Key Takeaways
- Cyber Essentials is one of three prerequisites for DCC Level 0.
- Your Cyber Essentials scope must align with your DCC scope, unless you can justify any exceptions.
- Cyber Essentials requires full certification renewal annually whereas DCC lasts three years with mandated annual assurance checks.
- MOD expects all industry suppliers to have DCC Level 0 by 31 December 2026.
Do You Need Cyber Essentials Before DCC Level 0?
Suppliers working towards Defence Cyber Certification (DCC) often ask the same question: do you need Cyber Essentials before achieving DCC Level 0? The answer is yes, it’s a mandatory requirement. Some organisations assume DCC replaces Cyber Essentials or that the two are separate options you can pick between, they are not. DCC builds upon the foundations established by Cyber Essentials is the foundation the whole scheme is built on.
This post explains why it Cyber Essentials is mandatory, what DCC Level 0 actually asks of you and where suppliers most often trip up before the assessment even starts.
Cyber Essentials Comes First
IASME, the MOD’s delivery partner for the DCC scheme, is clear on this point. All levels start with Cyber Essentials certification, with Levels Two and Three requiring Cyber Essentials Plus, meaning, a valid Cyber Essentials certificate is required before starting your DCC journey.
Every level begins with Cyber Essentials, so no route to DCC skips it.
If you want the full journey mapped out, our step-by-step DCC readiness roadmap walks you through each stage. Before that, it helps to understand what DCC Level 0 demands.
What DCC Level 0 Actually Requires
DCC Level 0 is the entry point, meant for suppliers assessed as very low cyber risk. It is built on three basic controls, checked against Defence Standard 05-138 Issue 4, the standard that sits behind the scheme. A valid Cyber Essentials certificate is the first control. The other two ask you to demonstrate UK GDPR conformance and show that you operate resilient networks and systems.
Put simply, Cyber Essentials is not an optional extra you can add later. It forms the foundation of the rest of the certification, and without it, you cannot pass DCC Level 0.
Pera Prometheus is an approved Certification Body for Cyber Essentials, Cyber Essentials Plus and DCC Level 0.
As we explain in Under CSM v4, Cyber Essentials is Non-Negotiable, treating the two as alternatives is one of the quickest ways to fall short. Getting Cyber Essentials right also means defining its scope correctly, which is where many suppliers run into difficulties.
Match Your Cyber Essentials Scope to Your DCC Scope
Cyber Essentials covers your internet-connected systems. DCC looks wider, at your whole organisation’s security and resilience. The two scopes are not identical but they must align. IASME requires that any internet-connected devices inside your DCC scope are covered by your Cyber Essentials certificate and the assessor reviews both scopes to check they fit together.
Scope your Cyber Essentials too narrowly and your DCC assessment stalls before it gets going. Scoping decides more than most people expect, which is exactly why we wrote Cyber Essentials Scoping: The Decision That Determines Whether You Pass or Fail. Once your scope is defined, the order of play is straightforward.
Cost and Keeping It Valid
The sequence is simple. Attain Cyber Essentials first, then move on to DCC. On cost, Cyber Essentials with Pera Prometheus starts from £320 for our unsupported package or from £750 with expert-led support. Cyber Essentials Plus, which adds a hands-on technical audit, starts from £1,550 unsupported or £2,700 supported. The DCC assessment fee is charged separately, starting from £900 for an unsupported assessment and £1,700 for a supported assessment. All prices are subject to VAT
Maintenance matters just as much as the first certificate. You must renew Cyber Essentials every year and re-certify to DCC every three years, alongside annual assurance checks to verify that your controls and scope are still compliant. Once certified, your status is publicly verifiable through the IASME certificate search. The MOD has asked all industry partners to reach at least DCC Level 0 by 31 December 2026, so the clock is already ticking.
Ready to Take the Next Step?
Getting Cyber Essentials in place before DCC Level 0 is where many suppliers lose time. As an approved certifying body for Cyber Essentials, Cyber Essentials Plus and DCC Level 0, we handle the certifications under one roof and can book you a free readiness review. We have also launched our Partner Reward Scheme, helping MSP’s benefit whilst keeping both themselves and their clients secure. . Get in touch and let’s talk through where you are.
Frequently Asked Questions
Q: Do I need Cyber Essentials before I apply for DCC Level 0?
A: Yes. A valid Cyber Essentials certificate is a necessity, and Level 0 cannot be awarded without it.
Q: Is Cyber Essentials Plus needed for Level 0?
A: No. Levels 0 and 1 need standard Cyber Essentials. Cyber Essentials Plus is only required for Levels 2 and 3.
Q: Does my Cyber Essentials scope have to match my DCC scope?
A: Not exactly, however Cyber Essentials must cover the applicable business-critical systems within the DCC scope. So, while the two scopes do not have to be identical, your Cyber Essentials scope must be sufficient to meet the DCC requirements The assessor will be able to check your scopes align correctly.
Q: How much does Cyber Essentials cost?
A: With Pera Prometheus, Cyber Essentials starts from £320 and Cyber Essentials Plus from £1,550, plus VAT. Full details are on the pricing page.
Q: If DCC lasts three years, why renew Cyber Essentials yearly?
A: Cyber Essentials certificates are valid for twelve months, so annual renewal is what keeps your DCC certificate valid across its three-year term.
Stay Safe, Stay Secure
