Cyber Security News

overlay
5 Oct

New MOD Cyber Requirements: What Defence Suppliers Need to Know

The Ministry of Defence has asked all industry partners to work towards achieving Defence Cyber Certification (DCC) Level 0 by 31 December 2026. Defence Cyber Certification has been available for over a year, but the latest announcement sets a clear expectation that all defence suppliers should now work towards at least Level 0.

Level 0 includes a requirement to hold Cyber Essentials for all applicable business-critical systems within scope. ‘Scope’ means the parts of your business and the IT systems that the certification covers, such as computers, email accounts, networks and cloud services.

If you supply the MOD directly, the message is clear. Find out now what will be expected of your business. Waiting until the requirement appears in a tender or contract renewal could leave too little time to deal with problems.

What is Defence Cyber Certification?

Defence Cyber Certification, usually shortened to DCC, gives the MOD and its contractors a consistent way to assess the cyber security of organisations throughout the supply chain. Different levels apply depending on the work being carried out and the systems and information involved. Level 0 is the starting point.

Cyber Essentials covers five areas: firewalls, secure configuration, user access, malware protection and security updates. These are basic controls, but they prevent many of the attacks that exploit unpatched software, insecure devices and poorly managed accounts.

Although Cyber Essentials forms part of Level 0, organisations also need to meet the wider requirements of the Defence Cyber Certification (DCC) framework. Suppliers should establish which DCC level applies to their work and which parts of their organisation need to be included within its scope.

Why subcontractors need to pay attention

Defence contracts often involve a long chain of specialist suppliers. Engineering companies, manufacturers, software providers, consultants and logistics businesses may all support a larger contract without working directly for the MOD. That does not put them outside the cyber security requirement.

Prime contractors, the businesses holding the main MOD contracts, need assurance that suppliers handling their information or contributing to delivery have appropriate security controls in place. These requirements can be passed down through several levels of the supply chain.

Start by getting the scope right

One of the first jobs is to establish which systems need to be covered by certification. This is known as its scope. It may include devices, Microsoft 365 accounts, cloud services, networks and other systems used to hold information or support the contract. A Cyber Essentials certificate must cover the applicable business-critical systems. A current certificate may not be enough if it covers the wrong part of the organisation.

If you already hold Cyber Essentials, check:

  • When the certificate expires
  • Whether its scope includes all relevant systems
  • Whether your systems have changed since certification

Cyber Essentials certificates last for 12 months. Your renewal date therefore needs to fit with the December 2026 DCC deadline and any earlier date set by your customer.

Allow time to resolve problems

Cyber Essentials is achievable for most organisations, but the process can uncover work that needs to be completed first.

Unsupported software and hardware, missing operating systems and app updates, unnecessary administrator access and unmanaged devices are common findings. Microsoft 365 settings and arrangements for remote workers can also require attention.

These problems are usually manageable when found early. They become harder to deal with when a tender or contract deadline is only a few weeks away.

A readiness review checks your systems against the certification requirements. It will show you what needs attention and give you a clearer idea of the likely timescale.

How Secure360.io can help

Our Team has helped organisations achieve Cyber Essentials certification since 2017. We have supported more than 100 organisations, including clients working to fixed procurement and contract deadlines.

We review the systems within scope, identify anything that could hold up certification and explain what needs to change. Where technical work is required, we can help complete it before the formal assessment. Every organisation we have supported through certification has passed once the agreed remedial work was complete.

The formal certification decision is made by an independent certification body.

What defence suppliers should do next

If your business supplies the MOD or works for a defence prime contractor, speak to your customer and confirm:

  • Which DCC level applies to your work
  • Which systems must be covered
  • When certification evidence will be required
  • Whether the requirement extends to any of your own subcontractors

The MOD has asked industry partners to achieve Level 0 by 31 December 2026. Check whether your customer has set an earlier date for your contract.

Need help preparing for Cyber Essentials?

Secure360.io can review your current position and help you address any issues before certification.

Book a Cyber Essentials consultation

FAQs

Do all MOD industry partners need DCC Level 0?

The MOD has asked all industry partners to achieve Level 0 by 31 December 2026. Confirm the precise level and scope with your MOD contact, customer or prime contractor.

Does an existing Cyber Essentials certificate meet the requirement?

