All Categories

overlay
5 Oct

New MOD Cyber Requirements: What Defence Suppliers Need to Know

The Ministry of Defence has asked all industry partners to work towards achieving Defence Cyber Certification (DCC) Level 0 by 31 December 2026. Defence Cyber Certification has been available for over a year, but the latest announcement sets a clear expectation that all defence suppliers should now work towards at least Level 0.

Level 0 includes a requirement to hold Cyber Essentials for all applicable business-critical systems within scope. ‘Scope’ means the parts of your business and the IT systems that the certification covers, such as computers, email accounts, networks and cloud services.

If you supply the MOD directly, the message is clear. Find out now what will be expected of your business. Waiting until the requirement appears in a tender or contract renewal could leave too little time to deal with problems.

What is Defence Cyber Certification?

Defence Cyber Certification, usually shortened to DCC, gives the MOD and its contractors a consistent way to assess the cyber security of organisations throughout the supply chain. Different levels apply depending on the work being carried out and the systems and information involved. Level 0 is the starting point.

Cyber Essentials covers five areas: firewalls, secure configuration, user access, malware protection and security updates. These are basic controls, but they prevent many of the attacks that exploit unpatched software, insecure devices and poorly managed accounts.

Although Cyber Essentials forms part of Level 0, organisations also need to meet the wider requirements of the Defence Cyber Certification (DCC) framework. Suppliers should establish which DCC level applies to their work and which parts of their organisation need to be included within its scope.

Why subcontractors need to pay attention

Defence contracts often involve a long chain of specialist suppliers. Engineering companies, manufacturers, software providers, consultants and logistics businesses may all support a larger contract without working directly for the MOD. That does not put them outside the cyber security requirement.

Prime contractors, the businesses holding the main MOD contracts, need assurance that suppliers handling their information or contributing to delivery have appropriate security controls in place. These requirements can be passed down through several levels of the supply chain.

Start by getting the scope right

One of the first jobs is to establish which systems need to be covered by certification. This is known as its scope. It may include devices, Microsoft 365 accounts, cloud services, networks and other systems used to hold information or support the contract. A Cyber Essentials certificate must cover the applicable business-critical systems. A current certificate may not be enough if it covers the wrong part of the organisation.

If you already hold Cyber Essentials, check:

  • When the certificate expires
  • Whether its scope includes all relevant systems
  • Whether your systems have changed since certification

Cyber Essentials certificates last for 12 months. Your renewal date therefore needs to fit with the December 2026 DCC deadline and any earlier date set by your customer.

Allow time to resolve problems

Cyber Essentials is achievable for most organisations, but the process can uncover work that needs to be completed first.

Unsupported software and hardware, missing operating systems and app updates, unnecessary administrator access and unmanaged devices are common findings. Microsoft 365 settings and arrangements for remote workers can also require attention.

These problems are usually manageable when found early. They become harder to deal with when a tender or contract deadline is only a few weeks away.

A readiness review checks your systems against the certification requirements. It will show you what needs attention and give you a clearer idea of the likely timescale.

How Secure360.io can help

Our Team has helped organisations achieve Cyber Essentials certification since 2017. We have supported more than 100 organisations, including clients working to fixed procurement and contract deadlines.

We review the systems within scope, identify anything that could hold up certification and explain what needs to change. Where technical work is required, we can help complete it before the formal assessment. Every organisation we have supported through certification has passed once the agreed remedial work was complete.

The formal certification decision is made by an independent certification body.

What defence suppliers should do next

If your business supplies the MOD or works for a defence prime contractor, speak to your customer and confirm:

  • Which DCC level applies to your work
  • Which systems must be covered
  • When certification evidence will be required
  • Whether the requirement extends to any of your own subcontractors

The MOD has asked industry partners to achieve Level 0 by 31 December 2026. Check whether your customer has set an earlier date for your contract.

Need help preparing for Cyber Essentials?

Secure360.io can review your current position and help you address any issues before certification.

Book a Cyber Essentials consultation

FAQs

Do all MOD industry partners need DCC Level 0?

The MOD has asked all industry partners to achieve Level 0 by 31 December 2026. Confirm the precise level and scope with your MOD contact, customer or prime contractor.

Does an existing Cyber Essentials certificate meet the requirement?

It forms part of the requirement, but you need to check that it is current and covers all applicable business-critical systems. You must also meet the other DCC requirements and obtain DCC certification.

Can the requirement be passed down to subcontractors?

Yes. The MOD has specifically told suppliers to consider subcontractor timescales where certification requirements apply further down the supply chain.

Read the Ministry of Defence announcement on Building cyber resilience in the UK one step at a time.

Business growth shown by people shaking hands.
overlay
22 Jul

Why Cyber Resilience Matters for SME Growth

Cyber resilience is becoming a normal part of doing business. Larger clients, insurers and regulated organisations increasingly want to know that the businesses they work with can manage cyber risk, recover from disruption and show what protections they have in place.

The Cyber Security and Resilience Bill, which had its second reading in the House of Lords on 14th July 2026, reflects that wider shift. The Bill is aimed mainly at larger organisations and key service providers, but the expectations behind it are already reaching smaller businesses through contracts, insurance and supplier checks.

