Defence Cyber Certification (DCC) is assessed on your whole organisation, not just your IT estate. Under Def Stan 05-138, DCC scope covers every system, process and piece of data your business needs to keep running, including data protection, resilience, physical security, suppliers and people. IT can coordinate the work, but leadership has to own the scope and the budget.
This week I spoke to two defence suppliers about Defence Cyber Certification. Both conversations were with the person in charge of IT, and both hit the same problem.
The first, an IT lead at a defence and security firm, needed to take the cost to his manager and then his Managing Director. His worry was that the board would see the words "cyber certification" and file it under IT spend. As he put it, this is a business case that touches every part of the company.
The second had just filled in a 246-requirement security questionnaire for a defence client. It took a week. The certification work sat with the Head of IT, but most of the questions were about how the whole business runs.
They are both right. DCC is assessed on the whole organisation, and if it is treated as an IT project, the scope, the evidence and the budget all end up in the wrong place.
DCC is built on Def Stan 05-138 issue 4, and that standard sets its scope as the supplier's whole corporate environment. It covers every system, process and piece of data needed to keep the business running, beyond the information tied to a single MOD contract.
IASME's scoping guidance spells out what that means in practice. HR, payroll, stock and order management, building entry systems, heating and ventilation, and operational technology on the shop floor can all fall in scope. The test is simple: if the business could not keep operating without it, it belongs in your DCC scope.
Scope is also signed off at company level. The applicant submits a scoping attestation, signed by someone authorised to speak for the organisation, confirming every essential service and site is covered. Get it wrong by under-scoping and the assessment fails, even if every control is met. And the scope you set at Level 0 has to stay the same as you move up to Levels 1, 2 and 3.
Even Level 0, the lightest level with just three controls, reaches past the IT team. Only one of the three is Cyber Essentials, and Cyber Essentials and DCC scope rarely match. From Level 1 upwards the spread gets much wider.
Data protection. Level 0 asks for UK GDPR evidence: who your Data Protection Officer is, how consent and deletion requests are handled, and DPIAs from the last year. That usually sits with legal, compliance or your DPO.
Resilience. Assessors look for resilience built into how the business runs day to day, from design through to operation. Business continuity and disaster recovery plans are normally owned by operations.
Physical security. Level 2 brings an on-site audit of your physical controls at every site in scope. That is facilities and site management territory.
Suppliers and parent companies. From Level 1, the businesses you depend on are assessed through your supplier controls. That includes an overseas parent company, which is treated as a third party. Procurement and commercial teams hold most of that evidence.
People. Staff, visitors and contractors with access to your sites and systems are part of the scope, which brings in HR.
IT can coordinate all of this, but it cannot produce the evidence alone.
If you are the IT lead taking DCC upstairs, three points tend to land.
It decides which contracts you can bid for. The MOD gives each contract a Cyber Risk Profile, and that sets the DCC level suppliers need. It has asked its supply chain to hold Level 0 by the end of 2026. A certificate at the right level also replaces the contract-by-contract questionnaires that currently eat a week of someone's time.
Scope is a board-level decision. IASME recommends that the CEO or equivalent knows and agrees the scope, and the attestation is signed on behalf of the whole company. Leadership should own that call before the assessment starts.
The work needs owners across the business. Name someone in data protection, operations, facilities, procurement and HR early. The evidence comes together faster, and the cost sits where it belongs: as the price of staying eligible for defence work.
Most DCC problems start with scope. Settle it early, with the right people in the room, and the rest of the assessment follows far more smoothly.
Periculo is an IASME Certification Body for DCC Levels 0 to 3, with SC-cleared assessors and DV-cleared leadership. If you would like a second pair of eyes on your scope before you take it to the board, feel free to book a short scoping call with me.
No. DCC is assessed against Def Stan 05-138, which scopes the supplier's whole corporate environment. Data protection, business continuity, physical security, supplier management and HR all contribute evidence, so it needs owners across the business, not just the IT team.
Every system, process and piece of data the business needs to keep operating. IASME's scoping guidance gives examples including HR, payroll, stock and order management, building entry systems, heating and ventilation, and operational technology. If the business could not run without it, it is in scope.
Someone authorised to speak for the whole organisation. IASME recommends the CEO or equivalent knows and agrees the scope, because under-scoping fails the assessment even if every control is met.
Yes. From Level 1, an overseas parent company is treated as a third party and assessed through your supplier controls, alongside the other businesses you depend on.
No. The scope you set at Level 0 has to stay the same as you move up to Levels 1, 2 and 3, so it is worth getting right first time.
The MOD has asked its supply chain to hold DCC Level 0 by the end of 2026. The level needed for a specific contract is set by that contract's Cyber Risk Profile.