DCC Level 0 Deadline
What MoD Suppliers Must Do Before 31 December 2026
The DCC Level 0 deadline is 31 December 2026. The Ministry of Defence has asked every industry partner across its supply chain to achieve Defence Cyber Certification (DCC) Level 0 by that date, and for most suppliers, that clock is already running short.
If you supply to Defence at any tier, this deadline applies to you.
Here's exactly what DCC Level 0 requires, why the date matters, and how to certify in time.
What is the DCC Level 0 deadline?
In a statement marking the first anniversary of the scheme, Eleanor Fairford, Director of Cyber Defence & Risk at the Ministry of Defence, asked all industry partners to achieve Level 0 DCC certification by 31 December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope.
This is a significant shift. The mandate moves DCC from a contract-by-contract requirement to a supply-chain gating control, meaning Level 0 is fast becoming the minimum entry ticket to work with the MoD at all.
What is Defence Cyber Certification Level 0?
DCC Level 0 is the entry-level certification within the scheme, designed for organisations with a Very Low assessed cyber risk profile. It is assessed against Def Stan 05-138 (Issue 4).
The wider DCC scheme runs across four tiers. Level 0 covers Very Low Risk work and, beyond Cyber Essentials, requires two additional basic controls, rising through to Levels 2 and 3, which demand well over a hundred controls for high-risk and mission-critical work. For the large majority of suppliers, Level 0 is the relevant tier and the one tied to the December 2026 deadline.
Certification sits behind DEFCON 658, the standard MoD contractual condition. When DEFCON 658 appears in a contract, it means you are required to hold and maintain an appropriate DCC certification.
Cyber Essentials: the prerequisite for DCC Level 0
You can't achieve DCC Level 0 without Cyber Essentials first. Cyber Essentials is a mandatory prerequisite for DCC Level 0. You must hold a valid CE certificate with a scope that aligns to your DCC scope before applying.
Think of it as two layers. Cyber Essentials is the technical prerequisite that secures your IT infrastructure, and DCC Level 0 is the defence-specific layer on top. It requires a valid Cyber Essentials certificate plus evidence of three specific areas: UK GDPR compliance, data security fundamentals, and system resilience. You need both to meet the 2026 MoD requirement.
The scope trap: why "business-critical systems" matters
The single biggest planning mistake suppliers make is scoping too narrowly. DCC takes a whole-organisation view, you cannot ring-fence only the team touching MoD contracts. Every business-critical system across your organisation is in scope, which is exactly why the MoD's wording specifies Cyber Essentials "for all applicable business-critical systems within scope."
Get your Cyber Essentials scope right first, because it underpins everything that follows in your DCC Level 0 application.
How long does DCC Level 0 take?
This is where the deadline gets real. Defence Cyber Certification Level 0 typically takes 2–3 weeks for a prepared organisation, but that assumes your Cyber Essentials is already in place and correctly scoped. Building CE from scratch, closing evidence gaps, and aligning scope can add weeks or months.
With a deadline of 31 December 2026 and Cyber Essentials as a prerequisite, working backwards from the date leaves less runway than most suppliers assume.
What to do now
To hit the DCC Level 0 deadline comfortably:
- Define your Cyber Essentials scope — the systems, devices, cloud services and people the certificate will cover. Get this right so it captures all your business-critical systems, because your scope has to satisfy the DCC requirement (and it also determines your fee tier).
- Complete the Cyber Essentials self-assessment — the online questionnaire, reviewed by a certified assessor.
- Move straight into DCC Level 0 using your CE certificate as the foundation, so you're not repeating work across both frameworks.
- Complete the DCC Level 0 questions — we'll review your responses and tell you of any evidence or gaps that need addressing.
- Submit and achieve DCC Level 0 — once we're happy everything's in order, you submit and get certified.
The good news: you don't have to work through any of this alone.
Start with Cyber Essentials — and we'll support you at every step
Cyber Essentials is the mandatory first step, so it's the smartest place to begin. As an established Cyber Essentials certifier, Periculo is with you from start to finish, we add you to the IASME assessment portal, help you scope correctly, guide you through the self-assessment, and take you straight on into DCC Level 0. One joined-up process, support at every stage, no repeated work.
Cyber Essentials pricing is set by IASME, the government-appointed body that runs the scheme, on a tiered structure based on your organisation's size:
| Organisation size | Employees | Price (ex VAT) |
|---|---|---|
| Micro | 0–9 | £320 |
| Small | 10–49 | £440 |
| Medium | 50–249 | £500 |
| Large | 250+ | £600 |
These are the official IASME fees we follow, so you know exactly what the certification costs, with no surprises. Get in touch and we'll confirm your tier and get you started.
Frequently asked questions
When is the DCC Level 0 deadline? The MoD has asked all industry partners to achieve DCC Level 0 by 31 December 2026.
Is DCC Level 0 mandatory? The MoD has asked all suppliers across its supply chain to achieve Level 0 by the deadline, and individual contracts already reference DCC via DEFCON 658. In practice, it is becoming the baseline requirement to work with Defence.
Do I need Cyber Essentials for DCC Level 0? Yes. Cyber Essentials is a prerequisite; all DCC levels start with Cyber Essentials, and you need it scoped to align with your DCC scope before you can certify.
How long is DCC Level 0 valid? Certification is subject to annual attestation, with full recertification every three years.
How long does DCC Level 0 take to achieve? For an organisation that already holds Cyber Essentials, it typically takes a few weeks longer if CE isn't yet in place.
Don't leave your DCC Level 0 deadline to chance
The 31 December 2026 deadline is closer than it looks, and with Cyber Essentials as a prerequisite, the suppliers who start now are the ones who'll certify without stress.
Book a call today, and we'll show you exactly where you stand and what it takes to certify in time.
