DCC Readiness Services for Advisories and MSPs

Defence suppliers are starting to ask their advisers about Defence Cyber Certification (DCC). A consultancy, advisory or MSP that already serves them can turn those questions into a structured readiness service. This guide explains how to scope and deliver one. It is written for the adviser, not the supplier, and it stays useful whichever tools you use.

Last reviewed 6 November 2026. The scheme guidance is still evolving, so check each linked source before you rely on it.

For the scheme itself, start with our Defence Cyber Certification guide. For the standard and the contract condition behind it, see What is Def Stan 05-138? and What is DEFCON 658?.

Why demand is rising

The Ministry of Defence (MOD) has asked, not ordered, suppliers to move. In a blog published on 8 May 2026, Eleanor Fairford, Director of Cyber Defence & Risk, wrote that she had asked industry partners to achieve Level 0 DCC certification by 31 December 2026. The same post says higher levels lower in the supply chain should be scheduled for delivery after 31 December 2026 (Defence Digital blog, 8 May 2026).

That is a request from the MOD to industry partners, so word it that way to clients. It is a request, not a contract clause. Individual tenders may still specify DCC as a condition (Cyber Security Model guidance). The Cyber Security Model guidance on gov.uk is more general: suppliers should expect to see an increasing requirement to hold valid DCC certification for the duration of their contract with the MOD (Cyber Security Model guidance, last updated 6 March 2026).

MOD guidance also says certification may be obtained whether or not an organisation is currently on a UK defence contract, which is why prospects can appear before a contract asks for it (ISN 2026/01).

DCC does not replace Def Stan 05-138. It is the certification route used to assure compliance with Issue 4 of that standard, and MOD buyers have been told to treat a current certificate at the required level or higher as satisfying the control requirement under DEFCON 658 (ISN 2026/02).

One question remains open in public guidance. The gov.uk page says suppliers with a valid DCC certificate are not yet exempt from completing elements of the Supplier Cyber Protection Service self-assessment questionnaire (SAQ), while ISN 2026/02 tells buyers to accept DCC. The NCSC describes DCC as replacing reliance on supplier self-attestation with independent assurance (NCSC Annual Review 2026). Do not promise a client that DCC removes the SAQ. Ask the MOD team named on the gov.uk page.

Scoping is the main delay

In a 24 September 2026 interview on the MOD’s Defence Digital blog, the certification body RightCue says scoping is the single biggest challenge for applicants and the most common cause of delays (Defence Digital blog, 24 September 2026). That makes scoping the natural first paid step in a readiness service.

A scoping workshop should settle four things before any control work starts:

1. Which level the client needs. The level comes from the Cyber Security Model risk assessment for the contract, not from the supplier’s own view of its risk. The Risk Assessment generates a Risk Assessment Reference (RAR) (Cyber Security Model guidance). ISN 2026/01 Annex A says the assigned level sets the minimum controls, not the supplier’s own risk assessment (ISN 2026/01).
2. Which legal entity is certified. See the next section.
3. Which systems and sites are in scope. RightCue’s interview also notes that Levels 1 to 3 may involve site visits and security-cleared personnel, so ask early about cleared staff and physical locations.
4. Which Cyber Essentials certificate is needed. Every level begins with Cyber Essentials, and Levels 2 and 3 also need Cyber Essentials Plus (IASME DCC page).

Where a control may not reasonably apply to the client, ISN 2026/01 says to raise it with the DCC certification body, which can decide a proportionate interpretation (ISN 2026/01). Record that conversation in the scoping file.

Entity scope and the highest applicable level

Certification applies only to the entity undergoing assessment. It does not automatically extend across a corporate group unless a group-level arrangement is explicitly justified and approved via the DCC certification authority (ISN 2026/01). For a client with several subsidiaries, list which entity signs each defence contract and certify those entities first.

A supplier on several contracts needs the highest applicable level across them, and a higher-level certificate is deemed to satisfy the lower levels. A client with one Level 2 contract and one Level 1 contract therefore plans for Level 2 (ISN 2026/01).

