and ISN 2026/02 (DCC accepted under DEFCON 658) are issued.
- By 8 May 2026 the MOD's Director of Cyber Defence & Risk had asked all industry partners to achieve Level 0 DCC certification by 31 December 2026, including Cyber Essentials for applicable business-critical systems in scope (MOD Defence Digital blog (opens in a new tab)).
That 31 December 2026 date is a request, not by itself a contract clause. The same post says higher levels required lower in the supply chain should be scheduled for after that date. The MOD also anticipates that Level 0 will become a baseline requirement for defence suppliers, and says suppliers should expect an increasing requirement to hold DCC (ISN 2026/01, Annex A (opens in a new tab); CSM guidance (opens in a new tab)). What binds a given supplier is its own contract.
How Certification Works
- Who delivers it. IASME is the Certification Authority and the MOD's certification partner. It delivers DCC through a network of assured Certification Bodies (CBs) whose assessors are qualified for all levels (MOD Defence Digital blog (opens in a new tab); IASME (opens in a new tab)). No figure for the number of CBs or certificates is published.
- Scope is one legal entity. Certification applies only to the entity undergoing assessment, and does not extend across a corporate group unless approved via the certification authority (ISN 2026/01, Annex A (opens in a new tab)). A supplier on several contracts needs the highest applicable level.
- Evidence. Each control needs a documented and implemented control with auditable evidence. Where a control may not reasonably apply, raise it with the certifying body, which can determine a proportionate interpretation (ISN 2026/01, Annex A (opens in a new tab)).
- Validity. Certification is supported by annual attestation, with full recertification every three years (MOD Defence Digital blog (opens in a new tab)). Applicants can apply at any level and at any time.
- Scoping takes the time. RightCue, an IASME certifying body, interviewed on the MOD Defence Digital blog on 24 September 2026, describes scoping as the most common cause of delays and says Levels 1 to 3 can involve site visits and security-cleared personnel (MOD Defence Digital blog, 24 September 2026 (opens in a new tab)).
If You Advise Defence Suppliers
- Confirm the level before the work. Ask the client for the Cyber Risk Profile level and risk assessment reference (RAR) on the contract. A CSM risk assessment generates the RAR (CSM guidance (opens in a new tab)).
- Scope early. Decide which legal entity and which systems are in scope first. One certifying body reports scoping is where delays tend to start (MOD Defence Digital blog, 24 September 2026 (opens in a new tab)).
- Plan Cyber Essentials first. It is the entry point at every level, and Level 0 asks for it across business-critical systems in scope.
- Use the CIP for gaps. Where a client cannot yet comply, a Cyber Improvement Plan is the contractual route (CSM guidance (opens in a new tab)).
- Two roles, kept separate. Advising on controls and assessing against them are different roles. Before you offer both, check IASME's own DCC guidance on whether one firm can do both for the same client. According to one certifying body, to become a DCC certifying body a firm must first be an IASME Cyber Essentials certification body, and its assessors need IASME qualifications plus DCC training for each level (MOD Defence Digital blog, 24 September 2026 (opens in a new tab)).
What DCC Is Not
- DCC does not replace Def Stan 05-138. It assures compliance with Issue 4 of the standard, and it does not replace the SAQ or DEFCON 658 either; see the open question above.
- DCC is not mandatory for all MOD suppliers. The MOD may require it through procurement, and 31 December 2026 is a request.
- Level 0 is not self-assessed. It is an independent, point-in-time assessment like the other levels.
- Level 1 does not require Cyber Essentials Plus. Plus applies at Levels 2 and 3, and there are four levels in all.
- ISO 27001, NIST SP 800-171 and CMMC are not equivalent to DCC, and this page does not claim any mutual recognition.
- One certificate does not cover a whole corporate group unless approved via the certification authority.
Sources: ISN 2026/01 (opens in a new tab), ISN 2026/02 (opens in a new tab), CSM guidance (opens in a new tab).
Where GetCybr fits
Everything above is scheme knowledge you can use without GetCybr. GetCybr does not currently include a Def Stan 05-138 or DCC framework, and DCC certification itself is carried out by an IASME certification body, not by software.
Custom frameworks are included for every account, so a practice that wants to track the controls it is assessed against, with owners and evidence, can set them up as its own framework. See the full compliance frameworks list for what is built in.
Sources
Last reviewed . Sources accessed 6 November 2026. This scheme's guidance has changed several times in the past year, so check the source before you rely on a detail. This page is general information, not legal or contract advice.
- Cyber Security Model, gov.uk (updated 6 March 2026) (opens in a new tab)
- Def Stan 05-138 Issue 4, Cyber Security for Defence Suppliers (14 May 2024, Crown copyright) (opens in a new tab)
- ISN 2025/07, Implementation of CSM v4 (26 November 2025) (opens in a new tab)
- ISN 2026/01, Update to Def Stan 05-138 Issue 4 and CSM scope clarification (30 March 2026) (opens in a new tab)
- ISN 2026/02, Use of DCC as assurance under DEFCON 658 (30 March 2026) (opens in a new tab)
- DEFCON 658 Cyber Flow Down, gov.uk (Edition 10/17 12/22) (opens in a new tab)
- One year of Defence Cyber Certification, MOD Defence Digital blog (8 May 2026) (opens in a new tab)
- Spotlight on a DCC certifying body, MOD Defence Digital blog (24 September 2026) (opens in a new tab)
- NCSC Annual Review 2026 (3 November 2026) (opens in a new tab)
- Defence Cyber Protection Partnership, gov.uk (opens in a new tab)
- IASME, Defence Cyber Certification (opens in a new tab)
Advising Defence Suppliers?
Talk to us about running a multi-client compliance practice, including custom frameworks for the standards your clients are assessed against.