Most suppliers preparing for Defence Cyber Certification want a single consolidated list of what is required. The MOD publishes CSM v4 (December 2025) and IASME publishes the assessment questions, but neither publishes a single readiness checklist. This article closes that gap. It is the checklist I walk through with Fig's L0 and L1 clients on the first scoping call, grouped by control family, with specific evidence artefacts named for each item.
Use it to audit your starting posture before engaging a Certification Body. Gaps found now are cheap to fix. Gaps found during formal assessment are findings.
For context on the underlying process, see the DCC L0 process walkthrough and DCC timeline guide. For the broader scheme, see the DCC explainer.
Work through each item. For each, record:
Every "partial" or "not in place" is pre-assessment remediation work. Fig's rule of thumb: if more than 20% of the checklist items are "partial" or "not in place", plan for four weeks of preparation before engaging formal assessment.
Bring the completed checklist to your first scoping call with a Certification Body. A responsible body will walk through it with you, validate the "in place" items against the evidence you have, flag partials, and help you estimate the remediation effort. At Fig, this is a two-hour engagement at the start of the L1 process and an hour for L0.
If your starting position is strong (15% or less partial/missing), L0 is an 18-day proposition and L1 is an 8-week proposition. If your starting position is weaker, timelines extend in line with the remediation work required.
For tier-specific pricing and what a consultant-led engagement actually includes, see the DCC pricing guide.
Key questions from MOD suppliers researching this topic.
A DCC requirements checklist translates the CSM v4 requirements into an organised list of evidence artefacts, configurations, and procedures a supplier needs in place before submitting for assessment. It is the fastest way to identify gaps at the start of the engagement.
The MOD publishes the CSM v4 requirements and IASME publishes the assessment questions, but neither publishes a single consolidated readiness checklist. The checklist in this article is derived from those sources and Fig's experience across live assessments.
A prepared organisation can work through the L0 checklist in two to three weeks. A supplier starting cold typically needs four to eight weeks. L1 takes six to twelve weeks depending on starting maturity.
Yes, for pre-assessment readiness work. You cannot self-certify DCC - formal assessment by an IASME-licensed Certification Body is required to issue the certificate - but the checklist is valid as a preparation tool.
Yes. The current CSM version is v4 (December 2025). When a new CSM version is published, the requirement list updates accordingly. Suppliers on long-running certificates may see changes between initial certification and annual attestation.
DCC Level 1 is substantially more involved than Level 0 and is where most suppliers underestimate the effort. This guide walks through a practical six-phase preparation approach covering scoping, governance, technical controls, platform gap analysis, mock assessment, and submission.
The honest answer to "how long does DCC take" depends more on the supplier's starting posture than on the Certification Body's turnaround. L0 can complete in under three weeks for a prepared organisation. L1 is a six to twelve week engagement. This guide walks through both, with the specific factors that lengthen or shorten each phase.
DCC Level 0 inherits the five Cyber Essentials technical controls and layers defence-specific governance on top. This guide breaks down each control, the specific evidence an IASME-licensed assessor expects, common configuration mistakes, and how the controls map to the CSM v4 requirements behind L0.