Which DCC level do you actually need?
From 3 December 2025, new MOD risk assessments and supplier questionnaires run under Cyber Security Model v4 and Def Stan 05-138 Issue 4, and contracts that already carry DEFCON 658 move across at their annual review. Some suppliers are working towards Defence Cyber Certification Level 0 without having checked whether Level 0 is the level their contracts require. That check is worth doing first, because the gap between Level 0 and Level 1 is 98 controls. These twelve questions tell you where you stand. Nothing here is gated and we are not asking for your email.
Level 0 is three controls. Level 1 is 101.
Def Stan 05-138 Issue 4 sets the controls for each Cyber Risk Profile, and they do not scale gently. A supplier assessed at Level 0 and a supplier assessed at Level 1 are being asked for very different things.
The three controls at Level 0 are Cyber Essentials certification, GDPR-compliant processing of personal data, and building resilience into the design and operation of your systems. Vulnerability management, patch management, penetration testing, asset inventory and security monitoring are none of them. All of those begin at Level 1 or above.
Def Stan 05-138 Issue 4, Table 1 (Cyber Risk Profile Requirements Table)
The date is not the hard part
Certification takes as long as it takes to find an assessor, book the assessment, and fix whatever it surfaces. That queue gets longer the closer the deadline gets, and Defence has asked every industry partner to reach Level 0 by 31 December 2026. Counting backwards from that date is a more useful exercise than counting forwards from today.
- 01
Do you know which Cyber Risk Profile your contracts actually carry?
This is the question the other eleven depend on. DEFCON 658 sets a Cyber Risk Profile per contract, and ISN 2026/02 maps those profiles to DCC levels: certification at or above the level your contract requires is accepted as evidence against the control requirement. You still complete the Supplier Assurance Questionnaire. The certificate is evidence inside it, not a substitute for it. Level 0 is the floor Defence Digital has asked everyone to reach. It is not necessarily your floor.
- 02
Can you produce the DEFCON 658 clause from your own contracts, today?
Not the framework, your actual signed contracts. Some suppliers discover the clause is there only when a prime asks. If you cannot find it in an afternoon, that is the first task, because everything else depends on which profile applies.
- 03
Do you know when your contract anniversary falls?
For existing contracts the change does not land all at once. The annual review takes place on the contract anniversary date, and the MOD notifies you of your updated profile under version 4 in advance of it. That is the date your clock actually runs to, and it is in your contract rather than in the news.
- 04
Do you hold a current Cyber Essentials certificate?
This is one of the three controls at Level 0, and every level above it starts here too. If it has lapsed, you are not at the start line, you are behind it. Levels 2 and 3 require Cyber Essentials Plus, which is an audited assessment rather than a self-assessment, and that takes longer to arrange.
- 05
Can you evidence that personal data is processed in line with GDPR?
The second of the three Level 0 controls, and the one most often assumed rather than evidenced. If your answer is that the policy exists somewhere, that is not the same as being able to show it on request.
- 06
Can you show that resilience is designed into your systems, not bolted on?
The third Level 0 control asks you to build resilience against cyber attack and system failure into the design, implementation, operation and management of the systems your business functions depend on. It is a design question before it is a tooling question, which is why it is harder to retrofit than the other two.
- 07
Do you have a written patching policy?
This is the one that surprises people. Def Stan 05-138 sets no number of days of its own. It asks you to remediate in line with your own documented timelines and with reasonable industry standards, prioritised on CVSS v3 or above, so you write the policy and are then assessed against the policy you wrote. Cyber Essentials, which applies at every level, separately requires high and critical updates within 14 days of release. An honest policy you meet beats an aggressive one you miss. The one cadence the standard fixes is scanning, which is monthly.
- 08
Can you show you have met that policy, over time?
A screenshot of today is not a metric. A year of records is. This sits under vulnerability management, which begins at Level 1, so if your contracts are Level 1 or above it is assessable and if they are Level 0 it is not.
- 09
What do you do about vulnerabilities you cannot patch?
Every estate has some. The standard expects a Risk Treatment Plan rather than silence. The assessable artefact is the decision and the reasoning, written down, not the absence of the finding.
- 10
Do you have an asset inventory, and does it include what faces the internet?
You cannot evidence patching on assets you have not listed, and vulnerability management explicitly covers internet-facing systems as well as internal ones. Automated asset inventory is itself a control at Levels 2 and 3. Internet-facing assets are the ones an attacker reaches first and the ones an assessor asks about first.
- 11
Are you monitoring, and could you prove it to someone who asked?
Security monitoring of the networks and systems supporting your business functions begins at Level 1. Event triage and the skills to contextualise alerts come in at Levels 2 and 3. The question at assessment is rarely whether you have logs. It is whether anyone looks at them and whether that is demonstrable.
- 12
Could you produce twelve months of this, or only today?
Most organisations are in better shape than they can show. Certification is an evidence exercise before it is an engineering one, and evidence is the one thing that cannot be created retrospectively. If you have not approached an assessor yet, add their queue to whatever number you just arrived at.
If several of those were uncomfortable
That is the normal answer, and it is usually an evidence gap rather than a security one. If you want a second pair of eyes on which level you actually need and what closing it would involve, that is what a scoping call is for. It is free and it is not a sales pitch.