If a prime has asked you for Defence Cyber Certification (DCC) Level 0, the first decision is where the boundary goes, before any control. IASME's Scoping Guide is blunt about why: "failure to adequately and accurately define the scope (e.g. under scoping) will result in a failure to achieve certification, even if all required controls have been met."
This page explains what DCC scope covers, what you can leave out, how it fits with your Cyber Essentials scope, and the worksheet we use to settle it before anyone answers a question.
The date, and what it is
The MoD's Director of Cyber Defence and Risk has asked all defence industry partners to achieve DCC Level 0 by 31 December 2026. In her words, published on the Defence Digital blog on 8 May 2026: "I have also recently asked all industry partners to achieve Level 0 DCC certification by 31st December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope."
The MoD is asking as a customer. IASME's own FAQ says "DCC is currently not mandatory" and that applicants "may still tender for MOD contracts via the normal MOD process". The level a particular contract needs "will be decided by the MOD or your Prime."
Scope is the whole organisation, minus what isn't essential
DCC is built on Def Stan 05-138 Issue 4, and the scope moved with it. IASME's FAQ puts the change plainly: Issue 3 "primarily focused on the protection of MOD Identifiable Information", while Issue 4 takes "a broader approach, emphasising overall organisational security and resilience."
So the starting point is your organisation, not your MoD contract. IASME's FAQ answers it directly:
"Can I only include the networks that handle the MOD contract or sensitive data? No, the scope is your whole organisation and the services/functions essential for it to operate, whether these functions are for MOD or non-MOD contracts."
Whole organisation doesn't mean every room. The Scoping Guide says "only the essential services and functions necessary to maintain the organisation's operations are in scope", and gives examples: HR, IT and stock management "are likely to be in scope, whereas non-essential areas like cafeterias or vending machines typically are not".
It also names systems that are easy to forget because nobody thinks of them as IT: payroll, building entry, industrial control systems and operational technology, order and stock management, and heating, ventilation and environmental controls.
The test for "essential"
IASME's test is practical. If you're unsure about a system, "consider the potential impact of a particular system or function being unavailable for a day, a week, a month, or longer." If the business couldn't carry on without it, it's in.
The Guide suggests five areas to walk through when you draw the boundary:
- Tools and technology, "whether connected to the internet or not".
- Operations and logistics: the processes and systems that deliver your products and services.
- Administrative functions: internal management and operations.
- Operational locations: every physical site you work from.
- People with access: staff, visitors and third parties.
It recommends a method such as the GovAssure Five Lens approach, and says that method "is not mandatory".
What the scope must include, and what it can't avoid
Five points in the FAQ and the Guide are worth reading closely:
- Cloud services: "If a cloud service is essential to your organisation, then it must be in scope."
- Suppliers and managed service providers: your scope includes "the policies and processes you use to manage and oversee your suppliers", and any control met by a third party "must still be shown as met and evidence may be required from the third party."
- Group companies: if a parent provides you with services, either the parent comes into scope or its service is treated as an external supplier service.
- Operational technology: if OT is essential, it's in. The Guide accepts that some controls can't be applied to, say, a CNC machine, and the Assessor can take compensating controls into account. A machine used only occasionally for non-essential work may be excluded.
- Every level: "The scope must remain the same across all levels." Scoping for Level 0 is the same exercise you'd do for Level 2.
How it fits with your Cyber Essentials scope
Cyber Essentials covers internet-connected networks and systems. DCC covers more. The FAQ's rule is: "Any internet connected devices/networks that are within the DCC scope must be covered by Cyber Essentials/Cyber Essentials Plus". The Assessor reviews both scopes to check they line up.
That's where the two scopes can drift apart. A Cyber Essentials certificate scoped to the office network is a good start, but if your DCC scope includes a workshop network the certificate doesn't cover, the two won't align.
What you hand the Assessor
The Scoping Guide lists what a scoping statement must contain:
- the systems, services and functions in scope and out of scope for DCC;
- the same list for Cyber Essentials or Cyber Essentials Plus;
- diagrams showing both, and how they overlap;
- a list of sites and what each one does.
The Assessor "may challenge aspects of your scope". The Guide also recommends that your CEO or CISO, or an equivalent official, is aware of the proposed scope.
A Goldline worksheet for the scope decision
This is the table we fill in with you on a DCC scope review, before anyone opens the question set. One row per function, six columns:
| Function | Systems it runs on | Out for a day, a week, a month: can you trade? | In DCC scope? | In Cyber Essentials scope? | Evidence the Assessor will ask for |
|---|---|---|---|---|---|
| Payroll | (your payroll system) | ||||
| Building entry | (door control) | ||||
| Production | (CNC, OT) |
Two rules make it work. Every "no" in the scope column carries one written reason, because that reason is what the Assessor will challenge. And any row that's in DCC scope and internet connected but missing from Cyber Essentials scope goes to the top of the fix list.
We applied the same whole-organisation thinking to our own certificate: Goldline's Cyber Essentials Plus, certified on 13 October 2026, covers the whole organisation.
What Goldline does, and who certifies
Goldline prepares you for DCC: the scope review, the gap list and the evidence. Goldline is not licensed for DCC and doesn't assess or certify it. An IASME Certification Body licensed for DCC carries out the assessment and certification. IASME describes its Certification Bodies as "licensed and assured by IASME to offer assessment and certification to cyber security standards such as Cyber Essentials and Defence Cyber Certification."
IASME keeps those roles apart too. Its FAQ says a Certification Body can help identify gaps, but "if they are also acting as your DCC Assessor, they cannot be involved in implementing or managing your security defences."
The DCC Requirement and Scope Review starts from £1,950 plus VAT and is credited in full against a Sprint started within six months. The DCC Level 0 Readiness Diagnostic is scoped on the free 45 minute diagnostic.
What this page doesn't settle
The Scoping Guide is guidance, and the final word on your scope is the Assessor's. Phrases such as "likely to be in scope" are IASME's own hedges, so treat the examples as prompts, not a list to copy. Nothing here tells you which DCC level a contract needs: that comes from the MoD or your prime. And because DCC is not mandatory, IASME says applicants may still tender through the normal MOD process, though a prime may set its own terms.
Questions
Sources
- Defence Digital blog, "One Year of Defence Cyber Certification", 8 May 2026: https://defencedigital.blog.gov.uk/2026/05/08/one-year-of-defence-cyber-certification-building-stronger-cyber-resilience-together/ (read 28 October 2026)
- IASME, Defence Cyber Certification, Frequently Asked Questions: https://iasme.co.uk/defence-cyber-certification/frequently-asked-questions/ (read 28 October 2026)
- IASME, DCC Scoping Guide v1.3: https://iasme.co.uk/defence-cyber-certification/DCC-Scoping-Guidance.pdf (read 28 October 2026)
- IASME, DCC Help and Resources: https://iasme.co.uk/defence-cyber-certification/help-resources/ (read 28 October 2026)
- Goldline published prices: /pricing (read 28 October 2026)