Defence Cyber Certificate (DCC)
The new MoD Defence Cyber Certificate is now with us and gaining momentum currently.
Subsequently, the MoD has now stated that compliance to DCC level 0 is now required by the end of the year.
Defence Cyber Certification (DCC) is reshaping cyber assurance expectations across the UK defence supply chain. Achieving certification strengthens buyer confidence and protects contract eligibility. This demonstrates that your cyber controls are governed and operating effectively, not just documented.
Defence Cyber Certification (DCC) is the Ministry of Defence cyber assurance framework.
Therefore, It replaces historic self-assessment models with independent certification aligned to contract cyber risk. Nevertheless, the emphasis now sits on demonstrable control effectiveness, governance, and ongoing assurance rather than declared compliance.
DCC is structured across four certification levels, each determined by contract risk. This is known as the Cyber Risk Profile. It takes into account information sensitivity, and operational dependency. Accordingly, levels align to relevant controls within Defence Standard 05-138. These increase with expectations for assurance depth and evidential maturity.
Assessment focuses on how cyber controls operate in practice. This includes technical configuration, governance oversight, risk management and recording as well as incident response capability.
For suppliers, DCC represents a shift from compliance activity to defensible operational assurance.
Fortis Defence Cyber Certification Service
Defence Cyber Certification demands clarity of scope, assurance depth, and defensible evidence.
Forts DPC provides structured, expert-led support across the certification journey, from early applicability assessment through to independent evaluation. We will work with you collaboratively.
Our approach reflects practical Defence assurance experience, aligning preparation with how assessors evaluate operational capability and control effectiveness.
- Applicability & Scope Assessment – Gain clarity on whether DCC applies, identify the likely certification level, and define assessment boundaries with confidence.
- Readiness Evaluation – Understand how existing controls, governance, and assurance maturity align with DCC expectations.
- Evidence Development – Develop coherent, assessment-ready evidence that clearly demonstrates operational effectiveness.
- Independent Certification – Approved Leve 0 and Level 1 Certification Body delivering independent DCC assessments.
- Ongoing Assurance – Maintain certification confidence through annual assurance activities and evolving Defence cyber requirements.
DCC Level 0 Certification
Firstly, DCC Level 0 has three controls. The first is Cyber Essentials so you will need a vlid certificate. You will need to keep your Cyber Essentials valid for three years. Following on is your GDPR compliance. We will examine your documentation and implementation of the regulation. Finally, we will look at your network controls.
DCC Level 1 Certification
DCC Level 1 has 101 controls. Hence, there are way too many to list here. We examine these using a document entitled the Applicant Submission Record (ASR) which contains 4 objectives to bring you to the required standard. This is not a quick process but if properly planned, certification can be achieved with minimal disruption to your business.
Get Certified Now
Basically, the journey to Level 0 is a simple one. Please visit our quote site below and receive a quote. We will be in touch 30 within 30 minutes to discuss your exact needs and agree timescales.
The journey to Level 1 begins in much the same way, by asking us for a quote. Alternatively you can get in touch at hi@fortis-dpc.com or book a call with our lead assessor Howard Freeman, here.
However, there are strict rules surrounding the preparation to Levels 1-3.
With Cyber Essentials, many businesses leave certification to their MSP or IT Provider. This means that these providers are marking their own homework. However, this is not an acceptable solution to the Ministry of Defence. Therefore, DCC Levels 1-3 demands that those involved in preparation for certification cannot assess you. You must use an independent assessor.
We can help you with a Gap Analysis but will not help you with any remediation work. Once this work has been carried out, we can begin your formal assessment.
You can access your personalised quote here
You can contact Fortis DPC on 03333 22 1011 and yes, our calls our answered by human beings.
Alternatively, please email us at hi@fortis-dpc.com.
Thanks for reading.
0 Comments