How does a UK defence SME achieve DCC Level 0?

To achieve Defence Cyber Certification (DCC) Level 0, a UK defence SME has to fully meet three controls: a valid Cyber Essentials certificate that covers its DCC scope, documented UK GDPR compliance backed by Data Protection Impact Assessments, and resilient networks and systems, meaning it has assessed how resilient its systems need to be and built that resilience in. Certification is assessed through an IASME-approved certification body, is valid for three years, and requires annual attestation.

That is the whole requirement. The rest of this guide explains each step, what evidence assessors expect, and how long it takes. It reflects version 2.2 of IASME's DCC Applicant Guide, published in October 2026.

What is DCC Level 0?

DCC is the MOD's certification scheme for the defence supply chain, launched alongside Cyber Security Model v4 (CSM v4) in December 2025 and administered by IASME. It has four levels, 0 to 3, which correspond directly to the Cyber Risk Profiles used in CSM v4 and the control sets in Defence Standard 05-138.

Level 0 is the entry level, for contracts assessed as very low cyber risk. It is deliberately achievable for small companies. The MOD has asked all industry partners to achieve Level 0 by 31 December 2026, and the MOD's Chief Information Security Officer has written to suppliers stating that certification will increasingly be specified as a precursor requirement for contracting with Defence.

One detail that catches people out: Level 0 has no partial credit. All three controls must be fully met to pass. Levels 1 and 2 allow some controls to be partially met; Level 0 does not.

The scheme is not theoretical. Lockheed Martin has already achieved the first DCC Level 3 certification, which tells you the assessment machinery is running and that primes are moving.

Step 1: Get Cyber Essentials, with the right scope

Cyber Essentials is the prerequisite for DCC Level 0. It covers five technical controls: firewalls, secure configuration, user access control, malware protection, and security update management. It is achieved through a self-assessment questionnaire verified by a certification body and typically costs a few hundred pounds.

Holding a certificate is not quite enough. Your Cyber Essentials scope has to cover every internet-connected device and network inside your DCC scope, and you must supply a diagram showing how the two relate. DCC scope also includes devices that are not internet-connected, so the two rarely match exactly, but if your CE scope does not adequately align, the DCC assessment is an automatic fail. Agree both scopes with your certification body before you answer anything else.

You also commit to keeping Cyber Essentials current for the full three years of DCC certification. CE renews annually, so that is three renewals to diarise, not one.

If you already hold a valid Cyber Essentials certificate with a sensible scope, you have done the hardest part. If not, a well-configured Microsoft 365 environment gets you most of the way, and certification is achievable in days to weeks depending on your starting posture.

One caution: the questionnaire is easy to underestimate. Declaring controls you do not actually operate is worse than failing, because a later DCC assessment is designed to find exactly that gap.

Step 2: Evidence UK GDPR compliance

The control asks two questions. First, do you have documented policies and procedures that ensure you meet your UK GDPR obligations? That can be a dedicated policy or part of other company documentation. Second, do you carry out Data Protection Impact Assessments (DPIAs) against the types of personal data you store or process?

The second question is the one most SMEs have not done. Expect to show the procedure you follow, the template you use, or the output of a completed assessment. Proportionality applies: a small company can have simpler documentation than a large one, but it still needs to exist in writing before the assessment. ICO registration is a legal obligation for most businesses in its own right, so have that in order too.

Step 3: Evidence resilient networks and systems

Again, two questions. Have you assessed how resilient your systems need to be against cyber attack and system failure? And have you built that resilience in?

The first is a short, honest risk assessment: which systems are essential to the business and what could take them down. For a micro company that can be a brief document; a larger organisation will have a risk register.

The second is where people go wrong. The Applicant Guide tells applicants to avoid pointing at policy documents or high-level plans here, and to show the concrete measures that let your systems withstand and recover from disruption: automated backups you have actually restored from, redundancy, uninterruptible power. A tested backup process meets the bar. A disaster recovery document nobody has read since 2023 does not.

Step 4: Book the assessment

DCC assessments are delivered by IASME's network of assured certification bodies. Register interest with IASME, who will provide a list of certification bodies assessing at your required level. The certification body explains the process, quotes, and conducts the assessment. Assessors identify gaps and advise, but they do not implement fixes for you or write your answers.

You answer the questions in an Assessment Submission Record (ASR). Restating the example answer is not enough: explain how you meet each control, and point to the exact section of each piece of evidence. If the assessor cannot find the supporting part, they can mark the question as failed. You are also responsible for documenting your scope clearly, and an inadequate scope fails the whole assessment.

Assessors now have explicit discretion. Version 2.2 of the Applicant Guide lets them add or remove a point on any control using professional judgement. That cuts both ways: a proportionate approach can be scored as fully met even if some questions do not apply to you, while a policy that exists but is not followed in practice can be marked down. At Level 0, losing a point on any control is a fail.

How long does it take?

For an SME with a reasonable Microsoft 365 setup: Cyber Essentials in one to four weeks, the remaining Level 0 evidence in parallel, and assessment shortly after.

The realistic constraint is assessor availability, which will tighten as the December 2026 date approaches. If you are starting now, start with Cyber Essentials this month.

What if the assessment does not go well?

A failed assessment is not a public event. If your assessor thinks you are at risk of failing, they may allow you to remediate and resubmit through agreed clarification rounds. Otherwise you receive a report setting out where you fell short, you remediate, and you reapply. Failed assessment details are kept confidential.

The cost of failing is time and a second fee. That is an argument for being honest with yourself about your evidence before you book, not an argument for delay.

After you are certified

Certification lasts three years, with an annual attestation to confirm your scope has not changed significantly. During that time you must keep Cyber Essentials current, keep meeting the controls, and discuss any significant change with your certification body in case it triggers recertification. Keep all assessment documents, unaltered, for at least three and a half years: IASME may moderate assessments and the MOD retains the right to audit. If you want to reuse your ASR for renewal or an upgrade, work on a copy and leave the original untouched.

Do I need a higher level?

Only if your contract's Cyber Risk Profile demands it. Level 1 introduces 101 controls, Level 2 (which requires Cyber Essentials Plus) has 139, and Level 3 has 144. Level 3 is currently assessed only through a combined Level 2 and 3 assessment covering 145 controls. The MOD or your prime contractor specifies the required level in the invitation to tender.

Do not over-certify speculatively. Hit the right bar at the right time.

Getting help with Level 0

Most of Level 0 is achievable without outside help if your environment is tidy and someone has the time. Where it stops being straightforward is when your Microsoft 365 setup has grown organically, nobody has written down the governance, or the founders simply do not have the hours.

Where we come in is AEGIS, and it is worth being clear what that is. It is not a compliance exercise. It is operational cyber security: we bring your Microsoft 365 environment up to defence standard, protect it around the clock, and produce the evidence you need for Cyber Essentials and DCC as an output of that work. Built by us, protected by us, owned by you, so the tenant stays yours.

AEGIS runs at every DCC level, 0 to 3, sized to the Cyber Risk Profile your contracts carry. At Level 0 it is sold as a fixed-price package for cloud-only, low-complexity organisations that includes the Microsoft licences and the certification body fee, delivered by SC and DV cleared people who helped build the MOD's own requirements.