The four levels follow Def Stan 05-138 Issue 4. Level 0 (Basic) has 3 controls, Level 1 (Foundational) has 101, Level 2 (Advanced) has 139 and Level 3 (Expert) has 144 (IASME DCC page; Def Stan 05-138 Issue 4). The standard is Crown copyright, so link to it and paraphrase rather than copy control text into client deliverables.

Evidence expectations

ISN 2026/01 Annex A expects each control to be supported by a documented and implemented control with auditable evidence (ISN 2026/01). IASME describes the assessment as a point-in-time assessment against a UK defence standard in which applicants describe how they meet each control and provide evidence (IASME DCC page).

For a readiness service, that suggests an evidence pack per control with three parts:

• a short statement of how the control is met in this entity,
• the policy or procedure that documents it,
• dated proof that it is implemented, such as a configuration export, a log extract or a signed record.

Certification lasts three years, with an annual attestation in between (Defence Digital blog, 8 May 2026). Evidence collected once and left to age will not serve the attestation, so a readiness service should include a calendar for refreshing it.

Cyber Improvement Plans for gaps

Not every client will be ready on day one. The Cyber Security Model guidance says suppliers who cannot comply must submit a Cyber Improvement Plan (CIP) detailing when they will meet the required level of compliance (Cyber Security Model guidance). ISN 2026/01 also describes a contractual mechanism, the CIP, for suppliers that are not yet certified.

A CIP is therefore a deliverable you can write with the client: the gaps found in scoping, an owner and a date for each, and the target level. Keep it factual. It is a plan the client submits to the MOD, so avoid dates the client cannot meet.

Two roles: implementation consultancy and certification body

A firm that helps a client reach the standard and a firm that assesses the client against it do different jobs. Treat them as two roles, even if your business could do both.

• Implementation consultancy. Scopes, writes policy, configures controls, builds the evidence pack and prepares the client for assessment.
• Certification body (CB). Carries out the independent assessment and, if the client meets the controls, certifies it. IASME describes delivery as running through its network of assured Certification Bodies (IASME DCC page).

Whether a certification body may also consult for the client it assesses is a question for the scheme rules. We have not verified IASME’s wording on this, so check IASME’s DCC FAQ for the rules on a certification body also consulting, and put the answer in writing before you quote for both roles on the same client.

Becoming a certification body

The 24 September 2026 interview on the MOD’s Defence Digital blog sets out the route in outline. A firm first needs to be an IASME Cyber Essentials Certification Body. The organisation and its assessors must be based in the UK or the Crown Dependencies. Assessors must meet IASME’s qualification requirements and complete DCC training and assessments for each level they plan to deliver, and IASME then licenses the organisation for those levels (Defence Digital blog, 24 September 2026).

Plan for capacity as well as qualifications. The same interview says Levels 1 to 3 may need site visits, security-cleared personnel and more evidence review. No public figure exists for how many certification bodies or certificates there are, so do not size a market from one.

Packaging the service

Define the offer in stages so clients can buy the part they need:

1. Scoping and level confirmation: the workshop above, ending in a written scope and a target level.
2. Gap review: each control compared with what exists, producing the CIP.
3. Remediation support: policy writing, control configuration and evidence collection.
4. Assessment preparation: a dry run of the evidence pack before the client books a certification body.
5. Annual attestation support: the yearly refresh between three-year recertifications (Defence Digital blog, 8 May 2026).

Check you have the people for the level before you quote. Levels 1 to 3 may need site visits and security-cleared staff (RightCue interview, 24 September 2026), so confirm who can do that work and where. If you cannot staff a level, refer the work to a firm that can rather than stretching a team.

We do not suggest prices here. Fees are for you to set against your own costs, and no official source gives a standard fee for readiness work.

Where GetCybr fits

GetCybr is a platform for MSPs, MSSPs and vCISO practices to manage compliance work across many clients. It does not currently include a built-in or native Defence Cyber Certification or Def Stan 05-138 framework, so it will not generate a DCC evidence pack for you.

What it does include for every account is Custom frameworks. A practice can therefore track its own paraphrased Def Stan 05-138 control list as a custom framework and keep each client’s evidence in one place. That is a way of organising your own work, not a certification, and the assessment still sits with an IASME certification body. See our frameworks hub for the frameworks the platform covers today.