DCC Level 0 is the entry-level tier of Defence Cyber Certification, aimed at MOD suppliers whose contracts are classified at the "Very Low" Cyber Risk Profile. The process is structured, portal-based, and - for a prepared organisation - completes in 14 to 21 days. This guide walks through the process end-to-end, with realistic timings and the specific decisions that most affect the outcome. For the full timeline picture including L1, see the DCC timeline guide.
The process begins when a supplier contacts an IASME-licensed DCC Certification Body or IASME directly. Two things are established on this first call:
A competent Certification Body will also flag obvious scoping issues on this call - remote workers, BYOD, cloud infrastructure, subcontractor relationships - so the supplier has a realistic picture of what is in scope before signing.
Scoping is the single most important activity at the start of an L0 engagement. Poorly-scoped assessments generate avoidable findings, trigger clarification cycles, and sometimes require a full re-submission.
You need to decide, explicitly:
The assessor will challenge the scope, especially if it appears to exclude material in-scope assets. Under-scoping is a common rejection reason. See the DCC L0 scoping guide for the specific pitfalls and how to avoid them.
Your Certification Body provisions an account on the IASME portal. You receive login credentials, a scope record matching what was agreed in Step 2, and access to the L0 self-assessment form.
At Fig we also open a shared evidence space at this point - a simple secure folder structure aligned to the CSM v4 L0 requirements - so the client has a single place to drop evidence as it is gathered, rather than attempting to reconstruct it at submission time.
The L0 self-assessment is completed by the supplier. The Certification Body can explain questions, point you at the expected type of evidence, and flag weak answers - but the assessor cannot complete the form for you or tell you what answer will pass. This separation is a regulatory requirement of the scheme.
The self-assessment covers:
Most of the supplier's preparation time is spent on this step. For a well-prepared organisation this is three to seven working days. For a supplier starting cold, two to three weeks is more realistic.
Evidence is uploaded against each question in the self-assessment. The scheme expects operational evidence - documents, configurations, and records that already exist as part of running the business - rather than documents fabricated for the assessment. See the DCC L0 evidence guide for what assessors are specifically looking for.
At Fig, the consultant reviews the evidence before submission and flags anything that is thin, missing, or misaligned with the control being evidenced. This pre-review is where first-pass failure is prevented.
The assessor reviews your submission. They are checking three things:
If everything aligns, the assessor moves straight to marking. If there are gaps, they are raised as clarification requests.
The assessor typically asks between zero and five clarification questions on a well-prepared L0 submission. The questions fall into three types:
A responsive supplier closes clarifications within one to three days. A slow responder stretches this phase out materially - it is the single most common cause of timeline overrun at L0.
Once all clarifications are resolved, the assessor completes marking on the IASME portal. A passing submission is automatically issued a DCC L0 certificate, your organisation is added to the IASME DCC register, and the certificate becomes commercially usable.
The certificate is valid for three years. Annual attestation is required at months 12 and 24; see the DCPP-to-DCC transition guide for how annual attestation actually works in practice.
A genuine failure at L0 is uncommon but not impossible. If the submission cannot be remediated within a defined window, the supplier is given the option to close the engagement, remediate, and re-submit. Fig includes up to three free clarification rounds; a fourth attempt or a full re-submission after a failed assessment is chargeable, but the scenario is rare if pre-submission review is done properly.
| Preparation level | L0 duration |
|---|---|
| CE certified, governance documented, scope clear | 14 – 21 days |
| CE certified, governance partly there | 21 – 35 days |
| No CE, ad-hoc governance | 28 – 56 days |
For a practical view of where the time actually goes, see the DCC timeline guide.
Fig's L0 engagement is run by a named consultant alongside the assessor. The consultant:
L0 pricing is tier-based: £999.99 + VAT for micro organisations, up to £4,999.99 + VAT for 250+ employees. See the DCC pricing guide for the full breakdown and market comparison.
Key questions from MOD suppliers researching this topic.
The journey covers eight steps: enquiry and pre-qualification, scoping, IASME portal access, self-assessment completion, evidence submission, assessor review, clarification, and marking with certificate issuance.
No. The supplier owns assessment responses and evidence. The body can guide interpretation and flag weak answers, but cannot complete the declaration on your behalf - this separation is a regulatory requirement of the scheme.
At L0, assessor interaction is usually via written clarification requests rather than a formal interview call. L1 includes structured interviews with IT lead, security lead, operations lead, and an executive sponsor.
For clean, well-prepared submissions, a final outcome typically lands within 7 to 10 working days of submission. Delays usually follow incomplete evidence packs or slow responses to clarification requests.
You receive structured clarification requests in the IASME portal. You remediate and resubmit relevant evidence. Fig includes three free clarification rounds; most suppliers pass after structured remediation when scope and controls are handled correctly.
The honest answer to "how long does DCC take" depends more on the supplier's starting posture than on the Certification Body's turnaround. L0 can complete in under three weeks for a prepared organisation. L1 is a six to twelve week engagement. This guide walks through both, with the specific factors that lengthen or shorten each phase.
DCC Level 0 is passed or failed on the quality of the evidence you submit. This guide is a control-by-control breakdown of the specific evidence types an IASME-licensed assessor looks for, how to assemble an evidence pack that avoids clarification cycles, the reality of evidence retention, and the difference between operational evidence and evidence fabricated for audit.
Scope is the decision that most often determines whether a DCC Level 0 engagement runs clean or drags on for weeks. This guide walks through how scope is actually constructed, the decisions an assessor will challenge, the five common scoping errors, and how to align DCC scope with your Cyber Essentials scope.