Elastic achieves Defence Cyber Certification Level 0 in the UK

The DCC scheme was launched in May 2025 by the UK Ministry of Defence and is administered by IASME, the organisation that also administers Cyber Essentials on behalf of the National Cyber Security Centre. It is assessed against Def Stan 05-138 (Issue 4) — the MOD's own defence standard for cyber security in the supply chain.

The scheme is structured as a four-level hierarchy with each level mapped to the degree of cyber risk associated with a supplier's role in the defence supply chain. Cyber Essentials certification is a prerequisite at all levels, providing a consistent baseline across the framework. Elastic already holds Cyber Essentials Plus certification — the higher of the two Cyber Essentials tiers, which requires technical verification rather than self-assessment. 

DCC Level 0 builds directly on that foundation, so this achievement extends an existing, independently verified security baseline rather than starting from scratch.

The MOD Defence Digital blog post marking the scheme's first year sets out the broader strategic context: DCC is part of a sustained effort to raise the cyber resilience floor across the entire UK defence industrial base, extending beyond prime contractors.

The MOD's mandate that all industry partners achieve DCC Level 0 by 31 December 2026 reflects a broader shift in how the UK defence sector manages supply chain risk. Vendors operating in this space without DCC certification will face growing barriers to new and renewal contracts.

For Elastic customers in UK public sector and defence contexts, this certification provides an independently verified signal of security maturity. It confirms that Elastic meets the MOD's independently verified cyber assurance standard for defence supply chain partners, assessed against the MOD's own framework rather than a standard developed by the vendor.

The DCC Level 0 certificate is available for download from assurance.elastic.co. Customers and partners requiring evidence of this certification for procurement, due diligence, or contract purposes can retrieve it directly from that page.