DEFCON 658 and Defence Cyber Certification (DCC) Levels 0 and 1 for MOD Suppliers

DEFCON 658 is the Defence Condition that puts cyber security requirements into Ministry of Defence (MOD) contracts, and Defence Cyber Certification (DCC) is the independent way to show you meet them. The MOD assesses the cyber risk of a contract, assigns a Cyber Risk Profile from Level 0 to Level 3, and the supplier must meet the controls that Defence Standard (DEF STAN) 05-138 Issue 4 sets for that level. Cyber Essentials is required at every level and Cyber Essentials Plus at Levels 2 and 3.

Sovereign Secure is listed on IASME’s Network Directory as a certification body for Defence Cyber Certification Levels 0 and 1 (checked 13 October 2026). We also certify Cyber Essentials and Cyber Essentials Plus, the base of every level. We are not listed for Levels 2 and 3, so for those you need a different certification body. The rest of this page explains the rules using MOD sources published on GOV.UK and IASME’s scheme pages.

What do we certify for MOD suppliers?

What is DEFCON 658?

DEFCON 658 (Cyber) is a standard MOD contract condition. The MOD’s Cyber Security Model guidance describes it as laying out the contractual terms for the model, and says suppliers are contractually required to meet the DEF STAN 05-138 controls. It also requires suppliers to pass its obligations down to their subcontractors. Read the version of DEFCON 658 in your own contract, because the MOD has updated the condition since earlier contracts were let. The model grew out of the Defence Cyber Protection Partnership (DCPP), a joint MOD and industry initiative to protect the defence supply chain.

The Cyber Security Model has four parts:

1. Risk Assessment. An MOD Delivery Team assesses the contract and generates a Cyber Risk Profile and a Risk Assessment Reference (RAR), usually given to bidders in the invitation to tender.
2. DEF STAN 05-138 controls. The standard lists the controls required at each Cyber Risk Profile.
3. Supplier Assurance Questionnaire (SAQ). The supplier self-assesses against its profile through the Supplier Cyber Protection Service, an online service in public beta since November 2025. The questionnaire is scored automatically, and suppliers repeat it each year on the contract’s anniversary.
4. Flow down. Suppliers run their own Risk Assessment for each subcontract and pass the requirements on.

A supplier that cannot meet its profile submits a Cyber Improvement Plan setting out when it will comply, and the plan becomes part of the contract. Industry Security Notice (ISN) 2025/07 reinstated the full model, as version 4, from 3 December 2025, ending interim arrangements first introduced in 2021.

What is DEF STAN 05-138?

DEF STAN 05-138 is the MOD’s Cyber Security Standard for Suppliers. Issue 4, dated 14 May 2024, replaced the Very Low to High profiles of Issue 3 with four Cyber Risk Profiles, Levels 0 to 3, and new controls at each level. ISN 2024/02 first published it “for information only”; ISN 2025/07 withdrew that status, and ISN 2026/01 replaced its covering narrative in March 2026 to clarify the scope.

Two points make Issue 4 different from earlier issues:

• It covers the whole organisation. As clarified by ISN 2026/01, the requirements apply to the cyber resilience of the supplier’s business-critical operations across the supplier as a single legal entity, not only to the information the MOD hands over for one contract.
• It follows the NCSC’s structure. Beyond the Cyber Essentials controls, the requirements sit under the same four objectives as the NCSC Cyber Assessment Framework: managing security risk, protecting against cyber attack, detecting cyber security events, and minimising the impact of incidents.

For each control, the standard expects a documented and implemented control with auditable evidence. Where a control may not reasonably apply to your organisation, ISN 2026/01 says to discuss it with your DCC certifying body, and to use the Cyber Improvement Plan process to flag potential non-compliance on a contract.

What are the Defence Cyber Certification levels?

Defence Cyber Certification has four levels that match the four Cyber Risk Profiles. IASME runs the scheme for the MOD, so it is often called IASME DCC.

