How much does DCC Level 0 certification cost?

There is no single official price, because IASME deliberately does not set standardised DCC assessment fees; each certification body quotes based on your size, scope, and readiness. As a realistic budget for a small, reasonably prepared organisation: £300 to £600 for the prerequisite Cyber Essentials certificate, and published Level 0 assessment fees in the market starting at around £1,000 plus VAT. A prepared micro or small business should think in terms of £1,500 to £2,500 all in, before any consultancy.

The bigger variable is not the fees. It is how ready you are when the assessor arrives.

The cost components

1. Cyber Essentials (prerequisite): £300 to £600. Priced on a sliding scale by organisation size using government headcount bands. This is a fixed, predictable cost and you must hold a valid certificate before DCC Level 0 assessment.

2. The DCC Level 0 assessment: quoted per organisation. IASME's position is that costs vary with size, complexity, scope, and preparedness, so certification bodies quote individually. Level 0 is a documentation-led review against a constrained requirement set, which is why some certification bodies publish flat fees starting around the £1,000 plus VAT mark. Get two or three quotes; this is a young market and pricing varies.

3. Internal effort: the hidden line. For Level 0 you need evidence of UK GDPR compliance (documented policies and procedures, plus Data Protection Impact Assessments on the personal data you process) and resilient networks (an assessment of how resilient your systems need to be, and proof of the measures you have actually put in place, such as tested backups). You also need clear scope documentation, including a diagram showing how your Cyber Essentials scope relates to your DCC scope. For a well-run SME this is days of focused work. For a company that has never written any of it down, it is the largest cost in the whole exercise.

4. Consultancy: optional, and honestly not always needed. A small company with a tidy Microsoft 365 environment and basic governance can achieve Level 0 without paying anyone for hand-holding. Consultancy earns its fee when your environment is messy, your time is worth more than the fee, or you are sequencing Level 0 as the first step toward Level 1 or 2 and want the roadmap built properly the first time. A managed service is a separate question: that is about who builds, runs and defends the environment afterwards, not about getting the certificate.

What makes the price go up?

Three things, all within your control.

Complex or poorly documented IT scope, because every unmanaged device and forgotten server extends the review, and a Cyber Essentials scope that does not align with your DCC scope is an automatic fail. Failed first attempts, because an unsuccessful assessment means remediation and reassessment, and Level 0 has no partial credit: all three controls must be fully met. And urgency, because assessor capacity will tighten as the end of 2026 approaches, and scarce slots do not get cheaper.

Is it worth it?

Set the total against the alternative. A certificate valid for three years (keeping Cyber Essentials renewed each year throughout), covering all your contracts at that level, replacing per-contract questionnaire cycles, and keeping you eligible for tenders where DCC is a precursor requirement.

For most defence suppliers the certificate costs less than the margin on a single small contract, and considerably less than being excluded from one.

Before you spend anything

Get quotes from more than one certification body, and be sceptical of anyone selling Level 0 as a complex programme. It is three requirements. If a proposal makes it sound like twenty, you are being sold something.