Cyber Essentials (CE) and Cyber Essentials Plus (CE Plus) are both UK government-backed cybersecurity certifications administered by IASME. DCC is the MOD's supply chain certification scheme, also administered by IASME. Suppliers often ask whether they duplicate each other, whether CE Plus replaces DCC, or whether a DCC certificate removes the need to hold CE at all. The short answer: the two schemes stack. DCC is built on top of CE or CE Plus, depending on your required DCC level, and you hold both certificates - not one or the other.
This guide walks through the relationship, the differences, and the decision framework for which certificate combination a given MOD supplier needs.
So the answer to "do I need CE or CE Plus?" is determined by the DCC level your contract requires, which in turn is determined by the Cyber Risk Profile of that contract.
Cyber Essentials (CE) is primarily documentary. The supplier answers a structured self-assessment questionnaire covering the five technical controls - firewalls, secure configuration, security update management, user access control, malware protection. An IASME-licensed assessor reviews the answers, asks clarification questions, and issues the certificate when satisfied. Assessment is typically same-week for prepared organisations.
Cyber Essentials Plus (CE Plus) is CE plus hands-on technical testing. An assessor runs an independent vulnerability scan against the in-scope boundary, spot-checks MFA configuration, tests malware protection by attempting to execute sample payloads, and verifies the controls claimed in the self-assessment match reality. CE Plus is a substantially bigger engagement - typically 1-3 days of assessor time at the supplier's premises or remotely.
The material difference: CE is an attestation with independent review. CE Plus is an attestation with independent review and independent technical verification.
DCC is not a repeat of CE/CE Plus. It adds defence-specific requirements:
DCC does not re-test the five technical controls; it trusts the CE (or CE Plus) assessor's finding on those and builds defence-specific assurance on top. This is why both certificates are required - the DCC certificate is evidence of scheme compliance for MOD procurement, and the underlying CE/CE Plus certificate is evidence of technical hygiene.
CE and CE Plus have materially different price points. A typical UK market:
So a supplier bidding for L1 contracts faces: CE (~£400) + DCC L1 (Fig: £9,999 - £49,999 by size). A supplier bidding for L2 contracts faces: CE Plus (~£2,500) + DCC L2 (typically £30,000+).
When comparing quotes from Certification Bodies, confirm whether CE or CE Plus is bundled in the DCC fee or quoted separately. At Fig, CE and CE Plus are priced separately from DCC, though we can bundle on request.
Some suppliers try to run CE (or CE Plus) and DCC in parallel to save time. This rarely works. DCC assessors require a current CE or CE Plus certificate before issuing the DCC certificate - the CE baseline must be in hand before the DCC submission is complete. You can prepare DCC governance evidence in parallel with CE, but you cannot certify DCC before CE.
The cleaner sequence:
For prepared suppliers running this sequence, L0 DCC can issue within 2-3 weeks of CE. L1 DCC is a 6-10 week engagement following CE.
See the DCC timeline guide for realistic timelines across both levels.
Some suppliers hold CE Plus even though their current contract only requires CE. Common reasons:
For most L0-only and L1-only suppliers, however, standard CE is the correct choice. There is no DCC benefit to holding CE Plus if the contract CRP only requires L0 or L1.
CE certificates are valid for 12 months. CE Plus certificates are also valid for 12 months. DCC certificates are valid for three years with an annual attestation. Operationally, this means:
This cadence is important for procurement. A DCC certificate issued in April 2026 is valid until April 2029, provided the annual attestations are completed each year. If the underlying CE or CE Plus lapses, the DCC certificate is effectively suspended until CE/CE Plus is restored.
If your contract CRP is Very Low or Low, you need standard CE plus DCC L0 or L1. If it is Moderate or High, you need CE Plus plus DCC L2 or L3. Fig is an IASME-licensed Defence Cyber Certification Body and an IASME-licensed CE and CE Plus Certification Body - we can deliver the full CE → DCC L0/L1 path as a single engagement. For L2 or L3 we refer suppliers to Certification Bodies accredited at those higher levels.
Several IASME-licensed bodies are accredited to deliver Defence Cyber Certification in the UK. NCC Group, Bridewell, Fortis DPC, Shift Key Cyber, Evolve North, CyberSmart, and Fig Group each approach DCC differently. This article gives an honest comparison - including where Fig is not the right choice.
DCC Level 2 and Level 3 apply to Moderate and High Cyber Risk Profile contracts. They are substantially larger engagements than L0 and L1, require Cyber Essentials Plus rather than CE, and are delivered by a smaller subset of UK Certification Bodies. This guide explains what each level involves, who delivers it, how long it takes, and when to certify at L2 or L3 rather than L1.
The CRP and required DCC level is specified on each contract by the MOD or the prime contractor. Primes, tier-2 subcontractors, and tier-3 subcontractors often face different requirements. This guide walks through how the scheme applies across contract tiers.