Sources: DEF STAN 05-138 Issue 4 (14 May 2024), clause 2.2 and Table 1, for the control counts and Cyber Essentials requirements; ISN 2026/01 (30 March 2026) for the level names and risk descriptions; ISN 2026/02 (30 March 2026) for the right-hand column. Last checked 13 October 2026.

Other scheme facts worth knowing:

• Who runs it. The MOD developed the scheme with IASME, which acts as its Certification Authority and delivers it through IASME-assured certification bodies. Our guide to IASME explains its other schemes.
• When it started. The MOD dates the launch to May 2025, a year after Issue 4 was published.
• What it certifies. The legal entity assessed, not a single contract. ISN 2026/01 says certification does not automatically extend across a wider corporate group unless a group-level arrangement is justified and approved through the certification authority. You can apply at any level whether or not you hold an MOD contract, and a supplier with contracts at different levels certifies at the highest one.
• How long it lasts. The MOD describes annual attestation with full recertification every three years. The Cyber Essentials or Cyber Essentials Plus certificate underneath it still renews every year.
• How the MOD treats it. Under ISN 2026/02, buyers must accept a current certificate at or above the required level as meeting the DEF STAN 05-138 control requirement. The MOD’s guidance says certificate holders are not yet exempt from completing the SAQ.

What do DCC Levels 0 and 1 require?

Level 0 (Basic) is normally assigned where the assessed cyber risk is very low. Its 3 controls are a Cyber Essentials certificate covering the scope the contract needs, compliance with UK GDPR, and resilient networks and systems. IASME describes it as basic cyber security practice and the foundation for every higher level.

Level 1 (Foundational) is normally assigned where the assessed risk is low to moderate. It rises to 101 controls covering areas such as governance, risk management, asset management, supply chain, security monitoring and incident handling, and IASME describes it as a comprehensive cyber security programme with good practices. Cyber Essentials is still the requirement; Plus is not needed until Level 2.

At both levels, according to IASME’s DCC FAQ:

• No level is a self-assessment. You answer each question, describe how you meet the control and provide evidence, and an assessor checks it.
• The scope is the organisation. It covers the functions and services your organisation needs to operate securely and resiliently, whether they support MOD work or not, and it stays the same at every level. Internet-connected devices inside that scope must be covered by your Cyber Essentials certificate.
• You can start at Level 1. You do not have to pass Level 0 first. Moving up later is a new assessment against the higher level’s controls, not a top-up of the extra ones.
• Paperwork differs. Level 0 needs no Assessment Submission Record; Levels 1 to 3 do.

Is Cyber Essentials enough for MOD contracts?

No, not where a contract carries DEFCON 658 with a Cyber Risk Profile or a Defence Cyber Certification level. Cyber Essentials is a requirement at every level, but it is never the whole requirement:

• Level 0 adds UK GDPR compliance and resilient networks and systems.
• Level 1 rises to 101 controls in total.
• Levels 2 and 3 need Cyber Essentials Plus, with its independent technical audit, within 139 and 144 controls respectively.

Scope matters too. DEF STAN 05-138 requires a Cyber Essentials certificate that covers the scope required for all aspects of the contract, maintained for the contract’s duration. A certificate scoped to one office or one subsidiary may not meet that test. For contracts outside defence, where Cyber Essentials alone is often the requirement, see is Cyber Essentials mandatory.

Is Defence Cyber Certification mandatory, and what are the deadlines?

Your contract decides. DEFCON 658 requires the controls; certification is a way to evidence them. IASME’s FAQ says DCC is not currently mandatory, and four published positions matter as of 13 October 2026:

• The MOD’s guidance says suppliers should expect an increasing requirement to hold valid certification for the duration of MOD contracts, specified as a tender condition.
• ISN 2026/01 says Level 0 certification is expected to become a baseline requirement for defence suppliers.
• ISN 2026/02 confirms that a current certificate at the right level is to be accepted as meeting the DEF STAN 05-138 control requirement.
• A Level 0 request. The MOD’s Director of Cyber Defence and Risk has asked all industry partners to achieve Level 0 Defence Cyber Certification by 31 December 2026, as published on the MOD’s Defence Digital blog in May 2026. The same post asks suppliers to set subcontractor timescales appropriately, with higher levels at lower tiers of the supply chain scheduled after that date.

