For a decade, UK defence suppliers demonstrated cybersecurity compliance by completing a Supplier Assurance Questionnaire (SAQ) under the MOD's Defence Cyber Protection Partnership (DCPP) framework. That era is ending. Defence Cyber Certification (DCC) - independently assessed, formally certified - is now the scheme MOD buyers expect suppliers to hold.
The transition is neither instant nor uniform. Some primes have already moved to DCC-required procurement. Others still accept DCPP SAQ during a defined transition window. This guide explains what the transition actually means operationally: what existing DCPP suppliers need to do, on what timeline, and how to manage buyer communication while both models are live.
For the broader scheme context, see the DCC explainer and the DCC levels guide.
The DCPP framework had three moving parts:
SAQ responses were recorded by the buyer and occasionally spot-checked, but there was no systematic independent verification. The gap between "the supplier declared this" and "the supplier actually does this" was the single largest weakness of the DCPP model, and the rationale for moving to DCC.
DCC keeps the CRP framework (because it works) and keeps DEFSTAN 05-138 as the underlying standard. What changes is verification. Three concrete shifts:
Under DCPP, a supplier submitted a fresh SAQ for each procurement. Under DCC, a supplier holds a certificate that covers multiple procurements at or below its CRP tier, simplifying bidding.
The answer depends on your pipeline and buyer posture. Three scenarios:
Some primes (typically the larger ones that were early adopters in the DCC scheme's first year) have moved their supplier base entirely to DCC. If your buyer is in this category, you have a limited window to certify at the DCC level matching your contract CRP. Delay risks exclusion from renewal or future procurement. Plan to certify within three to six months.
Most primes are still accepting DCPP SAQ during a defined transition window, usually with a stated deadline ("DCC required by [date]"). Work backwards from that deadline - add 14 to 21 days for L0 or 6 to 10 weeks for L1 - and start the engagement with a Certification Body before that backstop.
Do not wait. The direction of travel is unambiguous: DCC will become mandatory across the MOD supply chain within two to three years. Suppliers who certify early see two benefits: commercial advantage in competitive bids, and the ability to manage the certification on their own schedule rather than under deadline pressure.
Your existing DCPP submissions are useful as a starting point but do not substitute for DCC evidence. The main differences:
A supplier with a strong DCPP record will typically close the gap to DCC L0 in two to three weeks, and to L1 in six to eight weeks. A supplier with a thin DCPP record may find the gap is larger.
One of the biggest operational changes under DCC is the continuous compliance model. Rather than submitting a fresh SAQ every tender, a DCC-certified supplier holds a three-year certificate with annual attestation at months 12 and 24.
Annual attestation:
At Fig, annual attestation is included in the three-year certification fee. Some bodies charge for annual attestation separately; confirm this when comparing quotes (see the DCC pricing guide).
Buyers appreciate suppliers who communicate proactively about their DCC progress. A good template:
> We are currently certified under DCPP via SAQ as of [date] and are engaged with [Certification Body] for DCC Level [X] certification with a planned completion of [date]. We will share the DCC certificate as soon as it is issued and will continue to meet the DCPP attestation requirements through the transition.
This demonstrates awareness, commitment, and a concrete plan. It also gives the buyer the information they need for their own transition planning.
Two risks for suppliers who delay the DCC transition:
The practical conclusion: certify now at the level matching your current pipeline, whether or not your current buyer is formally requiring it.
Fig's DCPP-to-DCC transition support includes:
L0 pricing starts at £999.99 + VAT; L1 pricing starts at £9,999.99 + VAT for micro organisations. See DCC pricing for the full breakdown.
Key questions from MOD suppliers researching this topic.
DCPP self-attestation via the Supplier Assurance Questionnaire is being phased out in favour of DCC independent certification. Some primes have already moved fully to DCC-required procurement; others still accept DCPP attestation during a defined transition period. Check with each buyer.
Not always immediately, but yes in practice. The safest posture is to move to DCC at the level matched to the highest CRP in your current pipeline before buyers tighten requirements at a procurement deadline you cannot influence.
Partly. The underlying controls are similar - CSM v4 is the technical specification that underpins both - but the evidence bar is much higher under DCC. SAQ content is a useful starting point but not a direct substitute.
DCC certificates are valid for three years. Annual attestation is required at months 12 and 24, confirming controls continue to operate. Attestation is lighter-touch than re-certification - typically a self-declared confirmation reviewed by the Certification Body.
Retain DCPP records for at least three years as part of your audit trail. Future procurement exercises may reference the DCPP history as context, and annual attestation under DCC benefits from continuity of underlying evidence.
Defence Cyber Certification is the UK MOD's new independent cybersecurity certification framework for its supply chain. It replaces the self-assessed Supplier Assurance Questionnaire approach under the old DCPP. This guide explains how DCC works, who needs which level, and what the transition from DCPP means for existing suppliers.
The MOD's move from the self-assessed Supplier Assurance Questionnaire to independently-certified Defence Cyber Certification is the most significant shift in UK supply chain cybersecurity assurance in a decade. The sectors watching closely include critical national infrastructure, financial services, and the NHS - because the direction of travel for all of them is the same.
DCC certificates are valid for three years with an annual attestation each year. This guide explains what the annual attestation covers, how it differs from the full three-yearly assessment, the evidence to prepare, and what typically triggers findings between cycles.