Scoping a Defence Cyber Certification is probably the thing we get the most questions about - and it's one of the areas where judgement matters the most.
Under-scope, and you've certified a shell that doesn't protect what the MOD actually cares about. The DCC Applicant Guide is unforgiving here: if the Assessor decides your scope or its documentation is inadequate, the entire assessment fails. Not one control. All of it.
Over-scope, and you drag systems, people and sites into an assessment they have no business being in. Every extra system is more evidence to collect, more controls to meet and more things to keep compliant every year.
For most UK SMEs, scope is a reasonably simple question. For a UK subsidiary of an international group, it's the hardest question in the whole process. And the latest Applicant Guide, v2.2, has just changed the answer.
The good news
Tucked into the guidance for control 1400, Supply chain, is a new paragraph that wasn't in v2.1. It deals with a UK Applicant whose parent organisation provides it with services: IT, identity, email, security operations, whatever the group runs centrally.
Those services can now be assessed as if they came from an external supplier. That means the parent organisation itself can sit outside your DCC scope. The UK entity is certified. The group is not dragged in behind it.
For international businesses with a UK office, that's a big deal. Until now, the honest answer to "do we need to put the whole group through DCC?" was "it depends, and nobody's quite sure". Plenty of US and European primes and technology firms looked at that and concluded the UK market wasn't worth the hassle.
The guide now gives a clear, documented route. The UK entity can be certified on its own merits, without asking a head office in Virginia or Munich to submit itself to a UK assessment it doesn't understand and didn't budget for.
The catch
There's no free lunch, and the same paragraph says so. A smaller scope puts more weight on your supplier checks, because you're more reliant on services you don't run.
Two lines further on, the guide closes the obvious loophole. Where a control is met by a third-party service, it must still be evidenced. And due diligence applies to all externally provided services, whether they come from your parent or a genuinely external provider. Being part of the family earns no discount.
Aviation solved this problem decades ago. An airline can contract its maintenance out to a specialist organisation, but it never contracts out responsibility for the airworthiness of its aircraft. It has to know what work was done, by whom, to what standard, and be able to prove it. The aircraft is still the airline's problem.
DCC now works the same way. Your parent can run your IT. You still own the evidence.
The guide lists the kinds of assurance it expects, proportionate to the risk:
- Legal or contractual assurance
- Service Level Agreements
- Supplier certifications, such as Cyber Essentials or other suitable schemes
- Conformance with the NCSC Software Security Code of Practice
- Independent testing, such as penetration tests or audits
That list reads easily. Now try getting it from a head office that has never written an SLA for its own subsidiary, and thinks of the UK as a sales office with a coffee machine.
A worked example
Take a fairly typical client profile. A US technology company holds ISO 27001 and CMMC Level 2. It has opened a UK subsidiary to win MOD work. The UK team's laptops, identity, email and security tooling are all provided and managed by the US IT team. The UK has no IT staff of its own.
Under v2.2, the UK entity can certify with the US parent treated as a supplier. That's fine, as long as the UK can show two things: visibility and control.
Visibility: can the UK see that its controls work?
The parent's certificates are a good start, but they're not the answer on their own. Check what they actually cover.
- ISO 27001. Read the certificate scope and the Statement of Applicability. Does the scope include the IT services delivered to the UK, or just the US product line? A certificate covering a different part of the business is assurance about someone else.
- CMMC Level 2. It's assessed against NIST SP 800-171, which shares a lot of DNA with DefStan 05-138, so it's strong evidence. But CMMC scope is often a dedicated enclave built to protect US controlled information. If the UK team works in the corporate tenant rather than the enclave, the certificate doesn't describe their environment.
Beyond certificates, the UK needs to be able to evidence the DCC controls the parent delivers on its behalf: MFA and conditional access settings, patching reports, endpoint encryption status, log retention, and alerts from the monitoring service. That might mean read-only access to the relevant consoles, or a regular evidence pack from the US team. Either works. What doesn't work is "head office handles that".
Control: can the UK make anything happen?
Visibility without control is just watching. The UK entity needs some real ability to act, which in practice means:
- An intra-group service agreement that sets out the services, security requirements, SLAs and incident notification, and treats the UK like a customer.