For SMEs, the issue is not just whether the Bill applies directly, it is whether they can answer the cyber security and resilience questions now being asked of suppliers.

That does not mean every SME needs enterprise-level security. It does mean knowing what protections are in place, who is looking after them, how the business would recover from an incident, and what evidence could be provided if a client or insurer asked.

Growth brings more questions

A small business can run for years with informal processes and a trusted IT provider in the background. That may work well enough with familiar clients and straightforward operations but growth changes that.

A tender may ask whether you have Cyber Essentials. An insurer may want to know if multi-factor authentication is active across all accounts. A larger customer may ask for evidence of staff training, endpoint protection, backups or incident response planning.

These requests often arrive at awkward moments: during a contract negotiation, renewal, insurance application or procurement deadline. The businesses that struggle are not always the ones with no protection in place. More often, they have tools in place but cannot easily show how they are configured, monitored or reviewed. That creates delays at exactly the point where the business is trying to move forward.

Supplier cyber security is under closer scrutiny

The National Cyber Security Centre has warned that weaknesses in suppliers can affect the security of wider supply chains. Larger organisations know this, which is why cyber security checks are becoming a routine part of approving, renewing or expanding supplier relationships.

This is where better cyber security can help an SME commercially.

A business with clear controls, regular reporting and recognised certification is easier to assess. It can answer security questionnaires faster and avoid the last-minute scramble that happens when evidence is requested but no one is sure where to find it.

Cyber Essentials is a useful starting point because it gives SMEs a recognised framework for common security controls. Cyber Essentials Plus adds a technical audit, which can help where clients want a higher level of assurance.

Better security makes the business easier to trust

Cyber security is often discussed in terms of threats and attacks. For growing SMEs, it also matters because it removes friction. It helps with tenders, insurance applications, due diligence and board reporting. It gives staff clearer guidance on what to do when something looks suspicious.

The Cyber Security and Resilience Bill shows that resilience, reporting and supplier risk are becoming standard business concerns. Many SMEs may sit outside the direct scope of the legislation, but they will still feel the effect through the expectations of clients, insurers and regulated organisations.

Image of a padlock - password security
overlay
12 May

Passkeys vs Passwords: Is World Password Day Finished?

World Password Day has traditionally focused on creating stronger passwords and improving password security. But this year felt different.

The National Cyber Security Centre (NCSC) has started using the phrase “World Passkey Day” as the focus shifts towards passwordless authentication.

The NCSC is now recommending passkeys over passwords where they are available because passkeys are designed to be both more secure and easier for people to use.

For SMEs, charities, and professional services firms, this matters because most cyber attacks still begin with compromised credentials.

Why businesses are moving beyond passwords

For years, organisations have focused on improving password security:

  • longer passwords
  • more complex passwords
  • password expiry policies
  • different passwords for every account

Those controls still matter but passwords continue to create security problems because passwords can still be:

  • stolen through phishing
  • reused across accounts
  • exposed in previous data breaches
  • shared between staff
  • guessed from public information
  • captured by malware

This is one of the main reasons account compromise remains one of the most common causes of cyber incidents affecting businesses.

Most attackers do not need to “hack” their way into a business network. They simply log in using valid credentials.

What are passkeys?

Passkeys are a passwordless authentication method designed to replace traditional passwords. Instead of relying on something a user remembers, passkeys use secure cryptographic authentication tied to a trusted device. In practice, this often means users log in using:

  • fingerprint recognition
  • Face ID
  • device PINs
  • biometric authentication

According to the NCSC, passkeys are resistant to phishing attacks and cannot be guessed or reused in the same way as passwords. That makes them significantly harder for attackers to steal.

Passkeys also remove many of the usability problems associated with traditional password policies. Staff do not need to remember long complex passwords or repeatedly reset forgotten credentials. The combination of stronger security and simpler access is one of the reasons passkeys are gaining momentum so quickly.

Passwords are not disappearing overnight

Most organisations will still rely on passwords for many systems for years to come. Many business applications and legacy systems do not yet support passkeys or passwordless authentication. That means password security fundamentals still matter.

Businesses should still be using:

  • multi-factor authentication (MFA)
  • password managers
  • unique passwords for every account
  • individual user accounts
  • strong access controls
  • phishing awareness training

Passkeys are not a replacement for good cyber hygiene, they are part of reducing reliance on passwords over time.

What good authentication security looks like for SMEs

For most SMEs, charities, and professional services firms, a practical approach now looks like this.

Use passkeys where supported

Enable passkeys on supported platforms such as Microsoft, Google, and Apple services where practical.

Keep MFA enabled

MFA remains one of the most effective ways to reduce the risk of account compromise.

Use a password manager

Password managers help staff use strong unique passwords without relying on memory or unsafe workarounds.

Remove shared accounts

Shared logins reduce accountability and make incident investigations far more difficult.

Review access regularly

Many organisations still have dormant accounts, excessive permissions, and outdated MFA settings sitting unnoticed in the background.

Is this the last real World Password Day?

Passwords are not disappearing tomorrow but the direction of travel is becoming increasingly clear. The NCSC recommending passkeys over passwords reflects a wider recognition across the cyber security industry that passwords alone are no longer enough to deal with modern attacks.

For organisations, the practical takeaway is simple: Reduce reliance on passwords where better alternatives already exist.

Secret Link