EL
Entry Level
The baseline tier, and the right fit for most of the supply chain.
Clears to
OFFICIAL: Sensitive
What DISP is, and what it asks of your business
DISP supports Australian businesses to understand and meet their security obligations on Defence tenders, contracts and projects. It is a tiered membership program across four domains: governance, personnel, physical and cyber security.
Threat surface
Matrix
- GOVGovernance
- PERPersonnel
- PHYPhysical
- CYBCyber
Clearance scale
- OFFICIAL: Sensitive
- PROTECTED
- SECRET
- TOP SECRET
A tiered membership program
The Defence Industry Security Program sets the security standards Defence expects of the businesses it works with. Members choose a level, from Entry Level to Level 3, and each level clears the business for a higher classification of information: OFFICIAL: Sensitive, PROTECTED, SECRET or TOP SECRET.
The level is set for each of the four domains, so a business can hold the level each domain needs.
Why it matters
DISP began as a Defence-only framework. It is quickly becoming a standard compliance framework across government and the broader supply chain, and a fair test of a modern, resilient Australian company.
- Tender for Defence contracts: be Defence-ready when bidding for and delivering contracts and projects
- Access new markets: domestic and export Defence markets are growing
- Improve internal security: prepare for modern risks and meet current standards
- Reduce risk: stronger governance, personnel, physical and cyber security, with a plan to maintain it
Who it is for
Government and Prime contractors increasingly require DISP membership in tenders, including from subcontractors deep in the supply chain. Sectors that may benefit include engineering and design, manufacturing, construction, logistics, aerospace, IT services and consulting, at every size of business. Membership becomes mandatory when your work involves handling, accessing or creating classified information.
Two roles every member needs
Every member designates a Chief Security Officer (CSO) and at least one Security Officer (SO).
The CSO is a senior executive, typically a director or board member, who owns the company's DISP compliance and builds its security culture. The SO takes ownership of day-to-day compliance: reporting, managing security clearances and liaising with Defence. The SO reports to the CSO.
Eligibility
Tick each criterion that applies. Nothing is stored or sent.
Governance, personnel, physical and cyber
Defence assesses every member across the same four domains. The depth of each grows with the level you need.
Governance
GOV
Governance
The policies, processes and plans that govern the other three domains. Together they let your business identify, assess and mitigate security risk, build risk profiles, review them regularly and safeguard assets and information from internal and external parties.
- Policies
- Processes
- Plans
- Risk identification, assessment and mitigation
Personnel
PER
Personnel
How you manage security clearances, training, and staff and contractor access to the classified information and assets your company holds. From Level 1, members can self-sponsor employees and contractors to a lower clearance level than their officers hold.
- Security clearances
- Security awareness training
- Insider threat awareness
- Access to classified information
Physical
PHY
Physical
Depending on your level, classified material and assets may be held on your premises. Physical security keeps unauthorised people away from them, through access controls and zoning across offices, warehouses and factories. At lower levels many companies find they are close to compliant, as alarms, CCTV and access passes are now common.
- Site surveillance
- Safeguarding
- Zoning of office spaces
- Alarms
Cyber
CYB
Cyber
The security and resilience of your networks and devices, from servers and laptops to phones and cloud environments. DISP members must implement a minimum standard of cyber security, aligned to frameworks such as the ASD Essential Eight or ISO 27001.
- Essential Eight alignment
- Cyber security policies
- Network and device controls
- Accreditation at Level 2 and above
Four levels, one for each classification
Understand the membership levels to work out the level your organisation needs.
What each level includes
Each level builds on the one before it. Higher levels adjust every deliverable to stricter requirements and add their own.
- Included
- Partly
- Not included
Guides
Cost of DISP membership
Implementation costs vary greatly with the level you need and how compliant you already are. Lodging an application is free. The gap analysis shows exactly where your costs will fall.
DISP application process
Our process for implementing DISP's requirements is thorough and systematic, with clear objectives, fixed pricing and predictable timelines at every step.
Questions
What is DISP?
The Defence Industry Security Program supports Australian businesses to understand and meet their security obligations when working on Defence tenders, contracts and projects. It is a tiered membership program covering governance, personnel, physical and cyber security.
Who is eligible for DISP membership?
[Draft] Your business must be incorporated in Australia, hold an ABN, have someone able to obtain a Defence security clearance, and be financially viable. We confirm your eligibility in the first consult.
What are the four DISP domains?
DISP assesses your business across four domains, sometimes called pillars or categories:
- Governance: the policies, procedures, plans and documents that govern the other three domains.
- Personnel security: managing security clearances, training, and staff and contractor access to classified information and assets.
- Physical security: access controls and zoning that keep classified material in your offices, warehouses or factories away from people who should not reach it.
- Cyber security: the security and resilience of your networks and devices, aligned to frameworks such as the Essential Eight or ISO 27001.
When does a business need DISP membership?
DISP becomes mandatory when you take on Defence contracts or projects that involve handling, accessing or creating classified information. Government and Prime contractors are also increasingly asking for DISP membership in their tenders, so many businesses join before a specific contract requires it.
Who should be our Chief Security Officer and Security Officer?
Every DISP member must designate both roles, and each has prerequisites a staff member must meet before taking it on.
The Chief Security Officer (CSO) must be a senior executive, typically a director, board member, involved shareholder or other high-level executive. The CSO owns the company's DISP compliance and builds its security culture.
The Security Officer (SO) is the hands-on role: advising staff and management on security, annual reporting, annual security awareness training, managing clearances and reporting to Defence. An office manager, operations manager, IT manager or Defence project lead often fills it. The SO reports to the CSO.
Does DISP membership help beyond Defence contracts?
Yes. Beyond eligibility for Defence work, compliance improves your internal security protocols and awareness and reduces your exposure to information theft and cyber threats. That stronger security posture can appeal to clients in other sectors too.
Book a complimentary initial consult
We will confirm whether DISP suits your business and which level you need, with no obligation.