.tmb-banner.png?sfvrsn=e7c4da07_0)
Defence Cyber Certification (DCC)
DCC is an opportunity to demonstrate cyber resilience and trusted assurance across your organisation. Bridewell helps defence suppliers define scope, identify and remediate gaps, prepare evidence, and achieve certification.
Bridewell was one of the original five certification bodies selected to partner with IASME to develop and deliver the DCC scheme, we were also among the first organisations to achieve DCC Level 2 certification and the first to issue a DCC Level 3 certification in the UK.
What is DCC?
Defence Cyber Certification (DCC) is the UK Ministry of Defence and IASME cyber security certification framework for defence suppliers. It assesses an organisation against Defence Standard 05-138 Issue 4 and provides a single, organisation-level assurance of cyber resilience.
DCC is more than just a certificate, it provides organisation-level assurance that your cyber security arrangements meet the level expected for relevant UK defence contracts. It gives customers and partners a consistent way to understand your cyber resilience, while helping your organisation focus investment on the controls, evidence and governance that matter most.
- Support defence opportunities Present a recognised, organisation-level certification in support of relevant UK defence procurements.
- Replace repeated assurance activity Move away from completing separate Supplier Assurance Questionnaires for individual contracts where DCC applies.
- Strengthen cyber resilience Use the assessment to identify weaknesses, improve governance and embed stronger security practices across the organisation.
- Maintain assurance over time Certification is supported by annual attestation and full recertification every three years.
What are the 4 Levels of DCC?
There are 4 levels of DCC Certification which align to the Cyber Risk Profile set for each MOD or Prime Supplier Contract:
| Level 0 | Level 1 | Level 2 | Level 3 | |
|---|---|---|---|---|
| Controls/pre-reqs | 3 Controls + Cyber Essentials | 101 Controls + Cyber Essentials | 139 Controls + Cyber Essentials Plus | 144 Controls + Cyber Essentials Plus |
| Cyber Risk Profile | Very Low / Low | Low to Moderate | Moderate to High | High to Very High |
| Capability | Basic cyber security practices Forms the foundation level for all future assessments | Developing cyber security capabilities, building on core controls to strengthen organisational resilience | Mature cyber security capabilities, ensuring full coverage and proactive risk management | Expert cyber security capabilities Demonstrates Defence in Depth to protect against new/emerging threats |
| Assessment | IASME portal Evidence shared on a call or made available on the applicants own environment (SharePoint etc.) | Applicant profile created Evidence submitted via ASR; made available and retained on applicant’s system for 3.5 years from certification date | Applicant profile on IASME DCC Portal but evidence would be made available and retained on applicant’s system for 3.5 years from certification date. | Applicant profile on IASME DCC Portal but evidence would be made available and retained on applicant’s system for 3.5 years from certification date. |
| Pass Mark | 100% | 80% | 80% | 100% |
What is the Impact of DCC?
In a sector facing increasing supply chain risk to national security, along with the pressures for sales teams to quickly and effectively win business, DCC offers a streamlined approach to demonstrate supplier assurance.
Replaces Per Contract SAQs
DCC replaces the requirement to conduct a supplier assurance questionnaire for each defence contract your organisation is bidding for.
Retain Your Status For 3 Years
Once you have certified to a DCC level, you retain the status for 3 years with a short annual attestation.
Aligns With Other International Standards
DCC is fully aligned with international standards and DefStan 05-138, meaning you may have many controls already in place reducing additional overhead.
DCC is Available in 4 Levels
Each level is commensurate with the cyber risk profile of the contract an organisation may bid for.
Who is Affected by DCC?
Any organisation that supplies goods, services, or software to the UK Ministry of Defence (MOD) needs to use Defence Cyber Certification (DCC). This includes contractors and sub-contractors handling anything from basic supplies to highly sensitive data.
Start Your Defence Cyber Certification Journey
Speak with one of our consultants to see how we can support your organisation with this framework.
How Bridewell Can Help With DCC?
Whether you're just starting your DCC journey or are ready to pursue certification, Bridewell provides support at every stage. From defining your scope and understanding your obligations, through to identifying gaps and achieving certification, our DCC specialists help you navigate the process with confidence.
One of the most common challenges organisations face is determining what should and should not be included within their DCC assessment scope. Our specialists help you establish a clear, defensible scope that aligns with MOD requirements and supports successful certification.
- DCC scope definition and justification
- Identification of in-scope systems, services and personnel
- Alignment with Cyber Essentials and Cyber Essentials Plus requirements
- Review of third-party and supply chain dependencies
- Scoping workshops
Before committing to certification, we help organisations assess their current level of compliance against the target DCC level. Through a structured gap assessment, we identify weaknesses, validate existing controls and provide a clear remediation roadmap.
Assessment against the target DCC level
- Control and evidence review
- Identification of compliance gaps and risks
- Prioritised remediation roadmap
- Evidence collection guidance
- Support with governance, ownership and accountability
- Certification readiness review
As one of the original certification bodies selected to help develop and deliver DCC, Bridewell can independently assess your organisation and guide you through the certification process.
- Assessment planning and mobilisation
- Review of the Assessment Submission Record (ASR)
- Theoretical and practical assessment activities
- Evidence validation and stakeholder interviews
- Findings and certification reporting
- Certification decision and issuance
- Annual attestation and recertification support
See How We've Helped Customers with Other Cyber Frameworks
.jpg?sfvrsn=be1b45a6_1 "Azets 600 x 500px Thumbnail (1)")
"Throughout the project, Bridewell were easy to work with and managed the project effectively. In particular, we benefitted from the weekly meetings they held with our control owners to review progress against our KPIs and assign tasks to ensure we k
/alfa.png?sfvrsn=8fa4b044_1 "Alfa")
"Bridewell was extremely knowledgeable and efficient. They looked at what we had in place and then made recommendations on where we needed to improve, what documentation was needed to support that, and what additional training we needed.
/attraqt.jpg?sfvrsn=57a20bd6_1 "attraqt")
“The project has been very successful, but we recognise that getting the certification is only the first step. Bridewell has been a valuable addition to our team over the last six months."
Why Choose Bridewell for DCC?
DCC Experts
One of the original five certification bodies. We can support scoping, readiness, remediation planning, Cyber Essentials and Cyber Essentials Plus, assessment, certification and ongoing maintenance through clearly separated service routes.
Experienced in complex environments
Our consultants work with critical national infrastructure, government, defence and highly regulated organisations where scope, evidence, governance and operational reality all matter.
Framework expertise
Across DCC, DefStan 05-138, CE/CE+, ISO27001, SOC, NIST, CAF Where gaps extend beyond governance, Bridewell can draw on specialist cyber security capabilities across cloud, operational technology, testing, incident response and managed security.
Defence Sector Expertise
As CNI experts, we have a strong understanding of the defence sector and its supply chain.
Industry Accredited
One of the original five certification bodies. The first to achieve DCC Level 2, and the first to award DCC Level 3.
A Close Partner with IASME
We work closely with IASME, giving us a thorough understanding of the framework.
Further Support and Resources
For additional guidance, you can refer to: IASME DCC Help & Guidance