DCC Level 0 is achievable for smaller defence suppliers
For SMEs and defence subcontractors, achieving DCC Level 0 is not about having a large security team or an enterprise compliance department. It is about having the right security controls in place, clearly defining what is within scope, and being able to demonstrate that those controls work in practice.
Cyber Essentials provides the foundation, but DCC Level 0 also requires you to understand your defence-related scope, maintain appropriate evidence and show how the required security measures are applied within your business.
This guide explains what smaller suppliers need to put in place, what evidence to prepare and how to approach DCC Level 0 in a practical, proportionate way.
MOD Level 0 Objective, 31 December 2026
The Ministry of Defence has asked industry partners to work towards DCC Level 0 by 31 December 2026, including appropriate Cyber Essentials coverage for applicable business-critical systems. The actual requirement and DCC level applying to your organisation depends on the MOD or Prime requirement attached to your contract or supply-chain position.
Key Takeaways
- DCC Level 0 can apply to small subcontractors as well as large defence suppliers.
- Cyber Essentials is the foundation requirement.
- Your Prime may flow DCC requirements down the supply chain.
- Small businesses do not need to create unnecessary bureaucracy.
- Scope, third-party dependencies and evidence still matter.
- Zenguard offers one-off, Fast Track and monthly Assurance routes.
Does My Small Business Need DCC Level 0?
Not simply because you are small or operate in defence. The requirement may arise because:
- an MOD contract specifies it
- a Prime flows it down
- a tender requests it
- a customer asks for it
- the organisation chooses to certify proactively
Check the specific requirement applying to your organisation. Do not assume every SME in defence automatically needs Level 0.
Can a Micro Business Achieve DCC Level 0?
Yes. Small organisations can often have advantages: fewer systems, fewer users, fewer locations, simpler scope, shorter lines of responsibility and easier evidence collection. But do not oversimplify, complexity matters more than headcount alone. A 5-person engineering company with operational technology, several cloud platforms, multiple sites and complex third parties may still need careful scoping.
What Does DCC Level 0 Look Like in a Small Business?
A small defence supplier does not need an enterprise-sized security programme to achieve DCC Level 0. What matters is identifying the systems, services and third parties that are genuinely essential to the business, then showing how the relevant controls operate in practice.
This is an illustrative example only, your actual DCC scope will depend on how your organisation operates and which systems and services are essential to delivering securely and resiliently.
Cyber Essentials Comes First
Cyber Essentials is required for Level 0. For small businesses, this is often the first practical step. DCC Level 0 builds on Cyber Essentials but extends to broader organisational resilience, data protection and scope management.
Already have Cyber Essentials?
Don't have Cyber Essentials?
Need CE + DCC together?
What Should a Small Business Put in DCC Scope?
For a small business, DCC scope should focus on the people, systems, services and third parties that are genuinely essential to operating securely and resiliently. The scope should be proportionate to the organisation, but not artificially narrowed just to make certification easier.
The exact scope will vary by organisation, so use this as an example rather than a fixed template and discuss any uncertain inclusions or exclusions with your DCC Certification Body.
Can My MSP Help with DCC?
Yes, where relevant. An MSP can support technical implementation, patching, device management and evidence. But the organisation remains responsible for its DCC application, scope still needs to be understood, third-party responsibilities must be clear and evidence may still be needed.
Zenguard can work alongside an existing MSP.
Do I Need an Internal Cyber Security Team?
No, not necessarily. Small organisations may use internal staff, an MSP, specialist cyber support, a DCC Certification Body or managed security services. The key is that responsibilities are clear and controls operate in practice. Outsourcing does not remove organisational responsibility.
Do I Need ISO 27001 for DCC Level 0?
No, ISO 27001 should not be presented as a general Level 0 prerequisite unless a separate contract requires it. Small firms should avoid creating unnecessary governance overhead purely to make DCC look more sophisticated.
What Evidence Does a Small Business Need?
Evidence should be relevant, current, proportionate, understandable and reflective of actual practice. Examples may include:
- policies
- procedures
- records
- screenshots and configuration evidence
- supplier evidence
- scope documentation
DCC Level 0 Requirements Checklist
How Much Does DCC Level 0 Cost for an SME?
Zenguard's one-off DCC Level 0 certification pricing is based on organisation size. Cyber Essentials is required first. For detailed one-off pricing see the Cost & Certification Process article.
DCC Level 0 Assurance
The monthly option is not simply finance. It is an ongoing certification-lifecycle programme:
- Micro (1–9 employees): From £99+VAT
- Small (10–49 employees): From £149+VAT
- Medium (50–249 employees): From £249+VAT
- Large (250+ employees): On request
36-month minimum term. Certification remains subject to successful assessment and continued compliance with current scheme requirements.
One-Off Certification or Monthly DCC Assurance?
One-Off DCC
Best where certification is needed now, the organisation wants to manage renewal separately and no ongoing certification programme is required. See current DCC 0 pricing.
DCC Level 0 Assurance
Best where predictable monthly cost is preferred, CE renewal support is wanted, annual attestation support is wanted, scope/change reviews are useful and three-year recertification support is wanted. See current DCC Ongoing Assurance packages and pricing → 36-month minimum term.
