DCMS stands for the Department for Digital, Culture, Media and Sport, the UK government department currently responsible for shaping how businesses in this country handle cyber security. If you’ve ever wondered where schemes like Cyber Essentials actually come from, or who decides what “good enough” security looks like for small businesses, the answer traces back to DCMS today, though it’s worth knowing that responsibility has moved between departments more than once in recent years. It’s not a technical body in the way the National Cyber Security Centre is, but it sets policy, commissions research, and often decides what gets funded or mandated next.
What DCMS Actually Does
DCMS is a government department, not a regulator with enforcement powers in the way the Information Commissioner’s Office is. Its job is broader than cyber security alone, covering everything from broadcasting to tourism. Cyber and digital policy sat with DCMS until 2023, moved to a newly created department for a few years, and returned to an expanded DCMS following a recent machinery-of-government change. The department names shift more often than most business owners realise, which is worth knowing if you’re trying to trace a requirement back to its current source rather than an outdated one.
In practice, DCMS commissions the annual Cyber Security Breaches Survey, works with the NCSC on national strategy, and shapes the direction of schemes that smaller businesses interact with directly. It doesn’t run Cyber Essentials day to day, that’s handled by the IASME Consortium, but the policy foundations that led to the scheme existing in the first place trace back through DCMS and its various successor arrangements.
Why the DCME Confusion Comes Up So Often
People searching for DCME are almost always looking for DCMS. The mix-up is common enough that it’s worth addressing directly rather than assuming everyone already knows the correct term. There’s no separate body called DCME operating in UK cyber policy, so if you’ve come across the term somewhere, it’s very likely a typo or a mishearing of DCMS.
This matters because getting the name wrong, or relying on an outdated department name, can send you down the wrong research path entirely, especially when you’re trying to work out which UK body is currently responsible for a particular scheme, requirement, or piece of guidance.
How DCMS Policy Feeds Into Cyber Essentials
Cyber Essentials exists because government policy, developed with the NCSC, wanted a simple, affordable way for smaller organisations to demonstrate basic cyber hygiene, particularly when bidding for government contracts. The scheme has grown well beyond that original purpose, but the policy thinking behind it still sits with DCMS in its current form.
If your business is trying to understand what the certification actually involves, it helps to start with a plain-English breakdown of the scheme itself. Our guide on what Cyber Essentials actually covers walks through the five technical controls without the jargon, which is a good starting point before you get into the policy background.
Why This Matters for Business Owners, Not Just Policy Wonks
You don’t need to follow Westminster policy debates to run a secure business, but understanding where the rules come from does help you anticipate change. When DCMS publishes new guidance or funds a new initiative, it often signals what’s coming next in terms of compliance expectations, especially for businesses that work with government or in regulated sectors.
For example, changes to Cyber Essentials requirements over the years, including updates to what counts as an acceptable device configuration or how cloud services are assessed, generally start life as a policy decision at whichever department currently holds the digital brief, before becoming a scheme rule. Businesses that keep half an eye on this pipeline tend to be less caught out when requirements shift, or when responsibility moves departments again.
Getting Certified Without Getting Lost in Department Names
None of this needs to become a distraction from the practical task at hand, which is usually working out whether your business needs certification and what it will take to get there. The department names and policy structures matter for context, but the actual work is about closing gaps in your security setup.
If you’re at the stage of deciding whether Cyber Essentials is the right fit for your organisation, it’s worth reading through the certification requirements directly rather than trying to piece together the policy history first. It also helps to get the terminology straight first, since cyber security and cybersecurity get used interchangeably in official guidance, and a good cyber security course can help make sense of it all if you’re starting from scratch.
If you’re ready to see what certification actually involves for your business, take a look at our Cyber Essentials consultancy services to find out where to start.
