Understanding the Four Levels of Defence Cyber Certification: Which One Is Right for Your Organisation?
If your organisation works within the UK defence supply chain, you've likely heard about Defence Cyber Certification (DCC). As cyber security expectations continue to evolve, suppliers are increasingly expected to demonstrate that they can protect sensitive information and manage cyber risk effectively.
One of the first questions organisations ask is: Which level of Defence Cyber Certification do we need?
The answer depends on the type of work you undertake, the information you handle and the requirements defined within your contracts. Understanding the four certification levels is the first step towards preparing your organisation for compliance.
What Is Defence Cyber Certification?
Defence Cyber Certification is a cyber security framework designed to help organisations operating within the UK defence supply chain demonstrate appropriate levels of cyber resilience.
Rather than taking a one-size-fits-all approach, Defence Cyber Certification introduces four levels of assurance. Each level reflects the level of cyber risk associated with the work your organisation performs, ensuring that cyber security requirements are proportionate to the contracts being delivered.
Defence Cyber Certification Level 0
Best suited for organisations beginning their cyber security journey
Level 0 is intended for organisations that are not currently required to achieve Defence Cyber Certification but want to understand the framework and begin improving their cyber security posture.
At this stage, organisations should focus on:
Understanding Defence Cyber Certification
Identifying current cyber security risks
Reviewing existing IT systems and processes
Building awareness across the organisation
Although Level 0 is not a formal certification, it provides an excellent starting point for businesses preparing to work within the defence sector.
Defence Cyber Certification Level 1
Foundational cyber security for lower-risk contracts
Level 1 introduces the essential technical, organisational and governance controls expected of organisations delivering lower-risk defence work.
The focus is on demonstrating that appropriate cyber security measures are in place to protect systems and information used within defence contracts.
Organisations working towards Level 1 should expect to review areas such as:
Device security
User access controls
Password management
Software updates
Basic security policies
Staff awareness
For many organisations entering the defence supply chain, Level 1 provides the first formal step towards demonstrating cyber resilience.
Defence Cyber Certification Level 2
Enhanced assurance for more sensitive environments
As organisations begin handling more sensitive information or supporting higher-risk defence activities, additional cyber security controls become necessary.
Level 2 builds upon the foundations established at Level 1 and requires organisations to demonstrate stronger governance, technical security and operational maturity.
This may include improvements across areas such as:
Security monitoring
Risk management
Incident response
Access management
Asset management
Security documentation
Rather than simply implementing security controls, organisations must demonstrate that those controls are consistently managed and maintained.
Defence Cyber Certification Level 3
Advanced cyber resilience for the highest-risk environments
Level 3 represents the highest level of Defence Cyber Certification.
It is intended for organisations supporting defence activities where the potential impact of a cyber incident is significantly greater.
At this level, organisations are expected to demonstrate a mature, organisation-wide approach to cyber security, with robust governance, technical controls and continual improvement embedded throughout the business.
This is not simply about achieving compliance, it is about maintaining a high level of cyber resilience across every part of the organisation.
How Do You Know Which Level You Need?
One of the most common questions organisations ask is, "Which Defence Cyber Certification level applies to us?" The answer isn't based on the size of your business or the level you would prefer to achieve. Instead, the required certification level is determined by the Cyber Risk Profile (CRP) assigned to the work you undertake within the UK defence supply chain.
That Cyber Risk Profile is typically defined by the Ministry of Defence, a prime contractor or another customer as part of the procurement or contractual process. It reflects the level of cyber risk associated with the services you provide, the information you access and the potential impact a cyber incident could have on defence operations.
As organisations move into more sensitive or higher-risk areas of the defence supply chain, the expected level of cyber assurance increases accordingly. This ensures that cyber security requirements remain proportionate to the risks associated with each contract.
If you're unsure which level applies to your organisation, seeking advice early can save significant time and effort. Understanding your likely requirements before beginning your certification journey allows you to focus on the controls, governance and documentation that matter most, helping you prepare with confidence and avoid unnecessary work.
Preparing for Defence Cyber Certification
Regardless of the level required, successful certification begins with understanding your current cyber security posture.
Many organisations discover that they already have some of the required controls in place but need support strengthening technical security, improving governance or developing the documentation needed to demonstrate compliance.
Preparing early helps reduce delays, improves cyber resilience and gives your organisation greater confidence when bidding for defence-related work.
How Sunrise Technologies Can Help
Preparing for Defence Cyber Certification isn't simply about passing an assessment. It's about building the right technical foundations, governance and business processes to support long-term cyber resilience.
At Sunrise Technologies, we work with organisations to identify security gaps, strengthen technical controls, improve governance and create practical roadmaps towards Defence Cyber Certification. Whether you're exploring the framework for the first time or preparing for a specific certification level, our team can help you understand what's required and support you throughout the journey.
If you're unsure which Defence Cyber Certification level applies to your organisation, speak to our team today and take the first step towards building a stronger, more resilient business.