Cyber security for defence suppliers

Defence Cyber Certification (DCC) is now the recognised way for suppliers to show they meet the Ministry of Defence's cyber requirements. We help prime contractors and SMEs in the defence supply chain understand their Cyber Risk Profile, close the gaps and prepare for certification.

Talk to a member of our team

The challenge

What's driving security in your sector

Defence Cyber Certification

DCC has four levels, 0 to 3, matched to the Cyber Risk Profile of a contract. Levels 2 and 3 also require Cyber Essentials Plus. The MOD has asked all industry partners to reach Level 0 by 31 December 2026.

DEFCON 658 and DEFSTAN 05-138

Contracts that invoke DEFCON 658 require suppliers to meet the DEFSTAN 05-138 controls for their Cyber Risk Profile, and DCC is the recognised way to evidence this.

Flow-down through the supply chain

Primes must pass requirements on to their subcontractors, so SMEs are increasingly asked for DCC and Cyber Essentials before they can bid.

Whole-organisation scope

Unlike Cyber Essentials, DCC doesn't let you exclude parts of the business from scope. Only the number of controls changes between levels, so early scoping decisions matter.

How we help

Practical support, from strategy to evidence

We bring our six core services together around the requirements that matter in your sector, so effort goes into the controls and evidence that make the difference.

Cyber Security Advisory

Plain-English advice on which DCC level your contracts need and the most efficient path to get there.

Governance & Risk Management

Policies, risk assessments and governance processes that meet DEFSTAN 05-138 expectations without unnecessary bureaucracy.

Audit & Assurance

Independent DCC readiness assessments and evidence reviews before you engage a certification body.

Threat Modelling

Threat modelling of the systems that handle MOD information, to justify controls and prioritise investment.

Cyber Security Frameworks

Cyber Essentials and Cyber Essentials Plus preparation, with alignment to ISO/IEC 27001 where you hold or want it.

At a glance

Key requirements and frameworks

Requirement	What it covers
DCC Level 0	Baseline level; MOD target for all industry partners by 31 December 2026
DCC Levels 1–3	Increasing controls for low, high and substantial Cyber Risk Profiles
Cyber Essentials / Plus	Foundation for DCC; Plus is required at Levels 2 and 3
DEFCON 658	Contract condition on cyber requirements, including supply chain flow-down
DEFSTAN 05-138	Defence standard setting the controls for each Cyber Risk Profile

A summary for guidance only, correct as of October 2026. Requirements change; check the source for your situation.

FAQs

Common questions

It depends on the Cyber Risk Profile set for each contract, which the MOD or your prime will tell you. One certificate covers all contracts at or below the certified level, so it often makes sense to certify at the highest level you expect to need.

Certificates are issued through the DCC scheme's certification bodies. We help you prepare: confirming scope, closing gaps and getting your evidence in order, so your assessment goes smoothly first time.

For organisations that already hold Cyber Essentials, lower levels can often be reached within weeks. Higher levels usually take a few months, depending on the gaps. A short readiness assessment gives you a realistic plan and timeline.

Let's talk about your next step

A short, no-obligation conversation to understand where you are and what would help most.

Book a consultation

Other sectors: Financial services & payments · Energy, utilities & CNI · Technology, SaaS & managed services · Public sector & suppliers