DCC vs CMMC: How the UK and US Defence Cyber Schemes Compare

DCC vs CMMC: How the UK and US Defence Cyber Schemes Compare

The CMMC position is under US government review and may change.

On 13 July 2026, the Ministry of Defence (MoD) used its Defence Digital blog to say it has asked all industry partners to achieve Defence Cyber Certification (DCC) Level 0 by 31 December 2026 [1]. The same day, the US Department of War suspended the move to Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) [2]. Each announcement changed the picture for suppliers on its own side of the Atlantic, and plenty of defence businesses sit in both supply chains.

This guide to DCC vs CMMC covers what each scheme requires, how assessment works, where each stands in October 2026 and what a supplier can sensibly do about it. It draws on the text of Def Stan 05-138 Issue 4, IASME, GOV.UK, the MoD and the US Department of War. Anything that comes from CyberSmart's own reading of those sources is labelled as such.

Two defence cyber schemes with different jobs

DCC belongs to the MoD's Cyber Security Model (CSM). Defence Standard 05-138 sets out the controls, IASME acts as the Certification Authority, and a supplier's certificate gives independent evidence that it meets the CSM [3]. The standard applies to the supplier's whole organisation. Clause 1.1 puts it plainly: "The scope of this standard is the Supplier's overarching corporate or enterprise environment" [4].

CMMC belongs to the US Department of War and exists to protect two kinds of information that contractors handle: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) [5]. Where DCC looks at the supplier as an organisation, CMMC can be applied to the whole enterprise network or to a particular enclave where that information is stored and handled [5].

What DCC asks of suppliers

Def Stan 05-138 Issue 4 was published on 14 May 2024. It replaced five Cyber Risk Profiles (N/A, Very Low, Low, Moderate and High) with four levels, each with a defined number of controls [4].

Sources: Def Stan 05-138 Issue 4 [4] and IASME [3].

The MoD assigns a Cyber Risk Profile through the CSM risk assessment process. Level 0 is normally assigned where the assessed cyber risk is very low, Level 1 where it is low to moderate, Level 2 where it is high and Level 3 where it is substantial [4].

What Level 0 contains

Level 0 has three controls: a current Cyber Essentials certification covering the scope required for the contract, UK GDPR compliance, and resilient networks and systems [4][6]. The standard requires a documented and implemented control for each requirement, backed by auditable evidence [4]. Where a control is inappropriate or impractical in a particular situation, the supplier documents that and flags it to the MoD at the time of bidding [4].

How assessment and renewal work

Assessment is delivered through IASME's network of assured certification bodies. IASME describes DCC as a point-in-time assessment against a UK defence standard, supported by annual attestation and full recertification every three years [3]. CyberSmart is one of those certification bodies and assesses Levels 0 and 1.

Where DCC stands in October 2026

The MoD's own wording is that it has "asked all industry partners to achieve Level 0" by 31 December 2026 [1]. The same post says subcontractors must be encouraged to work towards the objective, with appropriate timescales [1]. It also reports that Lockheed Martin has received the first DCC Level 3 certification [1].

DCC is not a legal requirement in itself. DEFCON 658 sets out the contractual terms of the Cyber Security Model, and suppliers pass those obligations down to their subcontractors [7]. Where DEFCON 658 appears in a contract, the requirements become contractual, so the contract in front of you is the document to check.

One practical point for suppliers already working through the Supplier Assurance Questionnaire (SAQ). GOV.UK guidance states that a valid DCC certificate does not yet exempt suppliers from elements of the SAQ, and that the full SAQ remains mandatory for now [7].

What CMMC asks of contractors

CMMC has three levels. Each is independent and has its own set of security requirements [5].

Source: CMMC Model Overview, Version 2.13 [5].

The model groups its requirements into 14 domains that align with the NIST SP 800-171 Rev 2 control families, including Access Control, Audit and Accountability, Incident Response and Media Protection [5]. Under the original design, Level 1 relied on self-assessment, Level 2 on self-assessment or an assessment by a Certified Third-Party Assessment Organization (C3PAO), and Level 3 on a government-led assessment [2][8].

Where CMMC stands in October 2026

Phase 2 would have introduced C3PAO assessments as a condition of award for most Level 2 contracts [8]. The Department of War says Phase 1 self-assessments remain in place, along with compliance with NIST SP 800-171 Rev 2 and the duty to protect covered defence information under DFARS 252.204-7012 [2]. Law firm analysis adds that new Level 2 (C3PAO) and Level 3 designations are not permitted during the suspension, and that obligations flowing down to subcontractors continue [8].

