DCC Level 0 by 31 December: What MoD Suppliers Need to Know

If your business supplies the Ministry of Defence, there is a cybersecurity deadline worth having on your radar before the end of the year. The MoD has asked its industry partners to achieve Level 0 of Defence Cyber Certification (DCC) by 31 December 2026, and with only a couple of months to go, now is a sensible time to check where you stand, while you still have plenty of time to sort anything out.

Level 0 is the entry point to the scheme, so for many suppliers the requirements will be manageable. We often see businesses get caught out by assuming an existing Cyber Essentials certificate covers everything, because the scope of DCC can differ from your current certification, and finding that out late in the process can leave you with more work than you expected.

How DCC works

The MoD and IASME developed Defence Cyber Certification to give businesses in the defence supply chain a consistent way to show they meet the cyber security requirements associated with their work. The scheme has four levels, from Level 0 to Level 3, and a supplier's required level depends on the risk attached to the work and information involved. Level 0 is the baseline the MoD is asking all suppliers to reach, with three controls focused on basic cyber security practices, while the higher levels add more demanding requirements, including Cyber Essentials Plus at Levels 2 and 3.

Cyber Essentials sits at the foundation of every level, which is where scope becomes important. DCC takes a broader view of your organisation than Cyber Essentials does, and any internet-connected systems that fall within your DCC scope need to be covered by Cyber Essentials. If you only do one thing this week, work out which systems actually support your MoD work, because that tells you what needs to be assessed and whether your current certificate covers the right things.

Once you are certified, there are two cycles to keep track of. Cyber Essentials renews every year, while DCC lasts three years, with an annual attestation to confirm the controls are still in place and your scope hasn't changed significantly.

Bringing your subcontractors with you

Your own certification is only part of the work if other businesses help you deliver MoD contracts. The MoD has also asked suppliers to set appropriate timescales for their subcontractors, so their position may affect your plans as much as your own does. A quick conversation now gives everyone time to understand what is needed and avoids a situation where a subcontractor’s certification ends up holding up your arrangements.

Leaving time to address any gaps

Even when requirements are straightforward, certification still takes preparation. You may need to review device configurations and user permissions, confirm that software updates are being installed, make sure multi-factor authentication is switched on where it is required, and if something turns out to be missing, you will need time to put it right. As anyone who has tried to get IT work done in December will know, the run-up to Christmas is rarely the easiest time, so understanding your scope now gives you far more room to breathe.

As a Certification Body for Defence Cyber Certification, we’re always happy to help suppliers work out the right scope and take them through certification step by step. If you would like to check whether your existing Cyber Essentials certification covers the systems you need, get in touch with the Fleko team, and we can talk through your next steps.