DCC Level 0 Readiness Checklist | Evidence Document Checklist

⌛

Important: December 2026 Deadline

The MOD has mandated that all defence supply chain organisations achieve at least DCC Level 0 by 31 December 2026. Cyber Essentials is a mandatory prerequisite - your CE scope must align with your intended DCC scope. A scope misalignment fails the assessment immediately. Confirm everything in this checklist before your assessment begins.

Ready for DCC Level 0 assessment

0 / 12

Items confirmed

Tick each item below as you confirm the document or evidence is in place for your organisation.

Control 0001 SCOPING & BOUNDARY

The assessor will verify that your Cyber Essentials certificate is current and that your DCC scope is clearly defined with supporting documentation. A missing or misaligned CE certificate triggers automatic failure - no further controls are assessed. All three documents below must be ready before your assessment begins.

A current, unexpired Cyber Essentials certificate is in place - issued in your exact organisation's name by an IASME-licensed certification body Auto-Fail RiskThe CE certificate must not be expired and must cover the same organisational scope as your DCC assessment. A mismatch between CE scope and DCC scope is an automatic failure - no further controls will be assessed

A written DCC Scoping Statement is prepared - clearly detailing what is included and excluded from your network scope, with the technical rationale for the boundary Auto-Fail RiskThis is a formal written document, not a verbal explanation. It must align with your CE certificate scope. Vague or undocumented boundaries will be challenged by your assessor

A Network Architecture or Scope Diagram is prepared - visually mapping your internal network, firewalls, routers, cloud environment (e.g. M365 or Google Workspace), and remote workersThe diagram must visually match your CE certificate scope. If your CE scope shows users on M365, your diagram must show M365. Gaps between your diagram and your CE certificate will be flagged

Control 2314 UK GDPR & DATA PROTECTION

The assessor will review evidence demonstrating that personal data is processed lawfully under UK GDPR. This is an active compliance check - you must be able to evidence the controls are in place and working, not simply that you have written policies.

ICO Registration is confirmed and active - a copy of your registration certificate or a valid registration number with the Information Commissioner's OfficeMost organisations that process personal data must register with the ICO. Check ico.org.uk to confirm your registration is current and has not lapsed

A public-facing Privacy Policy is published on your website - clearly explaining what data is collected, how it is used, and on what legal basisThe assessor will check your website. The privacy notice must be accessible, up to date, and reflect your actual processing activities - not a generic template

A Data Mapping or Data Inventory document is in place - identifying what personal data your organisation holds, where it is stored, and who has accessSometimes called a Record of Processing Activities (RoPA). This must be a live, maintained document - not a one-off exercise that hasn't been reviewed

DPIA evidence is available - demonstrating that your organisation conducts Data Protection Impact Assessments for processing activities that carry operational riskNot all processing activities require a DPIA, but high-risk processing must have one. If you have never completed a DPIA, the assessor will ask why and this may be challenged

A named Data Protection Officer or Data Protection Lead is formally documented - with their name and role recorded internally and available to the assessorThis does not have to be an external DPO - an internal staff member can hold this role. The key requirement is that the accountability is formally assigned and documented, not just assumed

Consent Records are in place - evidence showing how your organisation captures, tracks, and manages consent from individuals whose data you processConsent records must demonstrate how and when consent was obtained. If you do not rely on consent as a legal basis (e.g. you rely on legitimate interests or contract), document that instead and ensure your other legal bases are clearly recorded

Control 2500 BUSINESS RESILIENCE & BACKUP

The assessor will verify that your organisation can recover from a cyber incident or data loss event. Resilience must be documented, backup must be actively in place, and restore capability must be tested and evidenced. Configured backups that have never been tested are not accepted as evidence of resilience.

A Resilience Policy or Business Continuity Plan is in place - a formal document signed off by management defining your backup and recovery proceduresThis does not need to be a lengthy document, but it must be formally signed off, reflect your actual environment, and include clear recovery procedures. An undated draft or template will not satisfy this control

Proof of active offsite or cloud backups is available - screenshots, configuration records, or backup logs showing critical data is regularly backed up and stored separately from the live environment Auto-Fail RiskBackups stored only on the same system or network as the live data do not satisfy this control. You must be able to show the backup is offsite or in a cloud environment (e.g. Azure Backup, AWS S3, a managed backup service) and that it runs regularly

Tested Restore evidence is available - a recent restore report, success log, or audit trail proving you have physically tested your ability to recover data from backup Auto-Fail RiskUntested backups are not accepted. The assessor wants to see that you have actually run a restore and verified the data. A screenshot of a backup completion notification alone is not sufficient - you need evidence of a successful recovery test

// What Next?

READY FOR YOUR DCC ASSESSMENT?

Our UK-based team will review your scoping and documentation before your formal assessment begins - identifying and resolving any gaps before they become failures. Fixed prices, IASME certification fee included. View pricing →

Start Assessment →Build Your Quote →

Don't yet hold Cyber Essentials? CE is a mandatory prerequisite for DCC Level 0 - you cannot proceed without it. We can manage both certifications as a single engagement. Use the CE basic readiness checklist →

This checklist is based on the DCC Level 0 evidence requirements under Def Stan 05-138 (Issue 4). It is provided as a self-assessment guide only - formal certification requires assessment by an IASME Approved Certification Body. For questions about your readiness, contact our team.

DCC LEVEL 0READINESS CHECKLIST

Control 0001 SCOPING & BOUNDARY

Control 2314 UK GDPR & DATA PROTECTION

Control 2500 BUSINESS RESILIENCE & BACKUP

READY FOR YOUR DCC ASSESSMENT?

GET CERTIFIED TODAY

DCC LEVEL 0
READINESS CHECKLIST