The Complete Guide to Defence Cyber Certification (DCC)

How White Hawk Solutions Helps Suppliers Navigate MOD Compliance Across the Supply Chain

If your business is part of the UK Ministry of Defence supply chain, or you are actively bidding for defence contracts, understanding Defence Cyber Certification is becoming essential.

DCC is designed to provide an organisation-wide security baseline across the defence supply chain, helping suppliers demonstrate that appropriate cyber controls are in place before they enter or continue through procurement.

The framework has been developed by the MOD and is delivered in partnership with IASME.

Under direction from the MOD’s Cyber Defence & Risk leadership, Level 0 Defence Cyber Certification has been established as the baseline standard for defence industry suppliers, with a target date of 31 December 2026.

For businesses already supplying the MOD, or planning to, that makes DCC more than a technical exercise.

It is increasingly part of remaining commercially ready for defence work.

At White Hawk Solutions, we work with Prime MOD contractors and SMEs to help them understand the requirements, prepare the right evidence and work through certification without unnecessary disruption.

What Is Defence Cyber Certification?

Defence Cyber Certification replaces fragmented, contract-by-contract checks under previous versions of the Cyber Security Model with a single, independently verified certification that can be used across multiple MOD procurements.

The aim is to create a clearer, more consistent standard across the defence supply chain.

What DCC Helps Suppliers Achieve

Tender and procurement readiness

DCC helps remove compliance barriers during bidding and supports continued eligibility for MOD framework opportunities.

Proportionate security

The required level of certification reflects the Cyber Risk Profile of the contracts you work on, helping avoid unnecessary controls and over-engineering.

Commercial efficiency

A single organisation-wide certification, dependent on the agreed scope at assessment, can support multiple defence procurements over a three-year certification cycle.

This reduces the need to repeat the same assurance work contract by contract.

The Four DCC Certification Levels

Under Def Stan 05-138 Issue 4, contracts are assigned a Cyber Risk Profile which determines the required level of Defence Cyber Certification.

Level 0: Very Low Risk

Level 0 is the baseline entry point for suppliers with minimal cyber exposure.

It requires active Cyber Essentials certification together with baseline governance, UK GDPR alignment and system resilience.

Level 1: Low to Moderate Risk

Level 1 introduces a broader set of practical security controls.

It includes 101 controls and builds on standard Cyber Essentials.

Level 2: High Risk

Level 2 applies to suppliers handling sensitive data or operating more integrated IT environments.

It requires Cyber Essentials Plus, includes 139 controls, and introduces more advanced technical oversight and site verification.

Level 3: Substantial Risk

Level 3 is the highest assurance tier.

It includes 144 controls and requires a higher level of security maturity, automation and alignment with Def Stan 05-138.

Why Level 0 Matters to Every Defence Supplier

While Levels 1 to 3 are linked to higher-risk contract profiles, Level 0 establishes the baseline across the UK defence supply chain.

Eleanor Fairford, Director of Cyber Defence & Risk at the Ministry of Defence, set out the expectation for industry partners:

“The DCC is a badge of excellence in cyber resilience for all Defence industry partners. Assured cyber resilience across suppliers will help UK Defence rise to the challenge of the escalating cyber threat.

I have also recently asked all industry partners to achieve Level 0 DCC certification by 31st December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope.

To support this transition, suppliers must be encouraged to work towards this objective and to ensure that any subcontractor timescales are set appropriately; where higher levels of certification are required at lower tiers in the supply chain, these should be scheduled for delivery after 31 December 2026.”

The important point is that DCC does not only affect Prime contractors.

Requirements can flow down through the supply chain, which means subcontractors and smaller suppliers also need to understand what is expected of them.

What Is Required for DCC Level 0?

DCC Level 0 builds directly on Cyber Essentials and creates a broader baseline across technical security, data protection and operational resilience.

To achieve Level 0 through an assured IASME Certification Body, an organisation needs to address three core areas.

1. Active Cyber Essentials Certification

Cyber Essentials is the mandatory technical prerequisite.

It must cover all applicable business-critical systems within the scope of the organisation’s defence operations.

2. UK GDPR Alignment

Organisations must demonstrate documented policies and working practices that align with UK GDPR and the Data Protection Act 2018.

This includes how personal and sensitive data is handled, stored and protected, together with measures such as Data Protection Impact Assessments and clear data handling policies where appropriate.

3. Resilient Networks and Systems

Suppliers must also demonstrate that resilience and continuity are built into the design, operation and maintenance of systems supporting the business.

The objective is to help protect operations and data against system failure, disruption or cyber incidents.

Moving Beyond Level 0

For many suppliers, Level 0 will be the immediate priority.

But businesses operating in defence IT, secure SaaS or mission-critical engineering may need Level 1 certification or above to meet the requirements of higher-risk contracts.

Moving into these higher levels brings significantly more control mapping, evidence preparation, policy alignment and operational work.

That is where the process becomes much more involved.

How White Hawk Solutions Supports Higher-Level DCC

White Hawk Solutions can manage the journey from initial scoping through to independent assessment.

Gap Analysis and Scoping

We review your current environment against the relevant Def Stan 05-138 controls and identify the specific areas that need attention.

Hands-On Implementation

As your Security Coach, we help lead the technical and process remediation work, embedding the required controls, policies and working practices into day-to-day operations.

Independent Assessment Preparation

To maintain independence, we work with established Level 1 independent assessors.

We help manage the assessment process and prepare the evidence required so that the audit can run as smoothly and efficiently as possible.

Proven Experience

We have recently supported Agilexe through its DCC journey, helping the business become one of the first MOD suppliers to successfully achieve DCC Level 1 accreditation alongside Cyber Essentials Plus.

Supporting the Full DCC Journey

Navigating MOD cyber requirements should strengthen your commercial position, not become an unnecessary distraction from the work your business is there to deliver.

For some organisations, the priority will be meeting the Level 0 requirement ahead of 31 December 2026.

For others, existing or future contracts may require Level 1, 2 or 3.

Either way, the challenge is the same: understanding what applies, identifying the gaps and moving through the process in a structured way.

White Hawk Solutions supports businesses throughout that journey, from initial preparation through to certification and higher-level project management.

Cyber Essentials and DCC Level 0 Under One Roof

Cyber Essentials is the mandatory technical foundation for DCC Level 0.

White Hawk Solutions can support, assess and certify businesses for Cyber Essentials alongside DCC Level 0, providing a single route through both requirements.

That means fewer handovers, less duplicated discovery work and a more straightforward certification process.

If your organisation is part of the MOD supply chain, or preparing to bid for defence work, now is the time to understand which level of DCC applies to you and what needs to happen next.

Speak to White Hawk Solutions about Defence Cyber Certification and getting your business contract-ready.