The Department's announcement gives the review a 60-day window and describes a goal of measures that are faster to adopt and easier for small businesses [2]. One secondary source reported on 12 October 2026 that it had found no announced replacement date for Phase 2 [9]. Suppliers should check the Department of War CIO website before relying on any date.

DCC vs CMMC side by side

Sources: [1], [3], [4], [5], [8], [10].

Where the two schemes overlap

The mapping document published with Def Stan 05-138 Issue 4 links each DCC control to external frameworks. Those include the NCSC Cyber Assessment Framework v3.1, NIST SP 800-171 Rev 3, NIST SP 800-172 Rev 2, NIST CSF 2.0 and 1.1, Cyber Essentials, ISO 27001:2022, ISO 22301 and ISO 27701 [11]. CMMC Level 2 is built on NIST SP 800-171 Rev 2, an earlier revision than the one in the DCC mapping [5][11].

CyberSmart's reading of those documents is that a supplier with strong access control, incident response and supply chain practices will find familiar ground in both schemes. CyberSmart has not found a statement from either authority that one scheme satisfies the other, so each should be treated as needing its own assessment.

What this means for suppliers

What is required

A UK supplier needs a current Cyber Essentials certificate that covers the scope of the work, plus evidence for the controls at the level its contracts specify. A US-facing contractor needs to know whether its contracts carry FCI or CUI, which CMMC level they call for, and what the contract clauses say about self-assessment today.

How suppliers typically approach it

Most start with scope: which systems, sites and people touch defence data. A gap check against the relevant control list follows, then evidence gathering, then booking an assessment. For DCC, certification takes time, and primes may set earlier internal dates than the MoD's [6]. The obvious first step is to ask the prime or customer which level, if any, their contract expects.

How CyberSmart helps

CyberSmart is an IASME-accredited certification body. It assesses DCC at Levels 0 and 1 and delivers Cyber Essentials and Cyber Essentials Plus, the prerequisite at every level. Active Protect provides continuous device monitoring and compliance checks between assessments, and CyberSmart Patch, which requires Active Protect, keeps third-party software up to date on Windows and macOS. CyberSmart's services described here relate to the UK scheme.

Frequently asked questions

Is Defence Cyber Certification mandatory?

DCC is not a legal requirement in itself. The MoD has asked all industry partners to achieve Level 0 by 31 December 2026 [1]. Where DEFCON 658 appears in a contract, the requirements are contractual, so check the contract and ask your prime if you are unsure [7].

Is CMMC certification required right now?

Phase 2 has been suspended since 13 July 2026, so third-party assessment is not currently being added to contracts. Phase 1 self-assessments and the DFARS 252.204-7012 duties remain in place [2].

Does a DCC certificate satisfy CMMC?

Neither authority states that one scheme satisfies the other. DCC is assessed by IASME-assured certification bodies against Def Stan 05-138, and CMMC is defined by US regulation. Evidence gathered for one can inform the other, but each needs its own assessment.

A sensible next step

If your organisation supplies the MoD or a defence prime, the first conversation is with your customer about which level your contracts call for. If you want to talk through DCC Level 0 or Level 1, or the Cyber Essentials certificate that sits beneath both, book a call with a CyberSmart advisor.

References

1. Ministry of Defence, Defence Digital blog, "Building cyber resilience in the UK one step at a time", 13 July 2026. defencedigital.blog.gov.uk
2. US Department of War, "Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements", 13 July 2026. business.defense.gov
3. IASME, Defence Cyber Certification. iasme.co.uk
4. Ministry of Defence, Defence Standard 05-138 Issue 4, "Cyber Security Standard for Suppliers", 14 May 2024. gov.uk
5. US Department of War CIO, CMMC Model Overview, Version 2.13. dodcio.defense.gov
6. IASME, "Level 0: the smart starting line for Defence Cyber Certification". iasme.co.uk
7. GOV.UK, Cyber Security Model guidance (CSMv4, DEFCON 658 and the Supplier Assurance Questionnaire). gov.uk
8. Latham & Watkins, "What Defense Contractors Should Know About DOD's Suspension of CMMC Phase 2". lw.com
9. The Defense Compliance Report, "CMMC Deadlines 2026: Phase II Suspension and What's Active", status as at 12 October 2026. thedefensecompliancereport.com
10. Federal News Network, "Pentagon suspends CMMC phase two requirements, launches review of program", July 2026. federalnewsnetwork.com
11. Ministry of Defence, mapping document for Def Stan 05-138 Issue 4. gov.uk