DISP, answered

The Defence Industry Security Program supports Australian businesses to understand and meet their security obligations when working on Defence tenders, contracts and projects. It is a tiered membership program covering governance, personnel, physical and cyber security.

[Draft] Your business must be incorporated in Australia, hold an ABN, have someone able to obtain a Defence security clearance, and be financially viable. We confirm your eligibility in the first consult.

DISP assesses your business across four domains, sometimes called pillars or categories:

• Governance: the policies, procedures, plans and documents that govern the other three domains.
• Personnel security: managing security clearances, training, and staff and contractor access to classified information and assets.
• Physical security: access controls and zoning that keep classified material in your offices, warehouses or factories away from people who should not reach it.
• Cyber security: the security and resilience of your networks and devices, aligned to frameworks such as the Essential Eight or ISO 27001.

DISP becomes mandatory when you take on Defence contracts or projects that involve handling, accessing or creating classified information. Government and Prime contractors are also increasingly asking for DISP membership in their tenders, so many businesses join before a specific contract requires it.

Every DISP member must designate both roles, and each has prerequisites a staff member must meet before taking it on.

The Chief Security Officer (CSO) must be a senior executive, typically a director, board member, involved shareholder or other high-level executive. The CSO owns the company's DISP compliance and builds its security culture.

The Security Officer (SO) is the hands-on role: advising staff and management on security, annual reporting, annual security awareness training, managing clearances and reporting to Defence. An office manager, operations manager, IT manager or Defence project lead often fills it. The SO reports to the CSO.

Yes. Beyond eligibility for Defence work, compliance improves your internal security protocols and awareness and reduces your exposure to information theft and cyber threats. That stronger security posture can appeal to clients in other sectors too.

In our experience, Entry Level is sufficient for most companies in the supply chain. Level 1 suits companies that want to self-sponsor security clearances, and Levels 2 and 3 suit organisations working on classified projects. We confirm the right level in your initial consult.

Yes. The level is set for each of the four domains, so you can select the level each one needs. Many of the consultants we work with hold a higher level for governance and personnel, which allows self-sponsorship of security clearances, and Entry Level for cyber and physical security. This keeps costs down, but it does not suit every business. We confirm the right mix in the initial consult.

Entry Level does not allow self-sponsorship. Level 1 lets you manage personnel clearances in-house and sponsor up to Baseline. Level 2 lets your Security Officer sponsor and manage clearances up to Negative Vetting 1 (NV-1). Many firms seek Level 3 for self-sponsorship up to Negative Vetting 2 (NV-2).

Your CSO and SO need clearances of their own to sponsor others. At Level 2, for example, the SO must hold at least NV-2.

Not necessarily. Defence accepts a number of internationally recognised standards for Level 2. ISO 27001/27002 is one of the most widely applied, but your managed services provider or internal IT team may already work to the ASD Essential Eight, NIST or another standard.

The standard you choose has significant short- and long-term implications for your application and your organisation, so we advise on it in the initial consult.

For Level 2 cyber, Defence requires accreditation of your IT network. Pathways such as an IRAP assessment are often costly, though your workflows and commercial opportunities may justify them. A standalone device, or use of the Defence Protected Network (DPN), Defence Secret Network (DSN) or DREAMS, is more affordable but not practical for every company.

These decisions have a significant business impact and are often difficult or costly to reverse, so choose the pathway with advice from someone who knows DISP well.

Only after careful evaluation. Level 3 suits mature organisations with considerable expertise and history in the Defence sector, working on the most classified technologies, operations and projects. We discourage firms without Defence experience or active Defence contracts from applying.

Weigh the commercial case, implementation cost and ongoing cost first. If your main goal is self-sponsorship up to NV-2, there may be pathways that reduce cost. We can evaluate the options with you.

[Awaiting typical timeframes per level from the business.] Every project has a predictable timeline agreed up front, with weekly or fortnightly progress meetings.

Entry Level is a fixed-price, all-inclusive package. Higher levels are priced after the initial consult. [Awaiting whether prices or ranges should be published.]

All DISP consultancy pricing is specific to your company, because organisational risk factors vary significantly. For Entry Level we have standardised base costs in line with Defence's suggested estimate. For higher levels, we price the work after the initial consult, once we have developed your risk profile.

Your implementation costs depend on how compliant you already are. You may already meet most requirements, or need significant work in some domains but not all four. The gap analysis shows where you stand, and at that point your costs become clear.

It varies significantly with your current security posture and the work needed to close the gap. Costs can include IT upgrades (licensing, servers, migrations and implementation), physical security upgrades (locks, safes, access controls, audit and certification), employee training and regular compliance audits.

Certification of IT or physical security is among the largest costs, and it tends to rise with company size and complexity, for example operating across multiple sites rather than one.

[Awaiting confirmation of whether an indicative Level 3 cost can be published.]

Yes. Defence allows companies to apply without external advice. Many organisations choose not to, because lodging before requirements are properly in place can cost time and contracts and can lead to a rejected application.

We work with clients Australia-wide, across all major metropolitan cities and major regional centres. For Entry Level a site visit is typically not required. Level 1 may require site visits for the physical security domain, and Level 2 includes a mandatory site inspection.

Defence does not require you to use a consultant, but many companies do, to streamline the application and reduce risk. A specialist brings:

• Savings on DISP implementation, particularly IT
• Compliant DISP documentation
• CSO and SO training
• Help preparing and lodging the application

Lodging a DISP application is free, but consultancy can save executive time, reduce risk and prevent lengthy recommendations from Defence.

Membership comes with ongoing obligations. Entry Level engagements include three months of support after approval, and we develop an annual maintenance program for you. Your Security Officer then handles annual reporting and annual security awareness training for all staff. Our compliance maintenance support can complement your internal team and reduce the load on senior executives.

Yes. Under DISP's governance requirements, companies must keep their Chief Security Officer and Security Officer trained. We train both roles on your documentation before you apply, and we offer ongoing training and compliance support after approval.

Yes. Members must report any suspected or actual security breach to Defence immediately. We help you build the processes and governance procedures that make that reporting compliant.