Free · no account needed

DCC Level 0 check

Seven questions on whether you look ready for Level 0 of Defence Cyber Certification (DCC), the Ministry of Defence’s cyber scheme for its suppliers. It takes a few minutes.

Scored in your browser, the same way as our full DCC Readiness Assessment. Nothing is sent anywhere.
Your answers are kept in this browser only, so you can come back to them.
A readiness check, not a certification. Security Compliance Hub isn’t affiliated with IASME or the MOD.

Level 0 questions

0 of 7 answered

Level 0 is strict: every one of these needs a Yes. The scope statement and Cyber Essentials questions are pass or fail on their own.

1Have you written and signed a DCC scope statement, backed by diagrams and system lists that show exactly what is in and out of scope, and does it cover everything the certification needs to?

Scope statement · pass or fail · IASME 0000.1

The scope decides what every other answer refers to, so it is checked first. The assessor needs to understand your scope from your documents alone: organisation and network diagrams, a list of systems, and which of them your Cyber Essentials certificate covers. A scope that is unclear, or leaves out things it should include, fails the whole assessment.

Yes No

2Is your Cyber Essentials certification in place and does its scope take in every internet-connected device and network inside your DCC scope?

Cyber Essentials · pass or fail · IASME 0001.1 · MOD 000011

Cyber Essentials only covers equipment connected to the internet, so your DCC scope, which also includes offline systems, will usually be wider. The assessor checks that the two scopes line up, allowing for devices Cyber Essentials itself leaves out, and a mismatch fails the whole assessment. Expect to provide your certificate number, your Cyber Essentials questionnaire or report, and a diagram showing where the Cyber Essentials scope sits within the DCC scope.

Yes No

3Will you keep your Cyber Essentials certification renewed for as long as your DCC certification, and any related contract, lasts?

Cyber Essentials · pass or fail · IASME 0001.2 · MOD 000625

Cyber Essentials certificates expire, so this checks you have committed to renewing on time and to following scheme updates for the life of your DCC certification and any contracts it supports. A signed commitment or a record of past renewals is the usual evidence.

Yes No

4Do you have documented policies and procedures that make sure you meet your UK GDPR obligations?

UK GDPR compliance · IASME 2314.1 · MOD 000447

This checks that data protection duties are written down and followed. Expect to show the relevant policies, such as your data protection policy and procedures for handling personal data.

Yes No

5Do you carry out Data Protection Impact Assessments (DPIAs) on the types of data you hold or process?

UK GDPR compliance · IASME 2314.2 · MOD 000446

A DPIA can involve identifying processing activities, looking at the data types, spotting risks and impacts, reducing those risks and recording the results. An assessor will usually want to see completed DPIAs and how they are triggered.

Yes No

6Have you worked out how resilient your systems need to be against cyber-attacks and system failures?

Resilient networks and systems · IASME 2500.1 · MOD 000452

This checks that you have judged, rather than assumed, how well your key systems must hold up and recover. An assessor will want to see the risks you identified and which systems are essential, scaled to your size: a short risk note for a small business, a risk register and supporting documents for a larger one.

Yes No

7Have you put resilience measures into your systems that meet the needs you identified?

Resilient networks and systems · IASME 2500.2 · MOD 000453

This checks that your resilience assessment led to real changes, not just a policy. Expect to show practical measures, such as redundancy, failover, spare capacity or recovery tooling, and explain how each one answers a need from your assessment.

Yes No