At the time of our check, the 31 December 2026 date appeared on the blog rather than in an Industry Security Notice. Treat it as the MOD’s stated expectation and confirm with your Delivery Team or prime contractor what your contract requires.

Who sets your level: the MOD or the prime contractor?

It depends on where you sit in the supply chain.

• Direct MOD contracts. The MOD Delivery Team runs the Risk Assessment and provides the Cyber Risk Profile and RAR at the earliest market engagement, usually in the tender.
• Subcontracts. The prime contractor, or the supplier above you, runs its own Risk Assessment and sets your profile. On existing contracts, it needs its own version 4 profile and RAR from its customer before it can flow requirements down.
• Existing contracts. Suppliers are notified of their version 4 profile before the contract’s anniversary. If you have not received one, ask your Delivery Team or buyer. Older profiles under Issue 3 do not map directly onto the new levels.

How does Defence Cyber Certification work with us?

1. Confirm your level. Get your Cyber Risk Profile and RAR from your buyer or prime. If it is Level 0 or 1, we can certify you; if it is Level 2 or 3, we will tell you so at the start.
2. Put Cyber Essentials in place. Your certificate must be current and cover the internet-connected parts of your DCC scope. If it doesn’t, we certify Cyber Essentials first, and our Cyber Essentials consultancy can help you get there.
3. Agree your scope early. IASME strongly recommends discussing scope with your certification body before you submit, to avoid under-scoping. You record it in a Statement of Scope that explains what is in and out and how it lines up with your Cyber Essentials scope.
4. Answer the questions with evidence. Download IASME’s Applicant Guide for your level, plus the Assessment Submission Record for Level 1, and gather policies, records and configuration evidence for each control.
5. Theoretical scoring. Our assessor reviews your descriptions and evidence and may give you a clarification round to fix gaps before the scored stage.
6. Practical scoring. Our assessor verifies that the controls work as you describe, using samples chosen at assessment.
7. Certificate and upkeep. You receive a digital certificate and verifiable badge for your level. Then attest every year, renew Cyber Essentials every year and recertify DCC every three years.

IASME’s rules keep assessment independent: a certification body can help you identify gaps, but if it is also your DCC assessor it cannot implement or manage your security controls. If you need hands-on remediation, use your own IT team or provider, and use independent cyber security testing where you want proof that technical controls work.

What about DCC Levels 2 and 3?

Sovereign Secure is not listed for Levels 2 and 3, so we do not assess or issue certificates at those levels. Search IASME’s Network Directory for a body listed for your level, or register your interest on IASME’s Defence Cyber Certification page, which sends a list of certification bodies that can assess to the level you need. We can still certify the Cyber Essentials Plus certificate that both levels require.

How much does Defence Cyber Certification cost?

IASME publishes no standard price. Its FAQ says certification bodies set prices with each applicant, because the work depends on:

• the size and complexity of your organisation;
• your current security posture and how prepared you are;
• your proposed scope;
• the level you need.

We quote in writing after a scoping call. Cyber Essentials or Cyber Essentials Plus is priced separately if you don’t already hold it.

Why Sovereign Secure?

• Certification body for DCC Levels 0 and 1. Listed on IASME’s Network Directory for both, checked 13 October 2026.
• The foundation in-house. We are an IASME-licensed certification body for Cyber Essentials and Cyber Essentials Plus, and for IASME Cyber Assurance.
• An established company. Sovereign Secure Ltd was incorporated in 2012, is ISO 27001 certified and is a PCI SSC Qualified Security Assessor (QSA) company.

Bidding for or delivering an MOD contract?

Tell us your Cyber Risk Profile, the contract or tender deadline and whether you hold Cyber Essentials, and we will confirm the route and quote for Level 0 or Level 1 certification. Use the form below, where “Defence Cyber Certification (DCC)” is already selected, or call +44 161 523 5276. Contact us for anything else.