What If We Need Cyber Essentials and DCC Quickly?
Organisations that need both Cyber Essentials and DCC Level 0 can use the DCC Fast Track, an accelerated route for combined preparation and certification. Do not assume guaranteed turnaround unless current commercial wording confirms it.
How Ready Is Your Business for DCC Level 0?
Use the Zenguard DCC Readiness Checker to identify likely gaps before committing to formal assessment. The checker is a preparation tool and does not provide certification or confirm compliance.
What About Backup and Business Resilience?
Small organisations should consider how essential systems and data would be recovered after ransomware, accidental deletion, account compromise, system failure or service outage. Where relevant, Zenguard offers a Microsoft 365/Google Workspace backup service as Optional Operational Resilience.
What About Ongoing Managed Cyber Security?
ZenProtect is separate from DCC certification. It is for ongoing managed cyber security rather than certification itself. Explore ZenProtect
What Happens After a Small Business Gets DCC Level 0?
- Annually: Cyber Essentials renewal
- Annually: DCC attestation
- Every three years: Full DCC recertification
One-off certification customers: Certification Maintenance
DCC Assurance customers: lifecycle support included according to plan.
DCC Annual Attestation & Renewal Guide
DCC Level 0 Checklist for SMEs
- Confirm DCC level required
- Confirm deadline
- Hold valid Cyber Essentials
- Define essential business functions
- Define DCC scope
- Review critical cloud and MSP dependencies
- Review Level 0 requirements
- Gather proportionate evidence
- Consider resilience
- Run DCC Readiness Checker
- Select DCC route
- Plan annual CE renewal
- Plan annual DCC attestation
Which Route Is Right for Your Business?
There is no single best route to DCC Level 0 for every SME. The right option depends on whether you already hold Cyber Essentials, how ready you are for assessment and whether you prefer one-off certification or ongoing monthly support.
If you are unsure which route fits your business, start with the DCC Readiness Checker before committing to certification.
We already have CE and look ready: Start DCC Level 0
We don't have CE or need preparation: Explore DCC Fast Track
We want predictable monthly costs: View DCC Ongoing Assurance Options
We're unsure where we stand: Run the DCC Readiness Checker
Common SME Misunderstandings
“We're too small for DCC.”
Not necessarily. Micro businesses can achieve Level 0.
“Cyber Essentials means we already have DCC.”
No. Cyber Essentials is the foundation, but DCC extends beyond it.
“We need ISO 27001 before Level 0.”
Not generally, unless a separate contract requires it.
“DCC is just an IT assessment.”
No. It includes broader organisational security and resilience beyond technical controls.
Frequently Asked Questions
Can a micro business get DCC Level 0?
Yes. Small organisations can achieve DCC Level 0 with proportionate controls and evidence.
Does a defence subcontractor need DCC?
Potentially, depending on MOD or Prime requirements. Check the specific contractual requirement.
Can my Prime require DCC?
Yes, requirements can be flowed down through the supply chain.
Do I need Cyber Essentials first?
Yes. Cyber Essentials is a mandatory prerequisite for DCC Level 0.
Do I need Cyber Essentials Plus?
Not for Level 0. Cyber Essentials Plus is required for DCC Levels 2 and 3.
Do I need ISO 27001?
Not as a general Level 0 prerequisite, unless a separate contract specifically requires it.
Do I need a cyber security employee?
Not necessarily. Responsibilities can be covered by existing staff, an MSP or specialist support.
Can my MSP help?
Yes, but responsibilities and evidence still need to be clear. The organisation remains responsible for its DCC application.
How much does DCC Level 0 cost for a micro business?
Zenguard offers one-off certification based on organisation size, plus DCC Level 0 Assurance on a 36-month minimum term. See the Cost & Certification Process article for details.
Is DCC Assurance just finance?
No. It is an ongoing certification-lifecycle programme including CE renewal support, annual attestation support, scope reviews and three-year recertification support.
What happens after certification?
Annual CE renewal, annual DCC attestation and full DCC recertification every three years. See the Annual Attestation & Renewal Guide.
Prepare → Certify → Protect → Renew
Prepare: Cyber Essentials, DCC Readiness Checker, DCC Fast Track
Certify: One-Off DCC Level 0 or DCC Level 0 Assurance
Protect: ZenProtect, Optional Backup / Resilience
Renew: One-off customers → Certification Maintenance. Assurance customers → lifecycle support included according to plan.
Three-Year Point: DCC recertification.
Small Business? DCC Doesn't Need to Be Complicated.
The right route depends on whether you already hold Cyber Essentials, how complex your scope is and how much ongoing support you want.
Need CE + DCC? Explore DCC Fast Track
Prefer Monthly? View DCC Ongoing Assurance Options
Ready? Start DCC Level 0
Related Resources
DCC Level 0 Requirements Checklist
DCC Level 0 Cost & Certification Process
Cyber Essentials vs DCC Level 0 DCC Annual Attestation & Renewal
