L2SECRET
Level 2 DISP: cleared for SECRET
Level 2 shows Defence you have the security measures to safeguard sensitive data and the commitment to uphold high standards. It means a considerable expansion of project scope.
Designation
Clears information up to
SECRET
- Profile
- Store and handle SECRET information and join classified procurement.
- Pricing
- Custom package
What's included
Level 2 lets your company store and handle SECRET information and take part in classified procurement. Defence sets high standards across all four domains, including third-party certification of your physical and IT systems and a mandatory site inspection.
Organisations deeply embedded in the Defence industry, or working on highly classified projects.
L2 inclusions
- Everything in Entry Level and Level 1
- Deliverables adjusted to Level 2 requirements
- Mandatory site inspection
What Defence assesses
To achieve Level 2, your company undergoes a thorough assessment by Defence. It evaluates your policies, procedures and systems against strict security requirements. Your physical and IT systems must be certified by a third party to show they meet the requirements for handling SECRET information.
We prepare you for the assessment by implementing the requirements and creating the governance, systems and processes you need to maintain compliance.
Clearances up to NV-1
With Level 2 membership, your Security Officer can sponsor and manage security clearances up to and including Negative Vetting 1 (NV-1). The Security Officer must hold at least Negative Vetting 2 (NV-2).
A security awareness training program
Level 2 members must run a Security Awareness Training Program (SATP) so employees understand their roles and responsibilities. It covers:
- Handling classified information correctly
- Recognising potential threats
- Reporting suspicious activity
- Following protocol for accessing secure areas and equipment
Choosing your cyber pathway
Defence accepts a number of recognised standards for Level 2 cyber, including ISO 27001/27002, the ASD Essential Eight and NIST. It also requires accreditation of your IT network. An IRAP assessment is often costly. A standalone device, or use of the DPN, DSN or DREAMS, is more affordable but not practical for every company.
These choices are often difficult or costly to reverse, so we work through them with you early.
Support after approval
We give clients a learning management system to help with their ongoing SATP obligations, and we offer ongoing DISP maintenance support for the SO and CSO that complements internal teams and reduces the load on senior executives.
Compare with other levels
- Included
- Partly
- Not included
Questions
Do we need ISO 27001 for Level 2 cyber requirements?
Not necessarily. Defence accepts a number of internationally recognised standards for Level 2. ISO 27001/27002 is one of the most widely applied, but your managed services provider or internal IT team may already work to the ASD Essential Eight, NIST or another standard.
The standard you choose has significant short- and long-term implications for your application and your organisation, so we advise on it in the initial consult.
Is Defence accreditation of our IT network mandatory?
For Level 2 cyber, Defence requires accreditation of your IT network. Pathways such as an IRAP assessment are often costly, though your workflows and commercial opportunities may justify them. A standalone device, or use of the Defence Protected Network (DPN), Defence Secret Network (DSN) or DREAMS, is more affordable but not practical for every company.
These decisions have a significant business impact and are often difficult or costly to reverse, so choose the pathway with advice from someone who knows DISP well.
Which levels let us sponsor our own security clearances?
Entry Level does not allow self-sponsorship. Level 1 lets you manage personnel clearances in-house and sponsor up to Baseline. Level 2 lets your Security Officer sponsor and manage clearances up to Negative Vetting 1 (NV-1). Many firms seek Level 3 for self-sponsorship up to Negative Vetting 2 (NV-2).
Your CSO and SO need clearances of their own to sponsor others. At Level 2, for example, the SO must hold at least NV-2.
Start your DISP journey
Please use a business email address. We reply within [Awaiting response time].
Book a complimentary initial consult
We will confirm whether DISP suits your business and which level you need, with no obligation.