Defence Cyber Certification (DCC): a guide for UK suppliers

What DCC is

Defence Cyber Certification is an MOD scheme, developed with industry and IASME, for independently evidencing compliance with the Cyber Security Model. It has four levels, 0 to 3, and launched in May 2025. Certification is subject to annual attestation and recertification every three years. Every level starts with Cyber Essentials, and Levels 2 and 3 also need Cyber Essentials Plus.

Under Industry Security Notice 2026/02, dated 30 March 2026, a valid DCC certificate at the required level or higher should be accepted as evidence that the matching Def Stan 05-138 controls are met under DEFCON 658. Holding DCC does not yet remove the need to complete the full Supplier Assurance Questionnaire.

How to find which level applies

Your contract's Cyber Risk Profile sets the level. DCC Levels 0 to 3 match Cyber Risk Profile Levels 0 to 3, and a higher DCC level covers all lower ones. The MOD authority usually states the profile in the invitation to tender. If you are a subcontractor, ask the company above you which level your subcontract carries. How the four profiles work.

Readiness and certification are different things

Readiness work checks your controls and evidence against the requirements for your level and closes the gaps. Certification is carried out by a Certification Body within IASME's assured network. Goldline provides readiness support only. We do not certify, we do not assess for IASME, and we never audit work we have implemented.

Frequently asked questions