DCC Readiness Checklist: 10 Things Defence Suppliers Should Review Now

With the Ministry of Defence asking industry partners to achieve Defence Cyber Certification (DCC) Level 0 by 31 December 2026, suppliers should be working out where they stand now — not waiting until the end of the year.

DCC is designed to provide organisation-level assurance of cyber resilience. Level 0 is the foundation level of the scheme, and IASME currently describes it as containing three controls alongside the required Cyber Essentials certification.

For many businesses, the challenge will not be starting from zero.

It will be establishing whether their existing technology, processes and evidence genuinely support DCC readiness.

Here are ten areas Defence suppliers should review now.

1. Is your Cyber Essentials certification current?

All DCC levels begin with Cyber Essentials.

For Levels 0 and 1, Cyber Essentials forms the baseline. Levels 2 and 3 require Cyber Essentials Plus.

The first check is therefore straightforward:

• Do you currently hold Cyber Essentials?

• Is it still valid?

• Is the scope appropriate?

• Are all applicable business-critical systems included?

The MOD's Level 0 objective specifically includes obtaining Cyber Essentials for applicable business-critical systems within scope.

If your certificate is due to expire soon, renewal should form part of your DCC planning rather than being treated separately.

2. Have you defined the correct DCC scope?

This is one of the most important early decisions.

IASME states that the scope of a DCC assessment must include all processes, systems and parts of the business required for the organisation to function and deliver securely and resiliently.

That may be broader than simply saying:

“These are the laptops we use for the Defence contract.”

Review which systems your business genuinely depends upon.

That may include:

• Microsoft 365;

• identity services;

• endpoints;

• networking;

• line-of-business applications;

• cloud infrastructure;

• backup services;

• security systems; and

• critical third-party services.

Getting the scope wrong at the beginning can create problems later.

3. Do you know which DCC level applies?

Level 0 is the baseline being encouraged across industry, but it is not necessarily the highest level your organisation may need.

DCC has four levels:

• Level 0 – 3 controls

• Level 1 – 101 controls

• Level 2 – 139 controls

• Level 3 – 144 controls

The required level is linked to the assessed cyber risk associated with the work being delivered.

If you already hold Defence contracts, review the applicable Cyber Risk Profile, contractual requirements and any instructions from your MOD customer or prime contractor.

A Level 0 objective does not override a requirement for a higher level where the underlying contract requires one.

4. Are your identities and privileged accounts properly controlled?

Identity is one of the most important parts of a modern security environment.

Review:

• whether MFA is enforced;

• how administrator accounts are separated;

• whether privileged access is restricted;

• whether dormant accounts are removed;

• whether joiner, mover and leaver processes are effective;

• whether shared accounts exist;

• whether conditional access is appropriately configured; and

• who can make changes to critical systems.

For Microsoft environments, Entra ID is often the control plane for a significant proportion of the business.

Weak identity controls can therefore undermine otherwise strong security measures.

5. Are all devices properly managed?

You should be able to answer a basic question:

What devices can access company information?

Review corporate laptops, desktops, mobile devices and any permitted personal devices.

Check:

• device inventory;

• patch status;

• operating-system support;

• endpoint protection;

• encryption;

• local administrator rights;

• mobile-device controls;

• remote-wipe capability; and

• whether unmanaged devices can access sensitive services.

If you cannot confidently identify and control the devices accessing the organisation, that is a gap worth addressing early.

6. Is your Microsoft 365 and cloud environment securely configured?

For many Defence SMEs, Microsoft 365 is effectively the business operating platform.

It may contain:

• email;

• documents;

• identities;

• Teams collaboration;

• SharePoint data;

• device management; and

• security tooling.

Review areas such as:

• MFA;

• Conditional Access;

• Defender;

• Intune;

• external sharing;

• administrator permissions;

• guest accounts;

• audit logging;

• mailbox forwarding;

• information protection; and

• security alerts.

If Azure or AWS is also in use, the same principle applies.