- A way to raise risks and require remediation, so a failed control in the UK assessment can actually be fixed by the people who run the system.
- Agreement on UK requirements where they differ, such as MOD data handling, Cyber Essentials Plus and DCC's own control expectations, rather than assuming US group policy covers it.
One practical trap: your Cyber Essentials scope has to align with your DCC scope. If the UK users sit in the parent's global Microsoft 365 tenant, the tenant configuration that CE examines is owned in the US. Work that out with your Certification Body early, not the week before assessment.
With visibility and control in place, this structure is entirely workable. Without them, you're asking an Assessor to take a US head office's word for it, and the guide has just told them not to.
The grey area
Visibility and control answer the question of whether the UK can evidence its IT. They don't answer a harder one: what is the MOD actually buying, and where is it made?
DCC isn't only about protecting MOD information. DefStan 05-138 Issue 4 broadened the focus to the resilience of the functions a supplier delivers. That's where the parent-as-supplier model starts to creak.
Ask two questions:
- How much of the product is produced in the UK? If the UK writes code, integrates hardware or configures the product for a UK customer, the UK holds real capability. If the product is built, compiled and shipped entirely from the US, the UK entity is closer to a distributor.
- How independently resilient is the UK? If the parent's service went down tomorrow, through an outage, a ransomware incident or a corporate decision, could the UK keep delivering to its MOD customer? For how long?
Those answers matter, because a small UK scope with a large dependency on the parent can produce a DCC certificate that describes the UK entity accurately but says very little about the thing the MOD depends on. That's the gap an Assessor will probe.
My verdict
Here's where I draw the line.
If the UK entity exists to sell the product into the UK market, perhaps with some engineering to tailor it for UK customers, then limiting scope to the UK entity is reasonable. The product is delivered, the customer runs it, and the parent's role is to support the UK team's corporate IT. Treat that IT as a supplier service, evidence it properly, and you're on solid ground.
If the product has an element of managed service, such as software hosted in the US, or a product that calls home to the parent for licensing, updates, telemetry or ongoing operation, then that service is business critical. The MOD isn't just buying a product; it's relying on infrastructure the parent operates. That has to be properly assured.
Two refinements, because the line isn't quite that clean.
First, "in scope" doesn't have to mean the whole parent. The guide still lets you treat a hosted platform as a supplier service. But the assurance then has to reach the same depth DCC would expect if you ran it yourself, and it has to be evidenced. In practice, it's often simpler and more defensible to bring the specific platform and the team that runs it into scope, rather than the entire US group.
Second, a sales-only UK office isn't automatically low risk. If MOD information sits in the parent's email, file storage or CRM, the parent's IT is protecting MOD data whatever the UK's business model. The supplier checks still need teeth.
So the real test isn't "is it a managed service?" It's this: does the parent operate anything the MOD relies on, or hold anything the MOD cares about? If yes, that part needs to be either in scope or assured to the same standard. If no, scope to the UK and evidence the services you consume.
Before you scope
If you're a UK subsidiary of an international group, do this before you commit to a scope:
- Map every service the parent provides, and what each one touches: identity, email, endpoints, monitoring, hosting, the product itself.
- Read the parent's certificates properly. Check what their scope actually covers, not just that they exist.
- Put an intra-group service agreement in place, with security requirements, SLAs and incident notification.
- Agree how the UK gets its evidence, whether through console access or regular evidence packs.
- Test your resilience. Walk through what happens to your MOD delivery if the parent's services disappear for a week.
- Talk to your Certification Body early, especially about how your Cyber Essentials scope lines up with a shared tenant.
And read the DCC Scoping Guide. The Applicant Guide is clear that scope is your responsibility, and "the US told us it was fine" won't hold up.
Get it right, and v2.2 makes DCC genuinely achievable for international businesses without dragging the whole group through a UK assessment. Get it wrong, and you'll find out at the worst possible moment.
We work with a number of international defence businesses on exactly this question. If you'd like a second opinion on your scope before you commit to it, our free Readiness Assessment will show you where you stand, with no cost and no hard sell. Get in touch at defence@nova-blue.com, or try the instant CSMv4 readiness check at https://defence.nova-blue.com/assess.