Licensed to assess DCC Level 0
Forensic Control is licensed by IASME to assess organisations for DCC Level 0. You can arrange your Cyber Essentials certification and DCC Level 0 assessment through the same certification body.
Trusted by UK organisations
Why choose Forensic Control for DCC Level 0
Certification experience since 2017
We've been certifying organisations to Cyber Essentials since 2017. We bring that experience to the foundation of your DCC assessment, checking the certificate you hold and explaining any changes needed to its scope.
Clear guidance on the evidence you need
We explain the requirements in plain English and identify where your evidence needs clarification. You'll understand what is being assessed and what your organisation needs to demonstrate, with guidance appropriate to its size and complexity.
Defence experience on our board
Our board includes David Webb, whose background spans military service and senior corporate security roles. With more than 30 years’ experience in security and risk management and an MSc in Security & Risk Management, he brings a practical understanding of operational resilience and the responsibilities of supplying the defence sector.
Our certification body credentials
Your IASME-licensed certification body
Forensic Control is licensed to assess DCC Level 0 and certify Cyber Essentials and Cyber Essentials Plus.
DCC Certification Body Level 0
Cyber Essentials
Cyber Essentials Plus
What is DCC Level 0?
Defence Cyber Certification is a scheme developed by the Ministry of Defence and IASME to assess the cyber security and resilience of defence suppliers. It provides independent assurance against Defence Standard 05-138, Issue 4.
Level 0 is the entry level. It builds on Cyber Essentials and also examines how your organisation protects personal data and keeps critical systems resilient. Certification gives defence customers evidence that you meet the requirements at this level.
The Level 0 assessment is a short online questionnaire covering three controls. There are fewer questions than Cyber Essentials, but each answer needs a written explanation of how your organisation meets the control. Organisations with basic security policies in place can usually use what they already have. If you hold ISO 27001 or IASME Cyber Assurance, much of what's needed is likely to be in place already.
Ways to buy
Choose your certification package
The initial purchase price excludes the annual DCC check.
DCC Level 0
For organisations that already hold a current Cyber Essentials certificate. We'll check its scope and assess your organisation against the DCC Level 0 requirements.
DCC is a three-year commitment, with an annual check. Certification depends on passing the assessment. You must hold current Cyber Essentials certification for the scope and renew it each year.
Cyber Essentials and DCC Level 0
For organisations that need both certifications. Arrange your Cyber Essentials certification and DCC Level 0 assessment together, with guidance on the scope and evidence required for each.
DCC is a three-year commitment, with an annual check. Certification depends on passing the assessment. The package includes Cyber Essentials for year one. Renewals for years two and three are separate.
Cyber Essentials Duo and DCC Level 0
Includes Cyber Essentials, Cyber Essentials Plus and DCC Level 0. Choose this package if your customer also requires Cyber Essentials Plus, or you want independent technical testing alongside your Cyber Essentials assessment. Includes 12 months of vulnerability scanning. Cyber Essentials Plus is optional for DCC Level 0.
DCC is a three-year commitment, with an annual check. Certification depends on passing the assessment. The package includes Cyber Essentials for year one. Renewals for years two and three are separate.
How DCC Level 0 certification works
Discuss your requirements
Tell us about your organisation, your customer's requirements and any deadline. We'll review your proposed scope and current Cyber Essentials status, then explain the assessment process and provide a quote.
Confirm your Cyber Essentials coverage
If you already hold Cyber Essentials, we'll check that it provides the coverage DCC needs. If you need to certify, renew or extend that coverage, we can arrange the Cyber Essentials assessment with you.
Prepare your answers and evidence
You explain how your organisation meets each Level 0 control and gather the evidence you already hold. We'll clarify the questions and evidence requirements. Your team or IT provider carries out any changes needed to meet the controls.
Complete your Level 0 assessment
We review your scope, answers and evidence with your team on a video call. If anything needs clarification, we'll explain what is required. Certification is awarded once all three controls have been met.
Maintain your certification
After certification, you receive a digital certificate and verifiable badge. Your DCC certificate lasts three years, subject to annual confirmation that the controls are maintained and your scope has not significantly changed. Cyber Essentials must also be renewed each year.
“A plan that only works when everything goes right is an unfinished plan. The real test is whether your people know what to do, who takes the decisions and how to keep the business operating when events stop following the script.”
Who is it for?
DCC Level 0 is relevant to organisations supplying the MOD directly, businesses working through prime contractors and suppliers preparing to enter the defence market. That includes suppliers whose work is not defence-specific, such as catering, cleaning, facilities and manufacturing. You can apply without an existing defence contract, and organisations outside the UK are eligible.
The MOD or your prime contractor determines the level required for a particular contract, known as its Cyber Risk Profile. A certificate at one level also covers contracts at a lower level, so you don't need a separate assessment for each contract. We'll review the requirement with you before starting your Level 0 assessment.
What you need for Level 0
Your organisation must demonstrate that it meets all three Level 0 controls, and be ready to show evidence of each during the assessment.
Cyber Essentials
You need a current Cyber Essentials certificate, issued to the organisation supplying the MOD, covering the internet-connected systems within your DCC scope. You must keep it in place throughout your DCC certification. Cyber Essentials Plus is not required for Level 0.
Protection of personal data
You must show that you process personal data in line with UK GDPR. Evidence usually includes your data protection policy and privacy notice, who is responsible for data protection, the data processing clauses in your contracts, how you record consent and handle deletion requests, and any data protection impact assessments from the last 12 months.
Resilient networks and systems
You must show how resilience against cyber attack and system failure is built into the way your systems are designed, run and managed. Depending on your organisation, evidence may include backup arrangements, successful restore tests and plans to maintain or recover essential services. The assessor will ask you to talk through these measures.
Client proof
Trusted by UK organisations
5-star Google reviews from Forensic Control clients.
“Highly recommend Forensic Control for anyone looking for a knowledgeable and supportive Cyber Essentials Plus audit partner.”
“From the very start of our CE+ journey, Jonathan was providing tremendous service to us in order to ensure we had all the necessary information and advice specific to our company.”
“Expert and friendly support towards our achieving Cyber Essentials Plus certification. Clearly laid out the expectations for meeting the standards and navigated us through.”
“Forensic Control were an excellent partner on our Cyber Essentials and Cyber Essentials Plus journey. They held our hand and counselled us through some seemingly insurmountable obstacles for a small firm.”
“This was our first time completing the certification. Jonathan outlined a clear, structured approach that gave me confidence straight away. Ross Southwell provided expert guidance throughout.”
“Forensic Control were exceptionally helpful and efficient all the way through the process, helping us to achieve Cyber Essentials Plus with minimum fuss.”
“We renewed our Cyber Essentials and Cyber Essentials Plus certifications with Forensic Control. They were professional, helpful and friendly throughout.”
5.0
Questions about DCC Level 0
What is DCC Level 0?
What are the three DCC Level 0 controls?
Do I need Cyber Essentials before DCC Level 0?
Will my existing Cyber Essentials certificate count?
How much does DCC Level 0 cost?
How long does certification take?
What questions and evidence are required?
Is DCC Level 0 mandatory?
Can you assess Level 1 or above?
Can you help us prepare as well as assess us?
Do we need to send copies of our policies?
How long is the DCC certificate valid?
Speak to us about DCC Level 0
Tell us what your customer has asked for, when you need to certify and whether you already hold Cyber Essentials. We'll explain your next steps and provide a quote for the assessment you need.
