Defence Cyber Certification Level 0 is not a new set of technical controls. L0 inherits the five Cyber Essentials technical controls as its baseline and layers defence-specific governance, supply chain, and incident-handling requirements on top. If you already hold a current Cyber Essentials certificate, you already meet the technical foundation of DCC L0 - what remains is the supplementary evidence.
This guide walks through each of the five controls in the order an assessor reviews them, with specific evidence expectations, the common mistakes that cause findings, and the CSM v4 mapping so you can see how each control plugs into the wider L0 requirement set. If you are new to the scheme, pair this with the DCC explained overview and the DCC L0 process walkthrough.
L0 requires three evidence packs:
This article covers the first pack in depth. The technical controls must be demonstrably operational - not just documented - and the assessor expects evidence from the last 30 to 90 days, not a snapshot generated for the assessment.
What the control actually requires. Every device that is part of the in-scope boundary must have a correctly configured firewall. For office networks, this is usually the perimeter firewall at the site's internet gateway. For remote workers and cloud-native operations, it is the host-based firewall on each endpoint, plus cloud provider security groups or network ACLs on public resources.
Specific evidence assessors expect:
Common mistakes:
CSM v4 mapping. This control maps to the "Network security" family within CSM v4 L0. The defence-specific overlay adds a requirement that internet-facing services processing MOD information must log all inbound traffic and retain those logs for at least 90 days.
What the control actually requires. Devices and services must be configured to reduce their attack surface before being deployed. Default credentials changed, unused accounts removed, unnecessary software uninstalled, auto-run disabled on removable media, and only the services required for the business purpose left enabled.
Specific evidence assessors expect:
Common mistakes:
CSM v4 mapping. Secure configuration is assessed under "System hardening" in CSM v4 L0. Where the supplier operates cloud workloads, the same requirements apply to cloud configuration baselines - CIS benchmarks or equivalent are accepted as evidence of baseline intent.
What the control actually requires. All software within the in-scope boundary must receive security updates - operating systems, applications, firmware, and cloud services. Critical updates must be applied within 14 days of release. Out-of-support software must be removed or isolated.
Specific evidence assessors expect:
Common mistakes:
CSM v4 mapping. CSM v4 L0 explicitly references the 14-day critical patch SLA for all in-scope systems processing MOD data. This is stricter than the 14-day CE SLA only in that it applies to internet-facing and internal systems handling MOD information.
What the control actually requires. Every user account in the in-scope boundary must be individually identifiable, authorised, reviewed, and revoked when no longer needed. Administrative privilege must be separated from everyday user accounts. Multi-factor authentication must be enabled for cloud services and for administrative accounts on any system.
Specific evidence assessors expect:
Common mistakes:
CSM v4 mapping. User access control maps to CSM v4 L0 under "Access management". The defence overlay adds a specific requirement for privileged access to MOD-facing systems: every privileged session must be logged, and logs retained for a minimum of 12 months.
What the control actually requires. All devices in the in-scope boundary must have malware protection active. The accepted forms are:
Specific evidence assessors expect:
Common mistakes:
CSM v4 mapping. Malware protection is part of the CSM v4 L0 "Endpoint protection" family. For suppliers that handle MOD data on personal devices under BYOD, the scheme requires equivalent protection on the personal device - which is often the cleanest argument against BYOD for defence work.
Holding the five technical controls does not finish L0. You also need:
For a full L0 readiness walkthrough, see the DCC L0 process guide and the DCC L0 evidence guide.
At Fig, we run our technology platform across the supplier's in-scope systems in parallel with the documentation review. The platform surfaces gaps against each of the five controls automatically - unpatched systems, misconfigured firewalls, weak access configurations, and so on - which means the supplier has the opportunity to fix issues before they become assessor findings.
The consultant reviews the output, proposes remediation, and only submits for formal assessment once the evidence is clean. This is the single biggest reason Fig's first-pass rate on L0 is materially higher than audit-only engagements: the assessor does not see the gaps because they are remediated before the submission.
Pricing for L0 starts at £999.99 + VAT for micro organisations. See DCC pricing for the full tier breakdown and a comparison against the wider UK market.
Key questions from MOD suppliers researching this topic.
The five controls inherit from Cyber Essentials: firewalls, secure configuration, security update management, user access control, and malware protection. DCC Level 0 layers defence-specific governance, supply chain, and incident response evidence on top of these technical controls.
Yes. DCC Level 0 requires a valid Cyber Essentials certificate as the technical baseline. The defence-specific supplementary requirements sit on top. You cannot complete Level 0 without holding current CE.
Assessors expect operational evidence: configuration outputs, policy documents, access review records, patch management dashboards, AV/EDR console exports, and firewall rulesets with timestamped review logs. Evidence must demonstrate the control is running in normal business operation, not fabricated for audit.
Yes. MFA enforcement is expected for cloud services (Microsoft 365, Google Workspace, AWS, Azure) and for all administrative accounts. "Enabled but not enforced" is not sufficient - the scheme requires enforcement via conditional access policy or equivalent.
Readiness depends on starting maturity. A supplier already holding Cyber Essentials can typically close remaining L0 evidence gaps within 2 to 4 weeks. A supplier starting cold may need 6 to 8 weeks to build the governance baseline and complete CE.
Scope is the decision that most often determines whether a DCC Level 0 engagement runs clean or drags on for weeks. This guide walks through how scope is actually constructed, the decisions an assessor will challenge, the five common scoping errors, and how to align DCC scope with your Cyber Essentials scope.
A consolidated, practical readiness checklist for DCC Level 0 and Level 1 against CSM v4 (December 2025). Use it to audit your starting posture before engaging a Certification Body. Organised by control family, with specific evidence artefacts and pass/fail criteria for each item.
The honest answer to "how long does DCC take" depends more on the supplier's starting posture than on the Certification Body's turnaround. L0 can complete in under three weeks for a prepared organisation. L1 is a six to twelve week engagement. This guide walks through both, with the specific factors that lengthen or shorten each phase.