The DCC Level 0 deadline is 31 December 2026. The Ministry of Defence has asked every industry partner across its supply chain to achieve Defence Cyber Certification (DCC) Level 0 by that date, and for most suppliers, that clock is already running short.
If you supply to Defence at any tier, this deadline applies to you.
Here's exactly what DCC Level 0 requires, why the date matters, and how to certify in time.
In a statement marking the first anniversary of the scheme, Eleanor Fairford, Director of Cyber Defence & Risk at the Ministry of Defence, asked all industry partners to achieve Level 0 DCC certification by 31 December 2026, which includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems within scope.
This is a significant shift. The mandate moves DCC from a contract-by-contract requirement to a supply-chain gating control, meaning Level 0 is fast becoming the minimum entry ticket to work with the MoD at all.
DCC Level 0 is the entry-level certification within the scheme, designed for organisations with a Very Low assessed cyber risk profile. It is assessed against Def Stan 05-138 (Issue 4).
The wider DCC scheme runs across four tiers. Level 0 covers Very Low Risk work and, beyond Cyber Essentials, requires two additional basic controls, rising through to Levels 2 and 3, which demand well over a hundred controls for high-risk and mission-critical work. For the large majority of suppliers, Level 0 is the relevant tier and the one tied to the December 2026 deadline.
Certification sits behind DEFCON 658, the standard MoD contractual condition. When DEFCON 658 appears in a contract, it means you are required to hold and maintain an appropriate DCC certification.
You can't achieve DCC Level 0 without Cyber Essentials first. Cyber Essentials is a mandatory prerequisite for DCC Level 0. You must hold a valid CE certificate with a scope that aligns to your DCC scope before applying.
Think of it as two layers. Cyber Essentials is the technical prerequisite that secures your IT infrastructure, and DCC Level 0 is the defence-specific layer on top. It requires a valid Cyber Essentials certificate plus evidence of three specific areas: UK GDPR compliance, data security fundamentals, and system resilience. You need both to meet the 2026 MoD requirement.
The single biggest planning mistake suppliers make is scoping too narrowly. DCC takes a whole-organisation view, you cannot ring-fence only the team touching MoD contracts. Every business-critical system across your organisation is in scope, which is exactly why the MoD's wording specifies Cyber Essentials "for all applicable business-critical systems within scope."
Get your Cyber Essentials scope right first, because it underpins everything that follows in your DCC Level 0 application.
This is where the deadline gets real. Defence Cyber Certification Level 0 typically takes 2–3 weeks for a prepared organisation, but that assumes your Cyber Essentials is already in place and correctly scoped. Building CE from scratch, closing evidence gaps, and aligning scope can add weeks or months.
With a deadline of 31 December 2026 and Cyber Essentials as a prerequisite, working backwards from the date leaves less runway than most suppliers assume.
To hit the DCC Level 0 deadline comfortably:
The good news: you don't have to work through any of this alone.
Cyber Essentials is the mandatory first step, so it's the smartest place to begin. As an established Cyber Essentials certifier, Periculo is with you from start to finish, we add you to the IASME assessment portal, help you scope correctly, guide you through the self-assessment, and take you straight on into DCC Level 0. One joined-up process, support at every stage, no repeated work.
Cyber Essentials pricing is set by IASME, the government-appointed body that runs the scheme, on a tiered structure based on your organisation's size:
| Organisation size | Employees | Price (ex VAT) |
|---|---|---|
| Micro | 0–9 | £320 |
| Small | 10–49 | £440 |
| Medium | 50–249 | £500 |
| Large | 250+ | £600 |
These are the official IASME fees we follow, so you know exactly what the certification costs, with no surprises. Get in touch and we'll confirm your tier and get you started.
When is the DCC Level 0 deadline? The MoD has asked all industry partners to achieve DCC Level 0 by 31 December 2026.
Is DCC Level 0 mandatory? The MoD has asked all suppliers across its supply chain to achieve Level 0 by the deadline, and individual contracts already reference DCC via DEFCON 658. In practice, it is becoming the baseline requirement to work with Defence.
Do I need Cyber Essentials for DCC Level 0? Yes. Cyber Essentials is a prerequisite; all DCC levels start with Cyber Essentials, and you need it scoped to align with your DCC scope before you can certify.
How long is DCC Level 0 valid? Certification is subject to annual attestation, with full recertification every three years.
How long does DCC Level 0 take to achieve? For an organisation that already holds Cyber Essentials, it typically takes a few weeks longer if CE isn't yet in place.
The 31 December 2026 deadline is closer than it looks, and with Cyber Essentials as a prerequisite, the suppliers who start now are the ones who'll certify without stress.
Book a call today, and we'll show you exactly where you stand and what it takes to certify in time.