Defence Cyber Certification is administered by IASME but delivered through a network of IASME-licensed Certification Bodies. Those bodies are not identical. Their pricing differs. Their engagement models differ. Their sector specialisms differ. And the gap between a good choice and a poor choice - for any specific supplier's situation - matters materially.
This article is a straight comparison. I run Fig Group and we are one of the accredited DCC Certification Bodies, so the comparison is not disinterested. But the defence supplier community is small, the Certification Bodies all know each other, and writing a puff piece that talks down competitors would be both dishonest and commercially counter-productive. So this is written straight: what each major body is good at, what their typical engagement looks like, and where the right answer for a specific supplier might not be Fig.
As of April 2026, the main IASME-licensed Certification Bodies delivering DCC in the UK include (alphabetically):
There are others. This list covers the names a defence supplier comparing DCC Certification Bodies is most likely to encounter in a procurement process.
In my experience running Fig and previously being on the other side of these engagements as a buyer, the criteria that matter when choosing a DCC Certification Body are:
Strengths: Scale and depth. NCC Group is one of the largest independent cybersecurity firms operating in UK defence. Their assessor capacity is substantial. They bring significant adjacent expertise (penetration testing, threat intelligence, incident response) that a smaller body cannot match.
Considerations: NCC is an enterprise-sized firm. Their engagement model, pricing, and timelines reflect that. For a large defence prime or a high-complexity L2/L3 engagement, NCC is a strong choice. For a small defence subcontractor looking for L0 or L1, the engagement may feel heavier than the supplier's needs.
Where NCC is the right answer: L2 and L3 engagements, complex multi-site organisations, suppliers with genuine enterprise-scale security operations that need matched assessor capability.
Strengths: Bridewell was one of the core partner organisations that helped develop the DCC scheme. That institutional familiarity with the scheme itself is genuine and matters. Strong consultancy alongside the certification offering.
Considerations: Like NCC, Bridewell is a larger consultancy with a broader offering. The DCC certification engagement is one of several services they deliver. Pricing reflects a full consultancy model.
Where Bridewell is the right answer: Suppliers who need a consultancy relationship that extends beyond DCC - cybersecurity strategy, SOC services, ongoing advisory - and want the certification included within a broader engagement.
Strengths: Dedicated focus on DCC L0 and L1. Clear accreditation positioning. Known for defence sector specialism.
Considerations: Accredited at L0 and L1, so suppliers needing L2 or L3 coverage would need to work with a body accredited at those higher levels.
Where Fortis DPC is the right answer: L0 and L1 engagements where the supplier wants a body that is specifically defence-focused rather than general-purpose cybersecurity.
Strengths: Licensed for Cyber Essentials and DCC, with government body relationships. Capable mid-sized body.
Considerations: Less broadly known than NCC or Bridewell; smaller team means capacity is more constrained during peak periods.
Where Shift Key is the right answer: Mid-scale defence suppliers who want a body with government scheme depth but a more personal engagement than a large consultancy.
Strengths: Recently accredited; active regional footprint (particularly northern England). Capable at L0 and L1.
Considerations: Newer to DCC than several of the other bodies listed. Lower volume of completed engagements as a reference point.
Where Evolve North is the right answer: Suppliers in the north of England who value regional relationship and do not need the largest possible body.
Strengths: Platform-led Cyber Essentials heritage with clear pricing. Efficient for high-volume CE-adjacent work.
Considerations: Stronger positioning for the CE side of the requirement than the deeper DCC L1 work. Engagement model is lighter-touch than a full consultant-led L1.
Where CyberSmart is the right answer: Suppliers needing CE + L0 who value a streamlined, platform-led experience and are comfortable self-directing the supplementary DCC preparation.
Strengths: Long-standing defence specialism. Deep expertise at the higher tiers of the scheme. Credible at L2/L3.
Considerations: Smaller team; accordingly bespoke engagement pricing and timelines.
Where C3IA is the right answer: Defence specialists needing L2 or L3 with a body that genuinely lives in the sector.
Strengths: Boutique expertise, defence and regulated sector focus.
Considerations: Smaller scale. Appropriate for specific engagements rather than high-volume delivery.
Strengths:
Considerations:
Where Fig is the right answer:
Where Fig is NOT the right answer:
The question is not which body is best. It is which body is best for your specific situation. Three questions to ask yourself:
If you are an L0 or L1 supplier and value speed and transparency, Fig is designed for you. If you want technology platform gap-identification as part of the engagement, that is included on Fig's L1 engagements. If you need L2 or L3, need a large enterprise-scale body, or need the certification bundled into a broader consultancy relationship, another body is the better choice.
None of the bodies listed above is a poor choice in the right context. The poor choice is picking on price alone without considering engagement model, or picking on brand alone without considering accreditation level. That is the framing that actually matters.
Key questions from MOD suppliers researching this topic.
Yes, the scheme certificate is standardised and carries the same weight regardless of the issuing body. The main differences are delivery model, sector experience, support depth, speed, and pricing structure.
Check accreditation for your required level first. A body cannot certify levels it is not accredited to deliver, so confirm the body is an IASME-licensed Defence Cyber Certification Body covering the level your contract requires.
Ask about level coverage, assessor availability, support model (audit-only versus consultant-led), technology-backed gap analysis, feedback cycle policy, Cyber Essentials bundling, and what happens during annual attestation.
Larger consultancies can be a better fit for complex environments, multi-service transformation programmes, or when stakeholders require a broader advisory relationship beyond certification itself.
If you need L2 or L3 delivery, require a specific body brand for procurement reasons, or want DCC embedded in a broader enterprise consultancy framework. For those scenarios, NCC Group, Bridewell, or C3IA are better matches.
Cyber Essentials Plus is a prerequisite for DCC Level 2 and Level 3. At Level 0 and Level 1, standard Cyber Essentials is enough. This guide explains how the two schemes relate, which one you need, and how they stack together for suppliers working with the UK MOD.
The CRP and required DCC level is specified on each contract by the MOD or the prime contractor. Primes, tier-2 subcontractors, and tier-3 subcontractors often face different requirements. This guide walks through how the scheme applies across contract tiers.
Small MOD suppliers - one to nine employees - face the same DCC requirements as larger organisations. This guide walks through what DCC Level 0 looks like for a genuinely small business, the specific areas where smaller teams trip up, and how Fig prices and delivers L0 for micro organisations.