Working within the UK Defence supply chain can bring additional cyber security requirements.
Those requirements may be passed down through contracts, prime suppliers and procurement processes.
White Hawk Solutions helps organisations understand what is expected, prepare effectively and connect Defence Cyber Certification with the wider controls already in place.
Discuss your defence requirementsDefence Cyber Certification (DCC) is a mandatory security requirement for suppliers within the UK defence supply chain.
It validates that an organisation complies with Ministry of Defence (MoD) cyber protection standards.
Achieving DCC demonstrates operational resilience and ensures the business remains eligible to bid on and secure defence contracts.
DCC is relevant to organisations that:
Supply products or services into the defence sector
Work as subcontractors to larger defence suppliers
Handle sensitive defence-related information
Need to respond to contractual cyber requirements
Want to prepare for future defence opportunities
Already hold Cyber Essentials but face additional assurance expectations
The exact level and specific requirements depend on the customer, contract and information involved.
Before initiating a Defence Cyber Certification assessment, organisations must meet foundational cyber security prerequisites.
Identify the Risk Profile: Understand the Cyber Risk Profile (CRP) specified by the Ministry of Defence (MoD) or the prime contractor for the project.
Defined System Scope: Clearly establish which internal networks, hardware, and personnel interact with defence data to ensure assessment boundaries are correctly configured.
Baseline Security: The organisation must hold a valid Cyber Essentials certification.
Every Defence supplier is assigned a Cyber Risk Profile (CRP). The DCC level is determined by the specific CRP of the contract your organisation is bidding on.
White Hawk can help clients understand the requirements for each associated level:
Level 0 - Very Low Risk. 3 core controls
Level 1 - Low to Moderate Risk. 101 security controls
Level 2 - Moderate to High Risk. 139 controls
Level 3 - High Risk. 144 full control set
Review the request, contract or supply-chain expectation and explain what it means for the organisation.
Review existing certifications, technical controls, policies and working practices.
Explain what needs to change, what evidence is required and which actions should take priority.
Work alongside the team to implement improvements and prepare for the relevant process.
Provide ongoing support with security, certification maintenance and future customer requirements.
Cyber Essentials and Defence Cyber Certification, then ongoing maintenance and support.
Essential technical controls in place
Required for all defence suppliers
White Hawk Solutions provides gap analysis. Implementation coaching. Full project management (including independent assessor engagement).
Maintained and kept up to date
The following information is a case study, detailing the full engagement with our client, Agilexe, and how we guided them through the journey of Cyber Essentials accreditation as well as the introduction of a Secure Software Development Lifecycle.
White Hawk Solutions can help you understand the requirements and achieve the right level of certification.
Discuss your defence-supplier requirements