1
Scope call
We confirm the level your contracts call for and agree which parts of your organisation the DCC scope should cover.
What DCC Level 0 asks of you
DCC is the MOD's cyber certification for its suppliers, built on Defence Standard 05-138 and run by IASME through licensed certification bodies. It has four levels, and the cyber risk profile of your contracts decides which one you need. Level 0 is the entry level, with three controls; Level 1 has 101, Level 2 has 139 and Level 3 has 144.
The first Level 0 control is Cyber Essentials, with a scope that covers the business-critical systems in your DCC scope and a commitment to keep it renewed. The second is compliance with the UK General Data Protection Regulation (UK GDPR), shown through policies and data protection impact assessments that suit your size. The third is resilient networks and systems, where the assessor wants proof you could recover from an attack or failure, such as a backup you've actually restored.
A DCC certificate lasts three years. Each year you confirm the controls are still in place, and you renew Cyber Essentials alongside it.
DCC starting requirements
Cyber Essentials underpins every level. Additional DCC controls and assessment apply.
- Level 3Cyber Essentials Plus
- Level 2Cyber Essentials Plus
- Level 1Cyber Essentials
- Level 0Cyber Essentials. Assessed by Forensic Control
Forensic Control’s certification body credentials
Who needs Level 0
If you supply the MOD directly or work beneath a prime contractor, the MOD's request applies to you. Since March 2026 a valid DCC certificate at the right level also counts as evidence under Defence Condition (DEFCON) 658, the cyber clause in MOD contracts, which we explain in our guide to DEFCON 658 and Cyber Essentials for MOD suppliers. You don't need a current defence contract to apply, and organisations outside the UK can certify too.
Large companies are starting at Level 0 as well. Lockheed Martin certified at Level 0 to check its reading of the controls before going on to become the first large company to reach Level 3.
Why use Forensic Control for Level 0
Our board brings defence experience to this work. David Webb, one of our Directors, served 26 years in the armed forces, 16 of them in UK Special Forces.
DCC expects your scope to cover the parts of the business you need to run securely, which is often wider than the scope on an existing Cyber Essentials certificate. We've written about what a narrow scope costs: the University of Nottingham held Cyber Essentials Plus, but the system that was breached sat outside its certificate. We check your Cyber Essentials scope against your DCC scope before you submit anything.
The same Forensic Control team handles your Cyber Essentials and your Level 0 assessment, so you aren't explaining your business twice.
How Level 0 works with us
2
If you don't hold it, we certify you. If your current certificate is too narrow, we re-scope it.
3
Your Level 0 submission
You answer the Level 0 questions and provide evidence for the three controls. Level 0 doesn't need the Assessment Submission Record that the higher levels use.
4
Assessment
We review your answers and evidence against Defence Standard 05-138. All three controls have to be met, and if anything needs clarifying we'll tell you exactly what.
5
Certificate, and the years after
You receive your certificate and a digital badge for your website and tenders. We remind you before each Cyber Essentials renewal and each annual DCC attestation.
Ways to buy
DCC Level 0
For organisations that already hold a current Cyber Essentials certificate. We'll check whether its scope matches what DCC needs.
Price on request
Cyber Essentials and DCC Level 0
You order both certificates together and the same team handles each.
Price on request
Duo and DCC Level 0
Combines Cyber Essentials, Cyber Essentials Plus and DCC Level 0. For suppliers whose primes already ask for Plus, or who expect to need Level 2 later. Includes 12 months of vulnerability scanning.
Price on request
If your contract needs Level 1 or above
Our licence covers Level 0. If a contract names Level 1, 2 or 3, we'll say so on the scope call and point you to IASME's list of certification bodies licensed at that level. The Cyber Essentials or Cyber Essentials Plus certificate we issue still counts towards every level.
IASME's rules keep assessment and implementation separate. As your assessor we can tell you where the gaps are, but we can't also make the fixes, so your IT team or provider does that work.
Questions about DCC Level 0
What is DCC Level 0?
What are the three DCC Level 0 controls?
Do I need Cyber Essentials before DCC Level 0?
Will my existing Cyber Essentials certificate count?
How much does DCC Level 0 cost?
How long does DCC Level 0 take?
What questions are asked at DCC Level 0?
Is DCC Level 0 mandatory?
What is DCC Level 1, and can you assess it?
Start with a scope call
Send us your current Cyber Essentials certificate, or tell us you don't have one yet, and we'll confirm your route to Level 0 and send you a quote.
