The DCC scheme has been developed by the UK Ministry of Defence and IASME
and is part of the broader initiative to enhance the cyber resilience of the UK’s defence supply chain
The DCC considers the overall cyber security and resilience posture of the organisation, moving away from protecting ‘MOD identifiable information’ to providing a single, organisation-level, assurance which can be presented in support of UK Defence Procurements, subject to an annual
review and recertification every three years.
DCC is a requirement for all defence procurement and contract activities.
Each defence contract undergoes a cyber risk assessment and all suppliers to that contract must meet the security controls required for that contract.
Organisations can certify to one of four levels.
DCC Level 0 is usually assigned to a supplier if they are deemed to have a very low level of assessed cyber risk. A supplier must demonstrate basic cyber security practices, and Level 0 acts as the foundation for any subsequent DCC assessments at Level 1 to 3.
DCC Level 0 involves three controls,which can be found in the DCC Applicant Guide:
Control 1: Does the supplier hold Cyber Essentials and commit to maintaining CE for the duration of the DCC certificate's duration?
Control 2: Does the supplier have documented policies and procedures which
ensure its compliance with the UK General Data Protection Regulation (GDPR)?
Control 3: Does the supplier carry out Data Protection Impact Assessments
(DPIAs) against data types it stores or processes?
DCC Level 1 is usually assigned to a supplier if they are deemed to have a low level to moderate level of assessed cyber risk. A supplier must demonstrate a comprehensive cyber security programme with good practices
DCC Level 1 involves 101 controls, which can be found in the DCC Applicant Guide
DCC Level 2 is usually assigned to a supplier if they are deemed to have a high level of assessed cyber risk. A supplier must demonstrate advanced cyber security oversight and planning which drives robust organisational and cyber practices
DCC Level 2 involves 139 controls, which can be found in the DCC Applicant Guide
DCC Level 3 is usually assigned to a supplier if they are deemed to have a substantial level of assessed cyber risk. A supplier must demonstrate expert cyber security capabilities that fully take advantage of the ‘defence in depth’ methodology to appropriately protect the organisation against new and evolving threats
DCC Level 3 involves 145 controls, which can be found in the DCC Applicant Guide
Bergerode Consulting is a leading IASME certification body in North West England
and we can help your organisation through the entire process of meeting the DCC standard.
We have extensive experience in helping organisations of all sizes and business areas with cyber security certificartion
so you can rest assured that you are in safe hands.
The price for any level of Defence Cyber Certification (DCC) is dependent upon the level your organisation requires to get through the assessment in terms of consultancy and preparation, but the actual assessment itself.