DCC CERTIFICATION BODY

Defence Cyber Certification

Q: Do I need Cyber Essentials Plus for Level 1?

No, Level 0 and Level 1 require a valid Cyber Essentials (Basic) certificate. Level 2 and Level 3 require Cyber Essentials Plus.

Q: What happens if I fail the assessment?

If you don't meet the requirements, Periculo will provide feedback on the areas that need improvement. You can address these gaps and resubmit your application.

Q: How long does a certification last?

DCC certification is valid for 3 years, subject to an annual check-in to ensure continued compliance.

Q: Would an assessor be able to implement and audit my DCC certification?

No. To maintain impartiality and accreditation standards, the same individual or team cannot both implement the controls and perform the certification audit. However, Periculo can provide separate teams for these services, or you can choose us for one specific role.

Q: What happens if gaps are found during the assessment?

If gaps are identified during the assessment, you will be provided with a report detailing the non-compliances. You will typically have a remediation period to address these issues before a re-assessment is conducted.

Q: Does DCC apply to my subcontractors?

Yes. The requirements of DEF STAN 05-138 must be "flowed down" through the supply chain. If you subcontract work that involves MOD identifiable information, you are responsible for ensuring your suppliers also hold the appropriate level of DCC certification.

Q: How does DCC differ from ISO 27001?

While ISO 27001 is a broad international standard for information security management, DCC is a specific UK Ministry of Defence framework. DCC is prescriptive about certain controls (like Cyber Essentials) and is mandatory for defence contracts, whereas ISO 27001 is often voluntary or industry-specific.

Q: What is the cost of certification?

Costs vary depending on the size of your organization and the certification level (Level 0 vs Level 1). Level 0 is generally lower cost due to the smaller control set. Contact Periculo for a tailored quote based on your specific organisational scope.

Q: What is the "Scope" of the certification?

Unlike previous standards that could be limited to a specific contract, DCC typically applies to the "Whole Organisation" or at least the entire specific business unit handling MOD data. This ensures a baseline of security across your entire corporate environment.

Secure your position in the UK Defence supply chain. Periculo guides you through Levels 0-3 DCC, ensuring compliance with DEF STAN 05-138.

DCC is more than just a requirement,
it’s a strategic advantage for your business.

STREAMLINED COMPLIANCE

This service helps prime contractors and SME suppliers rapidly achieve Defence Cyber Certification. We remove the complexity from framework onboarding, guiding you seamlessly through the required technical controls.

3-YEAR VALIDITY

The cost is dependent on the level of support you require. We tailor our services to meet your specific needs, ensuring you get the right balance of guidance and management.

COMPETITIVE EDGE

Holding DCC certification signals to the MOD and prime contractors that your security posture meets defence-grade standards — opening doors to contracts and frameworks that require supplier assurance.

What is Defence Cyber Certification?

The Defence Cyber Certification (DCC) is the Ministry of Defence's new framework for supplier cyber assurance. Developed in partnership with IASME, it replaces the previous "per-contract" self-assessments with a robust, whole-organisation standard.

It assesses your entire organisation's ability to withstand cyber threats, covering not just IT systems but also Operational Technology (OT), physical security, and personnel.

Based on DEF STAN 05-138

Aligned with the latest UK defence standards for cybersecurity.

Requires Cyber Essentials

Builds upon the solid foundation of Cyber Essentials certification.

CERTIFICATION LEVELS

Periculo supports organisations across all four DCC levels, from Level 0 through Level 3. We're currently authorised to certify Levels 0 - 3.

FEATURE

Level 0

Level 1

Level 2

Level 3

Risk Profile

Very Low

Low / Moderate

Moderate / High

High / Critical

Focus

Basic Cyber Hygiene

Enhanced Organizational Security

Advanced Security & Assurance

Highest Assurance / Mission Critical

Controls

3 Key Controls

101 Comprehensive Controls

Expanded Control Set

Full / Highest Control Set

Prerequisite

Cyber Essentials (Basic)

Cyber Essentials Plus

Cyber Essentials Plus + Evidence Pack

Assessment Type

Self-Assessment + Review

Assessment + Validation

Independent Assessment

Choose Your Path to Compliance

Periculo supports you whether you are ready for an audit or need help getting there.

(Note: As an accredited Certification Body, we maintain strict separation of duties. We cannot audit work we have implemented.)

Periculo as Your Auditor

For organisations ready for certification

As an official IASME Certification Body, we conduct the formal assessment to certify your organisation against DEF STAN 05-138.

OFFICIAL LEVEL 0 -3 ASSESSMENTS
INDEPENDENT VERIFICATION
FAST AUDIT PROCESS

Periculo as Your Implementer

For organisations needing guidance & support

Our expert consultants work alongside your team to build the governance, policies, and controls required for compliance. We support every DCC level, from Level 0 through Level 3.

GAP ANALYSIS & READINESS ASSESSMENT
POLICY WRITING & CONTROL IMPLEMENTATION
DCC MANAGED SERVICE (ONGOING SUPPORT)

DCC Managed Service

We provide comprehensive cybersecurity solutions to the defence sector, helping organizations meet the stringent requirements of the Defence Cyber Scheme and other government standards. Our services include supplier assurance, securing sensitive data, and ensuring the resilience of critical defence infrastructure. We help you navigate the complexities of defence procurement and maintain a robust security posture in an ever-evolving threat landscape.

Why choose Managed Service?

EXPERTISE ON DEMAND

Access to senior cyber security consultants without the headcount cost.

RISK REDUCTION

Proactively identify and close security gaps before they become compliance failures or costly breaches.

SIMPLIFIED AUDIT

We manage the evidence, documentation, and liaison with your certification body, so audit day is straightforward.

PRICING

Managed Service from

£3,000

Per Month

Your Path To Certification

We don’t just do audits; we can manage your certification. Our team guides you through every step of the journey.

Readiness Assessment

WE ASSESS YOUR CURRENT SECURITY POSTURE AGAINST DCC REQUIREMENTS AND IDENTIFY WHAT'S NEEDED TO GET AUDIT-READY.

Gap Analysis

WE PINPOINT SPECIFIC GAPS BETWEEN YOUR EXISTING CONTROLS AND THE DCC LEVEL YOU'RE TARGETING, THEN PRIORITISE REMEDIATION.

Implementation

Our experts help you prepare the necessary evidence and documentation to demonstrate compliance.

Certification

We conduct the final assessment and, upon success, issue your official DCC certificate.

Testimonials

We had a great experience working with Periculo for our Cyber Essentials Plus certification. From the very beginning, their team was incredibly responsive, supportive, and approachable, which made the preparation phase smooth and efficient.

They were always available to answer our questions, clarify requirements, and help us feel fully prepared before the audit.

NASSOS KATSAMANIS // AUXILIS.AI

FAQ’s

What is the difference between DCC and Cyber Essentials?

Cyber Essentials focuses specifically on internet-connected IT infrastructure. DCC is broader, covering the "whole organization," including air-gapped systems, physical security, OT, and HVAC systems that are essential for operations.

Do I need Cyber Essentials Plus for Level 1?

What happens if I fail the assessment?

How long does a certification last?

Would an assessor be able to implement and audit my DCC certification?

What happens if gaps are found during the assessment?

Does DCC apply to my subcontractors?

How does DCC differ from ISO 27001?

What is the cost of certification?

What is the "Scope" of the certification?

How long does the assessment take?

When is the DCC Level 0 deadline for MoD suppliers?