Are you ready for DCC Level 0?

Defence Cyber Certification (DCC) Level 0 has three controls and six questions. Check each one against the evidence the official applicant guide lists, and see what you still need to gather. Free, about five minutes.

How Level 0 is assessed

  • Three controls, six questions. Cyber Essentials, UK GDPR compliance, and resilient networks and systems, with two questions each.
  • All three must be fully met. Level 0 has no partial credit, and the official answers are yes or no.
  • A yes needs evidence. Each answer is written up with supporting evidence, and an approved DCC certification body assesses it.
  • Scope comes first. You also document what is in and out of scope: organisation and network diagrams, a list of systems and which of them Cyber Essentials covers. If the assessor finds the scope or its documents inadequate, the whole assessment fails. This check does not cover that step.

Based on the IASME DCC Levels 0–3 Applicant Guide, version 2.2 (October 2026), published by IASME, the scheme’s certification partner. We only receive your answers when you ask for the checklist, this page is not included in session recordings, and we never ask for documents here.

Control 1 of 3 · 0001

Cyber Essentials

A current Cyber Essentials certificate that covers the internet-connected part of your DCC scope, kept current for as long as you hold DCC.

Question 0001.1

Does your Cyber Essentials certificate cover all the internet-connected devices and networks in your DCC scope?

The assessor compares the two scopes. Cyber Essentials covers internet-connected devices and networks; a DCC scope also includes equipment that is not connected to the internet, so the two rarely match exactly, and that equipment does not have to be inside Cyber Essentials. If the scopes do not line up well enough it is an automatic fail, so discuss your scope with your certification body as one of your first steps.

Official wording
Does the organisation hold Cyber Essentials certification(s) that cover(s) the required scope for this activity?

Tick the evidence you already have

The guide lists each of these. This check counts the question as ready when you have them all.

Question 0001.2

Will you keep Cyber Essentials current for as long as you hold DCC, and for the life of the contracts it supports?

A DCC certificate lasts three years and Cyber Essentials has to stay valid throughout. Cyber Essentials certificates last 12 months, so in practice that means renewing every year.

Official wording
Does the organisation commit to maintaining Cyber Essentials certification for the duration of any function related to this activity or DCC certification? You must consider the Cyber Essentials certification covering contracts for their duration.

Tick the evidence you already have

The guide lists these as alternatives. The assessor decides what is enough.

Control 2 of 3 · 2314

UK GDPR compliance

Written data protection policies and procedures, and impact assessments for the data you hold. The guide points to the UK Data Protection Act 2018 and the Information Commissioner’s Office guidance. Meeting this control for DCC does not by itself show that you comply with UK GDPR.

Question 2314.1

Do you have written policies and procedures that show how you meet UK GDPR?

The assessor wants the documents that show how you comply. They can be a dedicated policy or sections inside other company documents, and a small business can have simpler documents than a large one. Whatever the size, the policy must follow the data protection principles.

Official wording
Does the organisation have documented policies and procedures which ensure compliance with obligations under the UK General Data Protection Regulation (GDPR)?

Tick the evidence you already have

The guide lists these as alternatives. The assessor decides what is enough.

Question 2314.2

Do you carry out Data Protection Impact Assessments for the types of data you store or process?

A Data Protection Impact Assessment may cover what you do with the data, the types of data, the risks and their impact, how you reduce them, and a record of it all.

Official wording
Does the organisation conduct Data Protection Impact Assessments (DPIAs) against data types it stores or processes?

Tick the evidence you already have

The guide lists these as alternatives. The assessor decides what is enough.

Control 3 of 3 · 2500

Resilient networks and systems

Know which systems the business cannot run without and the risks to them, and have working measures that let you withstand and recover from an attack or a failure.

Question 2500.1

Have you assessed how resilient your systems need to be against cyber attack and system failure?

The assessor expects to see which systems are essential, the risks to them, and the steps you took to work that out. The depth should match the business: a micro business may have one brief document, a large one several documents including a risk register.

Official wording
Has the organisation assessed the degree to which its systems must be resilient to cyber-attack and system failure? Focus your answer on the steps you took to evaluate how robust and secure your systems would need to be to withstand cyber-attacks.

Tick the evidence you already have

The guide lists each of these. This check counts the question as ready when you have them all.

Question 2500.2

Have you built that resilience into your systems?

This question is about what is actually running. The guide says to avoid pointing to policies or high-level plans and to show practical measures instead, such as automated backups or an uninterruptible power supply, each one answering a need from your assessment.

Official wording
Has the organisation built resilience into its systems to meet its resilience needs? Focus your answer on the implementation of resilience into your systems.

Tick the evidence you already have

The guide lists each of these. This check counts the question as ready when you have them all.

If the result button does not appear here, refresh the page. You can also send us your DCC requirement.

Replies the same business day

Want help getting Level 0 done?

We help you put the three controls in place and assemble the evidence, coordinate with an approved DCC certification body and support you through the assessment.

See how DCC Level 0 works Browse services
  • Published prices
  • No-obligation assessment