Most published guidance on Defence Cyber Certification focuses on L0 and L1 because those two levels cover the majority of MOD suppliers. But L2 and L3 exist, apply to a substantial minority of suppliers, and look quite different operationally - different baseline (CE Plus rather than CE), different Certification Body options (a smaller accredited pool), different timeline (months rather than weeks), and different price point (six figures rather than four or five).
This article covers what L2 and L3 actually involve. Fig Group is an IASME-licensed Defence Cyber Certification Body; we refer suppliers who need L2/L3 to other certification bodies where appropriate. So this guide is written without commercial incentive - it is what I tell suppliers who ask "should I be aiming for L2 or L3?" and "who do I talk to?".
For context on the broader scheme, see the DCC explainer and DCC levels guide.
L2 applies to Moderate CRP contracts. In MOD terms, that generally means:
L3 applies to High CRP contracts. That generally means:
The buyer specifies the CRP in the contract or tender. Suppliers cannot strategically opt for L2 or L3 to appear more credible - the CRP is set by the work's sensitivity, not by the supplier's preference.
The single biggest technical difference between L0/L1 and L2/L3 is the underlying Cyber Essentials baseline. L0 and L1 require Cyber Essentials (CE) - a primarily documentary assessment with limited technical testing. L2 and L3 require Cyber Essentials Plus (CE Plus) - hands-on technical testing by an assessor who probes the controls, runs scans, and verifies that what is declared matches what is configured.
CE Plus materially raises the bar. A supplier who passed CE comfortably may still struggle with CE Plus if their declared controls are not consistently applied across the estate. Organisations aiming for L2 typically invest in CE Plus 3 to 6 months ahead of L2 engagement to give themselves time to remediate any CE Plus findings.
L2 includes everything in L1 and adds:
L3 includes everything in L2 and adds:
As of April 2026, the main IASME-licensed Certification Bodies accredited to deliver DCC at L2 and L3 include:
Smaller or newer bodies that are L0/L1-only (including Fig Group) cannot deliver L2 or L3. The accreditation is level-specific and earning it is a multi-year process.
For a broader comparison including L0/L1 bodies, see the DCC certification body comparison.
L2 and L3 are measured in months, not weeks:
| Level | Typical end-to-end timeline | Assessor effort |
|---|---|---|
| L2 | 3 – 6 months | 10 – 20 assessor days |
| L3 | 4 – 9 months | 20 – 40 assessor days, including on-site |
These timelines assume the supplier is starting from a strong L1 or ISO 27001 baseline. A supplier attempting L2 from an ad-hoc governance starting point should expect 6 to 12 months before being assessment-ready. L3 from a low baseline is effectively a 12-to-18-month programme.
L2 and L3 pricing is bespoke, driven by scope complexity, site count, and the depth of operational maturity evidence required. Rough 2026 market ranges:
Within these ranges, the variance is driven by scope (single site vs multi-site vs international), maturity (existing ISO 27001 materially reduces effort), and technical estate (cloud-native simpler than on-prem legacy).
Three signals that a supplier should aim for L2:
Absent these signals, staying at L1 is usually the right commercial choice. L2 is a substantial step up and does not pay for itself on a single contract win.
L3 is rarely an opt-in. It is driven by specific high-CRP contracts where the buyer mandates it. Suppliers certifying at L3 usually do so because a specific programme requires it, and the certification economics work only within that contract context.
The exception is major defence primes for whom L3 is strategic infrastructure - it positions them for the full spectrum of MOD work including classified programmes. For those primes, L3 is an ongoing capability rather than a project.
For most suppliers, the path looks like this:
Skipping steps is possible but introduces risk. A supplier attempting L2 cold (no L0, no L1, no ISO 27001) will struggle.
For L0 or L1 preparation with Fig, see the DCC pricing guide. For L2 or L3, engage NCC Group, Bridewell, or C3IA directly.
Key questions from MOD suppliers researching this topic.
L2 applies to contracts with a Moderate Cyber Risk Profile (sensitive MOD data, operational MOD network connectivity). L3 applies to High CRP contracts (classified information, critical operational capabilities). The buyer specifies the required level in the procurement documentation.
L2 requires Cyber Essentials Plus (not CE basic), a formal ISMS with demonstrable operational maturity, privileged access management, continuous vulnerability monitoring, documented security operations capability, and multi-tier supply chain assurance. L1 has a lighter version of most of these.
No. Accreditation is level-specific. Some bodies hold only L0/L1 accreditation; others are accredited at all four levels. For L2/L3 in the UK, NCC Group, Bridewell, and C3IA are the main options.
L2 typically runs 3 to 6 months end-to-end. L3 typically runs 4 to 9 months. Both require substantial preparation work before engaging the assessor.
For suppliers without prior ISO 27001 or CE Plus maturity, building via L0 and L1 is usually the more sustainable path. For suppliers with existing mature ISMS and CE Plus, going direct to L2 can be appropriate if the pipeline warrants the investment.
DCC has four levels: L0, L1, L2, and L3. Each maps to a Cyber Risk Profile tier set by the MOD for a given contract. This guide explains the differences between the levels in detail, how to determine which one your contract requires, the practical differences in assessment effort, and why most suppliers new to the scheme start at L0 or L1.
Cyber Essentials Plus is a prerequisite for DCC Level 2 and Level 3. At Level 0 and Level 1, standard Cyber Essentials is enough. This guide explains how the two schemes relate, which one you need, and how they stack together for suppliers working with the UK MOD.
On the Defence Cyber Certification scheme's first birthday, the UK Defence CISO Eleanor Fairford has asked all MOD suppliers to achieve DCC Level 0 certification by 31 December 2026. This guide explains what the mandate covers, where it sits in the wider government supply chain Cyber Essentials programme, and the practical timeline suppliers now need to work to.