Many MOD and defence supply chain contracts require Cyber Essentials Plus - not just standard CE. As an IASME Approved Certification Body, we provide the independent technical audit your contract demands. Pre-Assessment Check included as standard. Fixed pricing, IASME fee included.
The Ministry of Defence requires cyber security certification across its supply chain. The specific level required depends on the contract - but CE Plus is increasingly specified where contracts involve sensitive data, classified environments, or where a prime contractor requires independent verification rather than self-assessment.
DEFCON 658 is the standard MOD contract condition requiring Cyber Essentials certification. Standard CE satisfies the baseline DEFCON 658 requirement. However, where contracts involve handling sensitive or classified information, or where the contracting authority specifies an independent technical audit, CE Plus may be required instead.
Where a contract references DCC Level 0, this is the MOD's own cyber certification built on top of Cyber Essentials. If your contract references DEFCON 658 or DCC Level 0, you will need both CE and DCC certification. See our DCC Level 0 page →
Increasingly, UK defence prime contractors require CE Plus from sub-contractors in their supply chain - independent technical verification rather than self-assessed CE. Check your contract or sub-contract conditions carefully. If CE Plus is specified, standard CE will not satisfy the requirement.
The level of certification required depends on your specific contract condition. Common scenarios:
Not sure what your contract requires? Ask our team →
CE Plus certificates are listed on the IASME public register. MOD procurement teams and prime contractors can verify your certification status directly - giving you a verifiable, searchable record to include in tender submissions.
Defence contractors often have a contract deadline driving certification. We include a Pre-Assessment Check before the formal audit begins - so any gaps are identified and fixed before the assessor starts, not after a failed result that could delay your contract.
We regularly work with MOD supply chain contractors and understand the DEFCON 658 context and wider MOD supply chain certification landscape. We can advise on whether CE, CE Plus, or DCC Level 0 is the right certification for your contract - before you start.
You work directly with your Lead Assessor from first contact through to your CE Plus certificate. No helpdesk, no rotating contacts. When your procurement team asks for a status update before a tender deadline, you can get a direct answer.
Four clear steps from enquiry to certification. Pre-Assessment Check included as standard - we identify any gaps before the formal audit begins.
Before the audit starts, we review your controls against CE Plus requirements in full. Any gaps are identified and resolved before the formal assessment begins - reducing the risk of issues on assessment day.
We confirm your assessment scope and asset list. You return an Audit Authorisation Form. Our assessor checks the scope is consistent with your Cyber Essentials certificate boundary before proceeding.
Remote vulnerability scanning, internal device sampling, and email and browser configuration checks - all conducted via screen share. No on-site visits required. Practical for defence contractors with restricted site access.
Your CE Plus certificate is issued by IASME, published on the public register, and emailed directly to you. Valid for 12 months - annual renewal required to maintain a current certificate for ongoing contract compliance. Your prime contractor or MOD procurement team can verify it instantly on the IASME registry.
CE Plus and DCC Level 0 are separate certifications that serve different purposes in the MOD supply chain. It is important not to confuse the two.
DCC Level 0 requires standard Cyber Essentials - not CE Plus. The CE basic certificate is the mandatory prerequisite for DCC Level 0; CE Plus is not required and does not replace the DCC assessment.
CE Plus is relevant to the defence supply chain for contracts where an independent technical audit is specifically required - typically where prime contractors or contracting authorities want more assurance than self-assessed CE provides, but DCC Level 0 is not the requirement.
Some defence contractors choose to hold CE Plus alongside or before DCC Level 0 because:
If your contract specifies DCC Level 0, you need CE basic (not CE Plus) as the prerequisite. If your contract specifies CE Plus or an independent technical audit, that is a separate requirement.
We offer CE, CE Plus, and DCC Level 0 certification. Not sure which applies to your contract? Our team can advise. See our DCC Level 0 page →
All prices are fixed and include the IASME certification fee. No hidden charges. See our full CE Plus pricing guide →
Cyber Essentials is a mandatory prerequisite for CE Plus. If you need both, buy them together and receive a bundle saving off the combined price. See bundle pricing →
Get independently verified for your MOD or defence supply chain contract. Talk to our UK-based team today. Direct contact, fixed price, IASME approved.
Need both Cyber Essentials and CE Plus? Buy them together as a single engagement and receive a bundle saving off the combined price. IASME fee included.
See Bundle Pricing →// DEFCON 658The MOD-specific cyber certification under DEFCON 658. Requires standard Cyber Essentials basic as its prerequisite. CE Plus is not required for DCC Level 0 and does not replace it.
DCC Level 0 →// Annual RequirementMany government and defence contracts require an annual pen test alongside CE Plus. CVSS-scored reports, free 30-day retest included as standard. From £1,499 + VAT.
Pen Testing →Client names are withheld in line with confidentiality requirements; character references are available upon request.