How much does DCC Level 0 certification cost?

There is no single official price, because IASME deliberately does not set standardised DCC assessment fees; each certification body quotes based on your size, scope, and readiness. As a realistic budget for a small, reasonably prepared organisation: £300 to £600 for the prerequisite Cyber Essentials certificate, and published Level 0 assessment fees in the market starting at around £1,000 plus VAT. A prepared micro or small business should think in terms of £1,500 to £2,500 all in, before any consultancy.

The bigger variable is not the fees. It is how ready you are when the assessor arrives.

The cost components

1. Cyber Essentials (prerequisite): £300 to £600. Priced on a sliding scale by organisation size using government headcount bands. This is a fixed, predictable cost and you must hold a valid certificate before DCC Level 0 assessment.

2. The DCC Level 0 assessment: quoted per organisation. IASME's position is that costs vary with size, complexity, scope, and preparedness, so certification bodies quote individually. Level 0 is a documentation-led review against a constrained requirement set, which is why some certification bodies publish flat fees starting around the £1,000 plus VAT mark. Get two or three quotes; this is a young market and pricing varies.

3. Internal effort: the hidden line. For Level 0 you need evidence of UK GDPR compliance (ICO registration, privacy policy, knowledge of what personal data you hold) and resilient networks (working, tested backups and a disaster recovery plan). For a well-run SME this is days of focused administrative work. For a company that has never written any of it down, it is the largest cost in the whole exercise.

4. Consultancy: optional, and honestly not always needed. A small company with a tidy Microsoft 365 environment and basic governance can achieve Level 0 without paying anyone for hand-holding. Consultancy earns its fee when your environment is messy, your time is worth more than the fee, or you are sequencing Level 0 as the first step toward Level 1 or 2 and want the roadmap built properly the first time. A managed service is a separate question: that is about who builds, runs and defends the environment afterwards, not about getting the certificate.

What makes the price go up?

Three things, all within your control.

Complex or poorly documented IT scope, because every unmanaged device and forgotten server extends the review. Failed first attempts, because an unsuccessful assessment means remediation and reassessment. And urgency, because assessor capacity will tighten as the end of 2026 approaches, and scarce slots do not get cheaper.

Is it worth it?

Set the total against the alternative. A certificate valid for three years, covering all your contracts at that level, replacing per-contract questionnaire cycles, and keeping you eligible for tenders where DCC is a precursor requirement.

For most defence suppliers the certificate costs less than the margin on a single small contract, and considerably less than being excluded from one.

Before you spend anything

Get quotes from more than one certification body, and be sceptical of anyone selling Level 0 as a complex programme. It is three requirements. If a proposal makes it sound like twenty, you are being sold something.