Defence & MOD Supply Chain Cybersecurity

Defence Cyber Certification (DCC) for MOD suppliers

Q: What is Defence Cyber Certification (DCC)?

Defence Cyber Certification (DCC) is an organisation-wide cyber security certification framework developed by the UK Ministry of Defence with IASME. It provides independent assurance that a supplier has implemented the controls in Defence Standard 05-138 (Issue 4) at the level for which it is certified. DCC has four levels (0 to 3) matched to the cyber risk of a supplier's role in the MOD supply chain, with certification valid subject to annual attestation and re-certification every three years.

Q: What are the four DCC levels?

DCC has four levels. Level 0 is the entry baseline for suppliers at very low cyber risk. Levels 1, 2 and 3 apply as the cyber risk profile of the contract increases. All levels start with Cyber Essentials, and Levels 2 and 3 also require Cyber Essentials Plus. Certification at a higher level satisfies the requirements of lower levels, but not the reverse.

Q: Does Periculo certify all DCC levels?

Yes. Periculo is an IASME-licensed Certification Body delivering DCC readiness, assessment and certification at Levels 0, 1, 2 and 3 (Level 3 via the Hybrid Level 2/3 route), assessed against Def Stan 05-138 Issue 4, alongside Cyber Essentials, Cyber Essentials Plus and CREST penetration testing for defence suppliers.

Periculo is a CREST-accredited cybersecurity consultancy and IASME-licensed certification body specialising in digital health, defence, and AI. We deliver Defence Cyber Certification (DCC) at every level — Levels 0, 1, 2 and 3 — for the UK Ministry of Defence supply chain, assessed against Def Stan 05-138 Issue 4.

What is Defence Cyber Certification (DCC)?

DCC is an organisation-wide cyber security certification framework developed by the UK Ministry of Defence (MOD) with IASME. It provides independent assurance that a supplier has implemented the controls set out in Defence Standard 05-138 (Issue 4) at the level for which it is certified. Unlike per-contract self-assessment, DCC assesses the overall security and resilience of your organisation — one certificate you can present across multiple defence procurements, subject to annual attestation and re-certification every three years.

DCC Level 0 baseline: 31 December 2026

The MOD's Director of Cyber Defence and Risk has asked all defence industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials for applicable business-critical systems. IASME still describes DCC as not universally mandatory, so treat this as the operational baseline for the supply chain. Certification Body capacity is finite and demand is concentrating through 2026 — early certification is a competitive differentiator at tender.

DCC services we offer — Levels 0 to 3

Periculo delivers DCC readiness, independent assessment and certification at every level of the framework. The level you need is set by the cyber risk profile the MOD or your prime contractor assigns to the work; certification at a higher level satisfies the requirements of lower levels.

DCC Level 0 — the entry baseline for suppliers assessed at very low cyber risk. Cyber Essentials sits at its core. This is the level MOD has asked all industry partners to hold by 31 December 2026.
DCC Level 1 — independent assessment and certification for the next tier of cyber risk, building on Cyber Essentials.
DCC Level 2 — higher-assurance assessment and certification; requires Cyber Essentials Plus.
DCC Level 3 — our highest-tier service for the most sensitive defence work, delivered via the mandatory Hybrid Level 2/3 route; requires Cyber Essentials Plus.

Cyber Essentials & Cyber Essentials Plus for defence suppliers

Cyber Essentials is the non-negotiable prerequisite at the core of every DCC level, and Cyber Essentials Plus is required at Levels 2 and 3. As an IASME-accredited certification body for both CE and CE+, Periculo can get the prerequisite in place and carry you through to DCC certification with one team — avoiding the delays that come from unprepared scoping or missing Cyber Essentials coverage.

CREST penetration testing for defence

Alongside DCC, Periculo provides CREST-accredited penetration testing for defence and MOD supply-chain organisations — networks, web applications, cloud environments, APIs and supporting infrastructure — with technical findings and executive summaries that stand up to procurement and prime-contractor scrutiny.

Who needs DCC?

Suppliers already delivering MOD contracts, at any tier of the supply chain.
Organisations bidding for future MOD or defence prime opportunities.
Subcontractors whose prime requires DEFSTAN 05-138 compliance under DEFCON 658.
Any organisation wanting to certify proactively ahead of the December 2026 baseline — you do not need a live MOD contract to apply.

Key facts

What it isMOD + IASME organisation-wide cyber certification, assessed against Def Stan 05-138 Issue 4
LevelsFour levels (0–3) matched to contract cyber risk; Periculo certifies all four
Level 0 baselineMOD-requested for all defence industry partners by 31 December 2026
PrerequisiteCyber Essentials at all levels; Cyber Essentials Plus at Levels 2 and 3
ValidityAnnual attestation, re-certification every three years
AccreditationIASME-licensed Certification Body; CREST-accredited testing

Common questions

When is the DCC Level 0 deadline?

The MOD has asked all defence industry partners to achieve DCC Level 0 by 31 December 2026. IASME still describes DCC as not universally mandatory, so it is best treated as the operational baseline for the supply chain.

What level of DCC do I need?

The level is assigned by the MOD or your prime based on the cyber risk profile of the work. Level 0 is the common baseline; Levels 1–3 apply as risk increases. A higher level satisfies lower-level requirements.

Does Periculo certify all DCC levels?

Yes — Levels 0, 1, 2 and 3 (Level 3 via the Hybrid Level 2/3 route), assessed against Def Stan 05-138 Issue 4, plus the Cyber Essentials and CE+ prerequisites.

Talk to Periculo

Whether you need DCC Level 0 to meet the December 2026 baseline, a higher level for a specific contract, or the Cyber Essentials and penetration testing that underpin it, Periculo supports MOD suppliers end to end — from one CREST-accredited team.

Website: www.periculo.co.uk
Email: info@periculo.co.uk

Book a consultation