Having covered what assessors are looking for, it is worth being direct about where organisations most commonly fall short. The challenges we see are rarely about capability. In most cases, organisations have the controls in place. What lets them down is preparation, documentation, and consistency.
Challenge 1: Readiness for Assessment
Often, challenges during assessments aren’t due to a lack of controls or capability but arise because organisations start before they’re truly ready. This is rarely deliberate, DCC is still quite new, so it’s understandable that organisations are adjusting to its requirements.
A frequent issue is that organisations haven’t had enough time to thoroughly review the IASME guidance prior to beginning their assessments. This guidance is designed to clarify what’s expected at every step, and following it early on can help things run much more smoothly.
Another common challenge involves scoping. DCC mandates having a formally documented scope. Without this, assessors lack a clear starting point. Sometimes, even when the scope is documented, it focuses solely on systems and functions directly tied to MOD delivery and overlooks wider business functions crucial for ongoing operations. Since DCC considers the organisation as a whole, the scope should reflect that perspective.
Fortunately, none of these difficulties are unmanageable. With proper preparation, they can almost always be avoided.
What helps:
- Engage with IASME guidance as a first step; it is there to make the process clearer
- Treat scoping as the foundation of your submission, not something to return to later
- Use the NCSC Five Lens model as a structured starting point for defining scope
- A readiness review before committing to assessment can save considerable time, cost, and rework
Challenge 2: Weak or Missing Evidence
Controls may be in place and operating effectively, but if you cannot demonstrate that to an assessor, it does not count. Evidence is where many otherwise well-prepared organisations come unstuck.
Evidence not linked to controls: A common pattern is organisations presenting a body of documentation without clearly mapping it to the specific control it is intended to satisfy. Assessors are not there to piece together the picture for you. If the link between your evidence and the control requirement is not explicit, it creates doubt.
Evidence incomplete or outdated: Evidence that is partial, expired, or no longer reflects the current state of your environment will not satisfy an assessor. A policy last reviewed two years ago, logs that cover only part of the scope, or screenshots from a system that has since been replaced — none of these demonstrate that controls are currently operating as described.
Potential solutions:
- Build an evidence map that explicitly links each piece of evidence to the relevant control
- Establish a review cycle for all documentation and evidence before assessment
- Ask yourself: does this evidence demonstrate that the control is operating today, across the full scope?
- Tell your story clearly – do not expect the assessor to find it
Challenge 3: Poor Documentation
Documentation is the primary lens through which you make your case to the assessor. When it is unclear, generic, or disconnected from reality, it undermines the entire submission.
The ASR is unclear: The ASR is one of the most important documents in your submission. An assessor reading your ASR should be able to clearly understand your organisation, your scope, and how your controls operate. If it is full of Yes and No answers or reads like it could apply equally to any organisation, it is not doing its job.
Documentation does not reflect reality: Policies and procedures that describe an idealised version of how things should work, rather than how they actually work, create an immediate credibility problem. Assessors will test documentation against what they find in practice. Where those two things do not align, the result is typically a non-conformity.
Potential solutions:
- Be detailed. Write the ASR as a narrative specific to your organisation
- Review all policies and procedures against actual practice before submission
- Where a gap exists between what is documented and what is done, fix the practice or fix the document
- Have someone outside the core project team review documentation for clarity and accuracy
Challenge 4: Staff Unprepared for Assessment
The assessment process is not limited to documentation review. Assessors will want to speak to people across the organisation. This is where many submissions that look strong on paper begin to unravel.
Inconsistent responses undermine credibility: When staff answers contradict what has been documented in the ASR, or conflict with what colleagues have said, it raises a fundamental question about the reliability of the entire submission. A single misaligned response can cast doubt on controls that are otherwise well evidenced.
Inaccurate evidence may be presented inadvertently: Unprepared staff do not set out to mislead assessors. But when individuals are asked about controls or processes, they are not familiar with, they may describe things incorrectly, either overstating or understating what is actually in place. Either outcome creates a problem.
Potential solutions:
- Brief all relevant staff before assessment
- Ensure that control owners and asset owners understand what has been documented and can speak to it accurately
- Conduct internal walkthroughs or mock interviews to identify gaps between documentation and understanding
- Make it clear to staff that it is acceptable to say “I don’t know, but I can find out”
The Common Thread
Across all four of these challenges, the pattern is the same. The issue is rarely technical. It is structural, organisational, and about preparation. Organisations that pass DCC first time are not necessarily those with the most mature environment, they are the ones that understood what was required, prepared accordingly, and presented their case clearly and consistently.
If you’re working through the Defence Cyber Certification at the moment and are encountering some of these common DCC challenges, we can help. Join our upcoming webinar on Wednesday 13th May 2026 to get started. Register your interest here.