Maintaining DCC Certification: What Defence Suppliers Need to Keep Under Review

A three-year DCC certificate does not mean three years without review.

IASME's certification terms make that clear: the certificate's validity is conditional on annual attestation and annual renewal of Cyber Essentials or Cyber Essentials Plus, as applicable. IASME

Achieving certification is an important milestone. But it should also prompt a practical question:

Who is responsible for maintaining the organisation's security position after the assessment?

Consider what might change during the certification period.

A new cloud application becomes essential to the business. An IT provider is replaced. Contractors receive administrative access. Another location opens. A backup platform changes.

The certificate may still be displayed on the website, but someone needs to understand whether the scope, controls and supporting evidence still reflect how the organisation operates.

For Defence suppliers, the objective should be to build that responsibility into normal business operations—not rediscover it shortly before the next assessment.

What is required to maintain DCC?

IASME's guidance identifies three recurring requirements:

These are distinct requirements. Renewing Cyber Essentials does not replace the DCC attestation, and holding a DCC certificate does not remove the annual Cyber Essentials renewal requirement. IASME

The prerequisite also depends on the level: Cyber Essentials underpins the scheme, with Cyber Essentials Plus required for DCC Levels 2 and 3. IASME

Maintain a calendar covering the relevant expiry dates, attestation arrangements and recertification preparation. Agree the process with your assessing Certification Body rather than assuming that every deadline falls on the same date.

The renewal calendar should have a named owner—not simply an automated reminder in a shared inbox.

Keep the requirements proportionate to your level

Maintaining DCC does not mean imposing the highest-level control set on every small supplier.

IASME describes Level 0 around three control areas: Cyber Essentials, UK GDPR compliance, and resilient networks and systems. Higher levels introduce more extensive requirements. IASME

The recommendations below describe a practical way to manage ongoing readiness. They are not a list of additional mandatory Level 0 controls.

Apply them to your organisation's certified scope, applicable level, contractual requirements and risk. Confirm formal certification questions with your Certification Body.

1. Keep the scope aligned with the business

The scope should describe the essential systems, services and business functions being assured. IASME's guidance emphasises including what the organisation needs to operate securely and resiliently—not just the systems that directly handle a particular MOD contract. IASME

Treat that scope as a maintained record.

When introducing a business-critical application, for example, ask whether it changes the information being processed, the services relied upon, the people with access or the arrangements needed for recovery.

Also review the relationship between your DCC scope and Cyber Essentials coverage. They need to align appropriately, but they are not necessarily identical: Cyber Essentials focuses on internet-connected systems, while DCC can encompass essential systems that are not internet-connected. IASME

A useful change record should explain what changed, who reviewed the impact and whether the scope or supporting documentation needs updating.

The question is not simply "Has IT changed?" It is "Does our assurance still describe the business we are operating?"

2. Distinguish routine changes from significant changes

Not every new laptop or routine network adjustment requires another certification exercise.

IASME states that normal organisational and network changes do not typically require recertification. Significant changes should, however, be reviewed with the assessing Certification Body to establish whether the certification scope has been substantially affected. IASME

We recommend making changes such as a major migration, acquisition, replacement of a critical service or substantial change in outsourced support explicit review triggers.

These are examples to assess—not an automatic declaration that a certificate has become invalid.

Record the change and discuss its significance with the Certification Body where appropriate. Do not wait until the annual attestation to discover that nobody has considered it.

Equally, do not sign an unchanged-scope declaration simply because the business would prefer to avoid a conversation.

3. Keep the technical controls operating between assessments

A useful maintenance review should test the current position, not just confirm that the original project was completed.

For a Microsoft-based environment, we would suggest examining questions such as:

• Are the expected users and devices still covered by the agreed security controls?

• Have privileged accounts or access exceptions been introduced without review?

• Are outstanding updates and protection failures being investigated?

• Have new services been added without ownership, monitoring or recovery arrangements?

The purpose is to identify departures from the agreed baseline and resolve them through normal service management.

For example, an assessment might have confirmed that all in-scope laptops were managed. Three months later, newly purchased devices should not be assumed to have inherited that protection automatically.

Choose representative checks that demonstrate what is happening now. Record exceptions, assign actions and verify that those actions have worked.

A configuration screenshot from assessment day cannot, by itself, demonstrate today's operating position.

4. Maintain evidence as part of normal work

IASME's applicant guidance requires organisations to explain how applicable controls are met and provide supporting evidence demonstrating compliance in practice. IASME

Our recommendation is to keep that evidence organised after certification, rather than treating the assessment submission as a folder that can be archived and forgotten.

A simple evidence index can record the relevant control, its owner, the supporting record, the latest review date and any outstanding action.

Use records your organisation already produces where they are suitable: completed access reviews, configuration reports, change approvals, recovery-test results and service-review actions.

Not every evidence type is required at every level. Select evidence that supports the actual requirement and applies to the correct scope.

Keep historical assessment material, but distinguish it from the evidence used to demonstrate the current position.

Our DCC Evidence Requirements guide explores that relationship between the control, its implementation and the evidence supporting it.

