The MoD has asked for DCC Level 0 by 31 December 2026. Here is what to do first.
The MoD has asked its defence industry partners to reach Defence Cyber Certification Level 0 by 31 December 2026. We get your evidence in order so an independent certification body can assess you.
Goldline prepares organisations for DCC. It does not certify them. An approved certification body does that.
Reviewed by Alfred Obeng on . Sources re-read that day: Defence Digital, the DCC Applicant Guide and Scoping Guide.
- A free 45 minute diagnostic, not a sales call
- Your scope agreed before any evidence work starts
- A written readiness plan with owners and dates
- Run by a senior practitioner, not a coordinator
Book the free 45 minute diagnostic
Pick a time that suits you. Bring the prime's email, the contract clause or your Cyber Essentials certificate.
Choose a timeCISSP, Project Management Professional (PMP)®, ISO/IEC 27001 Senior Lead Implementer and Lead Auditor, ISO/IEC 42001 Lead Implementer and Lead Auditor.
The three Level 0 controls
Level 0 has three controls. The DCC Applicant Guide lists them as 0001 (Cyber Essentials), 2314 (UK GDPR) and 2500 (resilience). Each question is answered Yes or No and needs evidence.
The step before the controls: scope
DCC scope is the whole organisation's essential services and functions: the legal entity that delivers to the MoD, with everything it needs to operate in a secure and resilient way. If the scope is too narrow you can fail certification even when every control is met. Your Cyber Essentials scope must also overlap with your DCC scope. If it does not, that is a failure.
If every box is ticked, the groundwork is done. Any open box is work still to do. This checklist is a self-check. It is not an assessment, and it does not predict a certification outcome.
Sources, read on 20 October 2026: Defence Digital blog posts of 8 May and 13 July 2026; DCC Applicant Guide version 2.2; DCC Scoping Guide V1.3.
How Goldline helps
Free 45 minute diagnostic
We agree your scope and establish where you stand against the three Level 0 controls.
Written readiness plan
Every gap written up as an action, with an owner and a date against it.
Producing what is missing
The GDPR policies and procedures, the data protection impact assessments and the resilience assessment.
Pre-submission check
A last read of the evidence pack before it goes to the certification body.
Goldline prepares you. An independent approved certification body assesses and certifies, so nobody marks their own work. If a prime asks how your certificate was earned, that answer holds.
What comes next
Level 1 is the next step for suppliers handling sensitive information. It carries 101 controls, assessed objective by objective, and it builds on the same foundation you put in place for Level 0.
For suppliers heading further, read the ISO 27001 overview.
The diagnostic is free
| Service | Fee |
|---|---|
| DCC Requirement and Scope Review | From £1,950 plus VAT |
| DCC Level 1 Readiness Diagnostic | From £4,500 plus VAT |
| DCC Level 0 Readiness Diagnostic | Scoped on the diagnostic |
| Cyber Essentials readiness, up to 10 peopleThe certification body's fee is passed through at its published rate, nothing added. | £595 plus VAT |
Certification body fees are separate and paid to the body. Every Goldline fee is on the pricing page.
Defence suppliers: Level 0 includes Cyber Essentials.
Further reading: DEFCON 658 explained and DEF STAN 05-138 risk profiling explained.