Defence Cyber Certification (DCC): 5-Step Supplier Guide

If you’re a supplier in the defence sector, you will already know how vital strong cyber security is in supporting the UK Ministry of Defence (MOD) in meeting its objectives. The UK MOD expects its supply chain to safeguard its sensitive information and maintain resilience against evolving threats. Failing to meet DCC requirements could result in lost MOD contracts and reputational damage across the defence supply chain. That’s where the Defence Cyber Certification (DCC) scheme comes in.

Achieving DCC certification isn’t a box-ticking exercise – it is a significant commitment to ensuring that the MOD’s capabilities remain on point, in an increasingly uncertain world. More importantly, it demonstrates that your organisation can be trusted to continue to provide the support the MOD needs to achieve its mission objective globally. However, understanding what’s required from the DCC and navigating the path to certification can be daunting.

The good news? You don’t have to tackle it alone. We at Arcanum specialise in helping organisations like yours prepare for DCC certification with clarity and confidence.

 

What is Defence Cyber Protection Certification (DCC)

The DCC scheme is the MOD’s cyber security assurance process for its suppliers. Alongside the Defence Standard 05-138 Issue 4, it sets out the security controls organisations must have in place to protect defence information and services.

There are different levels of certification, depending on the cyber risk associated with your work:

• Level 0 – Very low level of assessed cyber risk to a Supplier delivering an output. It requires Supplier organisations to demonstrate basic cyber security practices.
• Level 1 – Low to moderate level of assessed cyber risk to a Supplier delivering an output. It requires Supplier organisations to demonstrate a comprehensive cyber security programme with good practices.
• Level 2 – High level of assessed cyber risk to a Supplier delivering a contracted output. It requires Supplier organisations to demonstrate advanced cyber security oversight and planning which drives robust organisational and cyber practices.
• Level 3 – Substantial level of assessed cyber risk from a Supplier delivering a contracted output. Requires Supplier to demonstrate expert cyber security capabilities that fully take advantage of the ‘defence in depth’ methodology.

These Risk Profiles are defined by the Cybersecurity Model version 4.

 

The 5-Step Supplier Guide to Certification (and How We Help You)

Getting certified can feel overwhelming at first, but when broken down into five steps, the process becomes much more manageable. These steps are:

1. Define Your Scope

Remember, DCC isn’t just about the service you provide the MOD, it applies to your whole organisation. That means the people, processes, technology, physical and data assets used by your organisation may be required to be included in the scope of the DCC. At Arcanum, we help you translate this requirement into what it means for your organisation, so you know exactly what needs to be covered.

2. Gap Analysis

The next step is understanding where you stand against the DCC requirements. We can help you assess this, explain where the shortfalls are and, crucially, how you can meet the requirements in your specific context, showing you what’s achievable and realistic for your organisation.

3. Remediation

Once gaps are identified, it’s time to address them. We can provide clear technical advice, help you develop and refine processes, and create the documentation and supporting evidence you’ll need to demonstrate compliance.

4. Audit Preparation

For many organisations, the audit itself is the most daunting step. Your staff may not be used to being audited, and evidence gathering can feel overwhelming. We help prepare your teams by building confidence, providing advice and guidance, and reviewing your evidence package so everything is “audit ready”.

5. Certification

Finally, you’re ready to achieve certification. We can help you with this process by being present throughout, providing advice and guidance on any particularly difficult areas that you may be struggling to evidence.

Did you know?

DCC certification is valid for 3 years but requires ongoing compliance checks.

Common Defence Cyber Certification Challenges

We’ve worked with organisations across the defence supply chain and with other similar certifications, and we see the same challenges come up time and again:

• Scoping too narrowly and missing key areas of the organisation.
• Assuming existing cyber certifications (such as Cyber Essentials) are enough.
• Underestimating the need for robust policies and documentation.
• Staff unprepared for the scrutiny of an audit.

The result? Delays, unexpected costs, and increased risk of failing the assessment.

 

 

How We Support You

Our role is to make the journey straightforward and achievable. We:

• Translate DCC requirements into language and actions relevant to your organisation.
• Provide expert advice on remediation, documentation, and evidence-building.
• Build staff confidence in supporting an audit.
• Ensure you approach certification with no surprises.

With us by your side, you won’t just be “compliant” — you’ll be prepared, confident, and ready to demonstrate your cyber resilience to the MOD.

 

---

 

Find out more and get in touch on our DCC page.