5. Make responsibilities clear when using an IT provider

Using a managed IT provider does not remove the need to demonstrate that a control is being met.

IASME explicitly states that controls delivered through a third party must still be shown as satisfied, and evidence may be required from that provider. IASME

The practical response is to agree responsibilities before they become an issue.

Who reviews device protection? Who investigates security alerts? Who maintains the backup service? Who supplies the evidence? Who follows up when a gap is found?

Keep a named internal owner for the overall position, even where much of the technical work is outsourced.

Then check that the service agreement covers the work you are relying upon. "Managed IT" should not be interpreted as an unlimited promise to perform every security, compliance and certification activity.

A concise responsibility matrix is more useful than an assumption that either the supplier or the customer must be dealing with it.

6. Review recovery arrangements after meaningful changes

A backup policy describes an intention. A restore test helps demonstrate whether the organisation can recover.

IASME's Level 0 guidance specifically highlights practical recovery evidence, including tested restores, rather than relying only on a statement that backups exist. IASME

We recommend revisiting recovery arrangements when a critical application, supplier or infrastructure dependency changes.

Check what is protected, who can initiate recovery, which credentials are required and what would happen if the normal administrator were unavailable.

Test a relevant scenario and record the result. Were the required files or services recovered? Was anything missing? Did recovery depend on information that existed only in one person's memory?

Apply the same thinking to incident-response arrangements. Recheck contacts, escalation routes and responsibilities when people or suppliers change.

Our incident-response guide for Defence suppliers provides a starting point for reviewing the plan.

A process should still work after the person who originally designed it has moved on.

7. Keep certification maintenance separate from contract assurance

DCC maintenance and contract-specific assurance are related, but they are not the same process.

A contractual Cyber Risk Profile determines the relevant Def Stan 05-138 requirements. A supplier should therefore check new opportunities against the required level rather than assume an existing certificate is sufficient for every contract. GOV.UK

There is also an important scheduling distinction.

Current MOD CSMv4 guidance describes an annual Supplier Assurance Questionnaire on the anniversary of contract award, with a one-month completion window. It also states that holding a valid DCC certificate does not yet exempt suppliers from completing the relevant SAQ requirements. GOV.UK

A DCC attestation date, Cyber Essentials renewal date and contract SAQ anniversary can therefore be separate calendar entries.

Confirm the applicable process with your buyer, particularly for existing contracts transitioning between arrangements.

For the wider relationship between these requirements, see our CSMv4 and Cyber Risk Profiles guide.

8. Review subcontracting when the delivery model changes

If delivery moves to a new subcontractor, review the assurance implications alongside the commercial arrangements.

MOD guidance places responsibility for flow-down on suppliers, with subcontracted requirements assessed and the appropriate assurance process passed down the supply chain. GOV.UK

Our practical recommendation is to make that review part of subcontractor onboarding and significant contract changes.

Record the work being subcontracted, the relevant requirements, the assurance received and who will maintain the relationship. Do not rely solely on a certificate attached to an old procurement email.

Our Defence Supply-Chain Flow-Down guide explains this process in more detail.

A practical operating rhythm

You do not need a new committee for every control. You need a repeatable process with clear ownership.

The following is a suggested management rhythm, not a scheme-mandated schedule:

Adjust these intervals to your risks and operating environment. Specific control or contractual frequencies take precedence where they apply.

The value is not the meeting itself. It is being able to show what was reviewed, what was found, who acted and whether the issue was resolved.

Plan beyond the initial certification target

The MOD has asked industry partners to achieve DCC Level 0 by 31 December 2026, including Cyber Essentials for applicable business-critical systems within scope. That request should inform readiness planning, alongside each organisation's specific contractual obligations. Defence Digital

For organisations still preparing, include ongoing responsibilities in the plan from the outset.

Budget for renewal and recertification. Agree who maintains the evidence. Decide how changes will be reviewed and which activities belong with the internal team, managed provider or Certification Body.

For organisations already certified, use the same questions to test whether the post-assessment arrangements are clear.

The useful outcome is not just a certificate. It is an organisation that can explain how the position behind that certificate is being maintained.

How Symposium IT helps

Through Symposium Defence, we help organisations assess their technology environment, identify gaps, prioritise remediation and establish the managed IT and security arrangements needed to support ongoing resilience.

That includes reviewing Microsoft 365, identity, devices, information access, backup, monitoring and operational dependencies. Our readiness review looks beyond the minimum Level 0 requirements where appropriate, with the scope of the work agreed explicitly.

The engagement can start with a readiness review and progress into technical remediation and ongoing support.

Symposium provides readiness, remediation and managed services; formal DCC assessment and certification are delivered through the authorised certification framework.

Whether you are preparing for certification or reviewing what happens afterwards, start by establishing who owns the work and how it will be maintained.

Discuss your DCC readiness and ongoing support with Symposium Defence.

Book your DCC readiness review at defence.symposium-it.co.uk

Assured today. Ready tomorrow.

Sources

• IASME – Defence Cyber Certification

• GOV.UK – Cyber Security Model

• GOV.UK – Def Stan 05-138 Issue 4

• Defence Digital – One Year of Defence Cyber Certification