Cloud services should not simply exist — they should be governed, monitored and securely configured.

7. Can you detect and respond to a cyber incident?

Cyber resilience is not only about preventing incidents.

It is also about what happens when something goes wrong.

Review:

• whether you have an incident response plan;

• who is responsible for making decisions;

• how incidents are reported internally;

• how systems are isolated;

• how evidence is preserved;

• who communicates with customers;

• whether regulatory or contractual reporting obligations are understood; and

• whether the plan has ever been tested.

A document that nobody has rehearsed is very different from an operational incident-response capability.

8. Can you recover the business?

Backups should be considered from a resilience perspective, not simply an IT administration perspective.

Ask:

• What systems are backed up?

• Where are the backups stored?

• Can attackers modify or delete them?

• How frequently are they tested?

• What is the recovery time?

• What happens if Microsoft 365 becomes unavailable?

• What happens if a critical cloud workload fails?

• Who is responsible for recovery?

DCC is focused on organisational resilience, and that means considering whether the business can continue or recover following disruption.

9. Do you understand your supply-chain risk?

Defence cyber requirements do not stop at your own perimeter.

Businesses increasingly depend on third-party suppliers for:

• cloud hosting;

• managed IT;

• software;

• payroll;

• communications;

• data processing;

• security; and

• specialist subcontracted services.

Review which suppliers are genuinely critical to your operation and what access they have.

Under the MOD Cyber Security Model, cyber obligations can also flow down to subcontractors according to the risk associated with the work they perform.

That means suppliers may need to understand not only their own position, but also the resilience of organisations further down their supply chain.

10. Can you evidence what you say you do?

This is the area organisations often underestimate.

DCC applicants are required to explain how controls are met and provide evidence demonstrating that compliance exists in practice. IASME specifically advises applicants to ensure evidence is readily available for assessors.

Evidence might include:

• policies;

• screenshots;

• configuration records;

• audit logs;

• training records;

• vulnerability reports;

• access reviews;

• backup test results;

• incident exercises;

• risk registers; and

• supplier-assurance records.

A control may technically exist.

But if nobody can demonstrate that it exists and operates consistently, assessment becomes much harder.

What should you do if you find gaps?

Finding gaps during a readiness review is not a failure.

That is the purpose of carrying one out early.

The sensible approach is to document:

1. the gap;

2. the associated risk;

3. what needs to change;

4. who owns the remediation;

5. the target date; and

6. what evidence will demonstrate completion.

Where an organisation cannot immediately meet applicable Defence cyber requirements, the MOD framework also provides for Cyber Improvement Plans in relevant circumstances.

The key is to move from uncertainty to a documented remediation path.

DCC Level 0 is a starting point, not the finish line

The MOD's request for industry partners to achieve Level 0 by 31 December 2026 is intended to establish a stronger baseline of cyber resilience throughout the Defence industrial ecosystem.

For suppliers, this should not be treated purely as a year-end certification exercise.

It is an opportunity to ask a more useful question:

Could we demonstrate, today, that our business is secure and resilient enough to operate within the Defence supply chain?

If the answer is uncertain, now is the time to find out.

How Symposium IT can help

Symposium IT helps UK Defence suppliers understand their current cyber posture and build a practical route towards DCC readiness.

Through Symposium Defence, we review the technology, security, cloud environment and governance underpinning the organisation.

That can include Microsoft 365, Entra ID, Intune, Defender, Azure, endpoint security, backup and recovery, security monitoring and Cyber Essentials readiness.

The objective is straightforward:

Identify the gaps early, prioritise what matters, and build an evidence-led route towards the level of cyber resilience expected across the Defence supply chain.

How ready is your organisation?

If your organisation supplies the MOD, a prime contractor or another organisation within the Defence supply chain, a readiness review can provide a clear picture of where you stand before certification becomes urgent.

Explore Symposium Defence to learn more about DCC readiness and the steps your organisation can take now.