Defence Cyber Certification and Def Stan 05-138, without the guesswork
The MOD now expects suppliers to evidence cyber controls through independent certification rather than self-declaration. We get you ready for the right Defence Cyber Certification (DCC) level for your contracts – and keep you there.
Contract risk sets the bar. Certification proves you meet it.
Under the MOD Cyber Security Model (CSM v4), each contract is risk-assessed and given a Cyber Risk Profile. Def Stan 05-138 Issue 4 sets out the controls required for each profile, and the Defence Cyber Certification scheme – run with IASME – independently verifies that those controls are in place across your organisation.
DCC is structured in four levels, 0 to 3, with requirements increasing at each level and building on Cyber Essentials or Cyber Essentials Plus. One certification covers contracts at or below your certified level, so getting the level right matters.
Cyber Security Model
The MOD’s risk assessment of the contract, which determines the Cyber Risk Profile.
Def Stan 05-138
The defence standard defining the controls you must implement for that profile.
Defence Cyber Certification
Independent, organisation-wide verification that the controls are implemented and working.
Cyber Essentials
The baseline – Cyber Essentials or Cyber Essentials Plus underpins every DCC level.
From first assessment to certification and beyond
Scope and level
- Review of your contracts and Cyber Risk Profiles
- Confirm which DCC level you need, and when
- Define the organisational scope sensibly
Gap analysis
- Assessment against Def Stan 05-138 Issue 4 controls
- Cyber Essentials / Plus readiness check
- Prioritised, costed remediation plan
Implementation
- Policies, procedures and security plan
- Technical control guidance with your IT team or provider
- Incident response, access control and asset management
Evidence pack
- Control-by-control evidence mapping
- Records that stand up to independent assessment
- Mock assessment before the real one
Supply chain cyber
- Flow-down of cyber requirements to your suppliers
- Supplier cyber questionnaires and evidence review
- Tracking of supplier Cyber Essentials and DCC status
Stay certified
- Support through annual check-ins and recertification
- Internal audits of cyber controls
- Change management as your business evolves
ISO/IEC 27001 alongside DCC
Many defence suppliers need both. Def Stan 05-138 controls align closely with ISO/IEC 27001, so we design one information security management system that serves both – no duplicated policies, one set of evidence.
ISO/IEC 27001CMMC for US defence programmes
Supplying into US Department of Defense programmes? Our CMMC-qualified team supports readiness against CMMC and NIST SP 800-171, mapped against your UK obligations so the effort counts twice.
Talk to us about CMMCDefence cyber FAQs
Do we need Defence Cyber Certification?
It depends on the Cyber Risk Profile of the contracts you hold or bid for. The MOD has signalled that suppliers should increasingly expect to hold valid DCC certification for the duration of their contracts, so it is sensible to plan for it now.
We already have Cyber Essentials – is that enough?
Cyber Essentials or Cyber Essentials Plus is the foundation of every DCC level, but higher levels add further Def Stan 05-138 controls on governance, technical security and resilience. A gap analysis will show exactly what is missing.
Does ISO 27001 certification cover DCC?
No – they are separate schemes – but the controls overlap substantially. If you hold ISO 27001, much of your evidence can be reused, and we map it directly to Def Stan 05-138.
How long does it take?
It depends on your level, size and starting point. After a short scoping review we give you a realistic plan and timeline – not a generic promise.
Know your level. Close the gaps.
Start with a DCC readiness review: your contract requirements, current position against Def Stan 05-138 and a clear plan to certification.