How to Find the Right DCC Assessor

Defence Cyber Certification (DCC) assessments are delivered by Certification Bodies (CBs): organisations licensed by IASME, which operates the DCC scheme on behalf of the Ministry of Defence. You cannot self-certify at any DCC level, and no software platform can issue the certificate for you. A licensed CB assesses your evidence against DefStan 05-138 and makes the certification decision.

Finding the right CB comes down to four questions: are they licensed to assess at your target level, do they know your sector, when can they actually take you, and what will they charge. And if your Cyber Essentials assessor does not offer DCC, that is normal and it will not slow you down. This article covers how to find a CB that does, and how to compare quotes before you commit.

Who is qualified to assess DCC?

Suppliers usually say "assessor". Strictly, the assessor is the person who reviews your evidence, and the organisation they work for is a Certification Body. To deliver DCC assessments, a Certification Body must be licensed by IASME, the scheme operator for DCC, and accredited through UKAS (or an equivalent national accreditation body) against ISO/IEC 17021-1, the standard that governs how certification bodies must conduct themselves.

The practical consequence for a supplier is simple: your DCC assessment can only come from that licensed pool, and the pool is currently small. If you are new to DCC, start with what DCC certification is before choosing who assesses you.

Can my Cyber Essentials assessor do my DCC assessment?

Only if they hold a separate DCC licence. DCC licensing is distinct from Cyber Essentials accreditation. Many Cyber Essentials assessors are moving into DCC, but the DCC-licensed pool remains much smaller than the CE pool, so there is a good chance the body that certified your Cyber Essentials does not yet offer DCC.

If that is your position, three things are worth knowing:

• Your Cyber Essentials certificate stays valid. It covers the Level 0 pre-objective, and CE is mandatory at every DCC level, regardless of which body issued it.
• You do not have to switch. You can keep your existing CE assessor for Cyber Essentials renewals and use a different Certification Body for DCC. The scheme has no requirement that both come from the same body.
• You do not have to find the DCC CB yourself. A matching service can do the searching, checking and quote-gathering for you. Snubnose does this for suppliers certifying through the platform.

What should you look for in a DCC Certification Body?

Five things separate a good fit from a slow, expensive one.

Level coverage. CBs qualify to assess at specific DCC levels. A CB licensed for Level 0 and Level 1 cannot assess you at Level 2. Confirm the CB is qualified at your target level before anything else.

Sector experience. A CB that has assessed businesses like yours (same size, similar systems, similar contracts) asks sharper questions and accepts evidence faster. Ask what proportion of their assessments are defence SMEs.

Availability. The licensed pool is booked out. Ask for a concrete start date, not a position in a queue. A cheaper CB with a long lead time can cost you more than a dearer one who can start now, because the real cost of waiting is the purchase order your prime is holding back.

How the assessment actually runs. Ask whether evidence moves through a structured workspace or an email chain, how clarifications are raised, and how many rounds of review are included. Assessment style drives most of the difference in how long certification takes.

Recertification. DCC is not a one-off. Ask what the next cycle costs and whether your evidence base carries forward or gets rebuilt from scratch.

How many quotes should you get?

Two or three. One quote gives you no basis for comparison, and past three the gathering effort outweighs the information gained.

Make sure every quote states the same five things, so you are comparing like with like: the DCC level being assessed, fixed price or day rate, what is included (clarification rounds, re-review of corrected evidence), start date and time to a certification decision, and recertification cost. A quote that is silent on any of these is not the cheapest quote. It is the least finished one.

How Snubnose finds the right assessor for you

Suppliers certifying through Snubnose do not need to arrive with a Certification Body. When you reach assessment stage, Snubnose matches you with a CB from the Snubnose Assessor Alliance, drawn from a preferred-CB list and matched on level coverage, sector experience, geographic reach and current availability. Where more than one CB fits, Snubnose gathers quotes so you can compare and choose.

Two design choices matter here. First, no referral fees change hands in either direction, in line with the impartiality requirements of ISO/IEC 17021-1, so matches are made on fit rather than commercial arrangement. Second, the commercial relationship is yours: the CB quotes you directly, you choose, and Snubnose is not party to the engagement.

Because Alliance CBs run their assessments inside the Snubnose workspace, your evidence arrives mapped to DefStan 05-138 controls and pre-validated before the assessor opens it, which is a large part of why DCC Level 0 through Snubnose completes in five to ten working days rather than months.