It forms part of the requirement, but you need to check that it is current and covers all applicable business-critical systems. You must also meet the other DCC requirements and obtain DCC certification.

Can the requirement be passed down to subcontractors?

Yes. The MOD has specifically told suppliers to consider subcontractor timescales where certification requirements apply further down the supply chain.

Read the Ministry of Defence announcement on Building cyber resilience in the UK one step at a time.

Image to announce Secure360 achieving IASME Cyber Assurance Level One
overlay
18 Aug

Secure360.io achieves IASME Cyber Assurance Level One

Cyber security isn’t only about preventing an attack. Businesses also need to be able to respond, recover and continue operating when something goes wrong. The focus on cyber resilience is becoming increasingly important, with both the UK Government and the National Cyber Security Centre encouraging organisations to look beyond technical defences and consider how they would manage and recover from a cyber incident.

Cyber resilience is also an important part of IASME Cyber Assurance certification, which looks beyond technical controls at how cyber security is managed across an organisation.

This broader approach to cyber security is something we regularly discuss with our clients, so it’s important that we apply the same principles within our own business. With that in mind, .net Highland Ltd, the company behind Secure360, has achieved IASME Cyber Assurance Level One, building on our existing Cyber Essentials Plus certification.

How is it different from Cyber Essentials Plus?

Cyber Essentials focuses on five technical controls designed to protect organisations against common cyber attacks. With Cyber Essentials Plus, those controls are independently tested.

IASME Cyber Assurance takes a wider view. It looks at how cyber security is managed across the business, including who is responsible for it, how risks are managed and how access to sensitive information is controlled.

It also considers staff training, suppliers, backups, business continuity and incident response.

Level One is a verified self-assessment reviewed by an independent Assessor. It isn’t the same as the audited Level Two certification, but it requires an organisation to examine a broader range of security arrangements than Cyber Essentials alone.

Why did we want the certification?

For us, it was important to check that the standards we discuss with clients are reflected in the way we manage security within the business.

IASME Cyber Assurance Level One gave us a structured way to do that. We reviewed our policies, responsibilities, systems, suppliers and processes against the requirements of the standard.

It also meant checking that what is written down reflects what actually happens in practice. Responsibilities need to be clear, and processes need to work when they are needed.

Could IASME Cyber Assurance be useful for your business?

It’s possible to have good technical security in place and still have gaps in the way security is managed across the wider business.

You might already use multi-factor authentication, keep devices updated, protect endpoints and have Cyber Essentials certification. But what happens if a key supplier suffers a cyber incident? Is there a documented process for removing access when an employee leaves? Does everyone know what to do following a data breach? Could the business continue operating if an important system became unavailable? These are the kinds of questions IASME Cyber Assurance is designed to address.

It can be particularly useful if customers are asking for evidence of your security arrangements, you handle sensitive or personal information, or your business forms part of a larger organisation’s supply chain. It can also give directors and trustees a clearer view of how cyber risk is being managed.

For some businesses, many of the right security measures may already be in place, but the processes around them have developed informally over time. Responsibilities may not be documented, or it may be difficult to demonstrate what happens in practice when a customer or another organisation asks for evidence. IASME Cyber Assurance provides a framework for bringing those arrangements together and identifying where more work may be needed.

Going through the process ourselves has also given us first-hand experience of what it involves. When we talk to clients about their own security requirements, we know the questions they’ll need to answer because we’ve had to answer them ourselves.

Helen Kings, Secure360.io

Business people at a meeting with 2 laptops
overlay
2 Mar

Cyber Security for SMEs in the UK: No Business Is “Too Small” to Be Targeted

Recent reporting in The Times highlights a clear message from ministers: no business is out of reach from cyber criminals. The article draws on the latest government survey data showing that around half of UK small businesses reported a cyber breach or attack in the past year. At the same time, the Department for Science, Innovation and Technology and the National Cyber Security Centre have reinforced that cyber threats are increasing in frequency and impact.

This is not new. But the framing has shifted. Cyber risk is now described as a business issue, not simply an IT concern.

Are small businesses really targeted by cyber criminals?

Yes. Most attacks affecting UK SMEs are not advanced, targeted operations. They are:

  • Phishing emails
  • Compromised passwords
  • Stolen Microsoft 365 credentials
  • Malware delivered through ordinary user activity

These attacks are automated and opportunistic. Criminals do not screen for company profile. They scan for exposed systems, weak passwords, and inconsistent controls.

