Defence Cyber Certification
- Independent certification for UK defence suppliers, aligned to Defence Standard 05-138 Issue 4.
- Readiness, gap analysis and hands-on implementation, delivered with our certification partner network.
- Levels 0 to 3, scoped to your organisation and the cyber risk profile your contract carries.
Defence Cyber Certification is how the Ministry of Defence now assures cyber security across its supply chain. We prepare organisations for it and implement the controls it requires, working alongside an assured certification body who carries out the assessment.
Why Defence Cyber Certification exists
Until recently, MOD supplier cyber assurance rested on the Supplier Assurance Questionnaire, which is a self-declaration. Too many suppliers completed it without auditable evidence behind their answers, and the shortfall only surfaced after an incident.
DCC applies the Cyber Essentials model to that problem. Cyber Essentials is self-assessed; Cyber Essentials Plus adds an independent audit of what you have claimed. DCC works on the same principle, except that every level, including the entry level, is independently assessed. In short, show us what you say you do.
Scope is the whole organisation
This is the point most suppliers miss. Defence Standard 05-138 Issue 4 moved away from assessing only the systems that handle MOD information. The scope is now your overarching corporate environment: every system, process and function required for your business to operate, whether or not it touches defence work.
Under-scoping is an automatic failure, even where every control has been met. Getting the scoping statement right is the first and most critical step, and it carries forward unchanged to every subsequent level.
Why choose Data Defence
We implement controls for a living. We run managed detection, vulnerability management, backup, recovery and firewall services for organisations across regulated sectors, which means we arrive already knowing how these controls behave in a working estate rather than how they read in a standard.
Most certification support stops at documentation. Ours does not. Where a gap analysis finds a control missing, we can build it, operate it and evidence it.
We work with an assured certification partner who carries out the formal assessment. Under the scheme rules, an organisation that supports implementation cannot also be the assessor. We think that is the right way round. It means our work during implementation is directed entirely at getting you ready, with no interest in the assessment outcome beyond your success.
How we deliver it
Five steps, from defining your scope to formal assessment. Where gaps need closing, we can use our own managed vulnerability service, managed detection and response and technical recovery services.
- Scoping. We define and document the assessment boundary, and produce the scoping statement the scheme requires. Completed once and reusable at every level.
- Readiness review. We work through the assessment submission record with you to establish roughly where you stand before you commit further.
- Gap analysis. A structured assessment against your target level, identifying shortfalls and the evidence you will need to produce.
- Implementation. We close the gaps, using our own managed services where that is the fastest route, and build the evidence trail as we go.
- Assessment. Our certification partner conducts the formal assessment. We prepare you for it and support you through it.
Evidence, not declarations
A certificate is only worth what stands behind it. Levels 1 and above are assessed in two phases: a theoretical phase where you explain and evidence each control, and a practical phase where an assessor verifies that the controls actually operate, using sampling. A control claimed on paper does not survive that.
Our approach is built accordingly. We record what can genuinely be produced if an assessor asks, and we are straight with clients where a control exists in principle but cannot yet be demonstrated. That is a less comfortable conversation at the start and a considerably better position at assessment.
Related case studies.
- Deployed a fully managed SOC
- Introduced continuous vulnerability detection
- Enhanced enterprise-wide cyber resilience
- Developed a full Cyber Incident Response Policy, Plan, and Procedure
- Created technology-specific playbooks tested through live tabletop exercises
- Delivered executive and technical workshops building organisation-wide readiness
- Built a template framework enabling the client to author future playbooks independently