When is the DCC Level 0 deadline and what happens if I miss it?

The Ministry of Defence has asked all industry partners to achieve Defence Cyber Certification (DCC) Level 0 by 31 December 2026. Missing it does not make your company vanish from existing contracts overnight, but it progressively shuts you out of new ones: DCC is increasingly specified as a precursor requirement for contracting with Defence, and primes are already asking subcontractors to evidence certification during supplier onboarding.

Is it a deadline or an expectation?

Worth being precise, because a lot of coverage is not. The MOD's published wording is that it has asked industry partners to achieve Level 0 by that date. It is not a statutory deadline, and 1 January 2027 does not automatically void your contracts.

What it is instead is a clear signal of contracting intent, backed by the MOD's Chief Information Security Officer writing to suppliers to say certification will increasingly be specified as a precursor requirement. In practice that makes it a commercial deadline rather than a legal one, which for most suppliers amounts to the same thing but arrives unevenly: it hits you when you bid, not on a fixed date.

Treat it as the date by which not holding Level 0 starts costing you opportunities.

Who does it apply to?

The expectation reaches across the supply chain, not just the primes. If your company supplies the MOD directly, or supplies a company that does, at any tier, you should assume it applies to you.

Level 0 is the floor. If your contracts carry a higher Cyber Risk Profile, the required level (1, 2 or 3) will be specified in the tender or flowed down by your prime.

What happens if I miss it?

Three things, in roughly this order.

Tender exclusion. Where DCC Level 0 is specified as a precursor requirement, no certificate means no bid. You will not get a warning letter. You will simply stop qualifying.

Prime contractor pressure. Primes are accountable for flow-down under CSM v4, and the path of least resistance for them is to prefer certified suppliers. Uncertified subcontractors become the awkward line in their assurance return.

Cyber Improvement Plan territory. On contracts already in flight, gaps against the required profile mean documenting a CIP with committed remediation deadlines that form part of the contract. Manageable, but you are now remediating under contractual pressure instead of certifying at your own pace.

How long does certification realistically take?

The Level 0 requirements are Cyber Essentials, UK GDPR compliance evidence, and demonstrable backup and recovery capability. For a typical SME:

• Cyber Essentials: one to four weeks if your environment is in reasonable shape.
• GDPR and resilience evidence: one to two weeks of focused administrative work, in parallel.
• Assessment through an IASME certification body: subject to availability.

That last point is the trap. Assessor capacity is finite, and every supplier who has deferred this will be booking slots in the final quarter of 2026. A process that takes six weeks in August becomes a scramble in November.

Counting backwards from December

Work it out for your own business. Take 31 December, subtract the assessment slot you have not booked yet, subtract the weeks of Cyber Essentials work, subtract the fortnight of evidence gathering nobody has started, and subtract the fact that the people who need to do it also have day jobs.

For most SMEs that arithmetic lands somewhere in the autumn, which is precisely when every other deferring supplier will be competing for the same assessor diaries.

Is Level 0 worth doing if my contracts might need Level 1?

Yes. Certification is valid for three years with annual attestation, Level 0 requirements are a strict subset of the higher levels, and holding it keeps you tender-eligible while you build toward more.

The wrong move is waiting for perfect clarity on your future risk profile while the date erodes your options.