If your defences are basic but unmanaged, you are visible.

Why cyber security is now an operational risk for SMEs

For a large enterprise, an incident may be absorbed by specialist teams. For a small or medium-sized business, the impact is often immediate:

  • Email access lost
  • Invoices delayed
  • Customer data inaccessible
  • Staff unable to work
  • Reputational damage within local networks

The financial cost is frequently cited. The operational disruption is often worse. Cyber security for small businesses in the UK is therefore about continuity, not just compliance.

Why supply-chain expectations are rising

There is another shift taking place. Large organisations are under increasing pressure to understand cyber risk within their supply chains. That includes professional services firms, contractors, third sector organisations, manufacturers and local partners.

If you:

  • Handle client data
  • Access a larger organisation’s systems
  • Provide outsourced services
  • Process payments
  • Connect to shared platforms

You are already part of a supply chain.

As ministers publicly state that no business is out of reach, expectations extend beyond defending against attackers. They extend to demonstrating responsible controls.

SMEs are increasingly being asked:

  • Do you enforce multi-factor authentication?
  • How do you manage administrator access?
  • How quickly are security updates applied?
  • Are backups documented and tested?

These questions now appear in procurement documentation, contract clauses and insurer renewals. For many organisations, the pressure to strengthen cyber security does not begin with an attack. It begins with a client request. Ignoring that shift introduces commercial risk. Addressing it builds trust. Cyber resilience is becoming a condition of doing business.

What practical steps should SMEs prioritise?

You do not need complexity. You need consistency.

Start with:

  • Multi-factor authentication across all key systems
  • Controlled and limited administrator access
  • Reliable patching of devices and servers
  • Tested, segregated backups
  • Ongoing phishing awareness for staff

These measures prevent the majority of opportunistic attacks affecting UK SMEs.

Cyber risk is business risk

The recent coverage in The Times also reflects a broader change in tone. Ministers are positioning cyber security as part of economic resilience. That has implications for SME leaders.

The question is no longer: “Are we likely to be attacked?” It is:

"If our cloud systems, email or client data were compromised tomorrow, how quickly could we recover?”

In practice, most SMEs do not struggle because they lack sophisticated tooling. They struggle because baseline controls are inconsistently applied, reviewed once and forgotten, or delegated without oversight.

Resilience is not built through dramatic projects. It is built through steady, informed leadership decisions.

If no business is out of reach, then cyber security belongs in routine business conversations alongside finance, staffing and growth. Not as noise. Not as fear. As governance.

Frequently Asked Questions

Are small businesses in the UK really targeted by cyber criminals?

Yes. Government survey data shows that around half of UK small businesses report experiencing a cyber breach or attack each year. Most incidents are not highly sophisticated. They involve phishing emails, stolen credentials or unpatched systems. Criminals typically target weak controls rather than company size.

What is cyber security for SMEs?

Cyber security for SMEs refers to the practical controls and processes that protect small and medium-sized businesses from digital threats. This includes securing email and cloud platforms such as Microsoft 365, managing access permissions, applying security updates, backing up data and training staff to recognise phishing.

Why is cyber security now a supply-chain issue?

Larger organisations are increasingly required to assess the cyber risk within their supply chains. If your business handles client data, connects to external systems or provides outsourced services, you may be asked to demonstrate basic security controls. Cyber resilience is now part of procurement and contract discussions.

How can an SME reduce cyber risk quickly?

The most effective immediate steps are:

  • Enable multi-factor authentication across all critical systems
  • Limit and monitor administrator access
  • Apply security updates promptly
  • Test backups regularly
  • Provide staff phishing awareness training

Consistent application of these baseline controls prevents the majority of opportunistic attacks affecting UK SMEs.

A practical starting point

For many SMEs the challenge is not understanding cyber risk, it is knowing where the current gaps exist.

If you would like a short review of your current cyber security posture, we can help identify:

  • where your biggest risks may sit
  • whether baseline controls are consistently applied
  • where improvements could strengthen resilience

This is usually a 30-minute conversation focused on practical steps rather than technology jargon.

👉 Contact Secure360 to start the discussion.

Secret Link