A Smarter, Stronger Approach to Cyber Assurance
Cyber security in the UK defence sector is evolving and so is the way suppliers prove their readiness. With the latest changes to the MOD Defence Cyber Certification (DCC) scheme, suppliers will now undergo a single assessment that provides certification valid for three years, granting them eligibility to apply for Ministry of Defence contracts. This shift streamlines the assurance process, replacing the previous requirement to complete a Supplier Assurance Questionnaire (SAQ) on a contract-by-contract basis. The certification framework consists of four levels (0, 1, 2, and 3), with Level 3 representing the highest standard of cyber security readiness.
What’s new in the DCC Scheme?
While the fundamental security controls outlined in Defence Standard (DefStan) 05-138 remain unchanged, the method of assessment has evolved to focus more on organisational security practices. This means that suppliers must demonstrate compliance through structured governance and documentation, rather than simply answering a questionnaire.
Key updates:
- Applicant Guide – A critical document that outlines how a supplier conforms to the required DefStan 05-138 controls.
- Greater Emphasis on Organisational Control – Cyber resilience is now assessed holistically, ensuring suppliers embed security practices across their operations rather than merely implementing technical safeguards.
- Three-Year Certification Validity – Get certified once and stay certified for three years, reducing the administrative burden and freeing suppliers up to focus on winning MOD contracts.
How Suppliers Can Prepare
Achieving certification requires suppliers to develop a clear, robust security plan that clearly demonstrates how they meet DefStan 05-138 requirements.
Certification isn’t just a checkbox exercise. It’s a commitment.
It’s about building practical security measures that align with risk management best practices. How Arcanum can support you:
- Pre-assessment consultations to ensure documentation and processes meet certification standards.
- Applicant Guide Development to align your business with DCC requirements.
- Tailored advisory services to help suppliers embed security resilience into their operations.
Why Certification Matters
With cyber threats continuing to evolve, MOD suppliers must be proactive in demonstrating security maturity. The new DCC scheme ensures that organisations don’t just claim compliance—they prove it through strategic, long-term cyber risk management. If you’re preparing for a DCC assessment, as one of the five cyber security consultancies selected to pilot the scheme, Arcanum is here to support you.
Get in touch to discuss how we can help you achieve certification and secure your place in the MOD supply chain.