Company sizeLarge Enterprises
For a large organisation, DISP touches many teams at once. We align the implementation with your size, maturity and experience in Defence, and bridge the competing objectives of your cross-functional teams.
Domain focus/ from this brief
Scan
DISP's cyber, personnel and physical requirements affect internal teams differently, with competing objectives.
Certification costs tend to rise with size and complexity, such as operating nationally across multiple sites.
Your IT may already work to ISO 27001, the Essential Eight or NIST, and DISP needs to build on it.
Ongoing obligations can draw heavily on senior executives without support.
Because DISP spans cyber, personnel and physical security, it affects your IT, HR, facilities and leadership teams differently. We bridge the gaps between their objectives and concerns, so every team is supported as the company works through the process.
Certification of IT or physical security is among the largest costs at higher levels, and it tends to rise with company size and complexity. [Draft] Scoping which sites and systems need to handle classified material is one of the most important early decisions.
Defence accepts a number of recognised cyber standards, including ISO 27001/27002, the Essential Eight and NIST. [Draft] Large organisations often have much of this in place, so the gap analysis focuses on what DISP adds.
We scope the program across your sites and teams, write documentation that fits your existing governance, and provide maintenance support that complements your internal team.
Understand the membership levels to work out the level your organisation needs.
Entry Level
EL
Clears to
OFFICIAL: Sensitive
Entry Level brings your organisation to modern information security standards. Approval clears you for information up to and including OFFICIAL: Sensitive. We deliver it as a fixed-price, all-inclusive package.
Level 1
L1
Clears to
PROTECTED
Level 1 expands the Entry Level scope to meet Defence's additional requirements, and clears your organisation for information up to and including PROTECTED. It also lets you sponsor personnel security clearances up to Baseline.
Level 2
L2
Clears to
SECRET
Level 2 lets your company store and handle SECRET information and take part in classified procurement. Defence sets high standards across all four domains, including third-party certification of your physical and IT systems and a mandatory site inspection.
Level 3
L3
Clears to
TOP SECRET
Level 3 grants access to TOP SECRET information and projects of the highest sensitivity. Defence sets its highest standards across all four domains. Implementation and maintenance are challenging and costly, but the commercial upside is typically significant.
Every engagement starts with a complete audit of your existing processes across the four DISP domains: governance, personnel, physical and cyber security.
We write the policies, processes and plans your organisation needs to meet Defence’s requirements for identifying, assessing and managing security risk.
DISP membership comes with ongoing obligations. Our maintenance support complements your internal team and reduces the load on senior executives.
DISP obliges members to keep their Chief Security Officer and Security Officer trained. We train both roles and support them as obligations come up.
Yes. The level is set for each of the four domains, so you can select the level each one needs. Many of the consultants we work with hold a higher level for governance and personnel, which allows self-sponsorship of security clearances, and Entry Level for cyber and physical security. This keeps costs down, but it does not suit every business. We confirm the right mix in the initial consult.
Not necessarily. Defence accepts a number of internationally recognised standards for Level 2. ISO 27001/27002 is one of the most widely applied, but your managed services provider or internal IT team may already work to the ASD Essential Eight, NIST or another standard.
The standard you choose has significant short- and long-term implications for your application and your organisation, so we advise on it in the initial consult.
Please use a business email address. We reply within [Awaiting response time].
We will confirm whether DISP suits your business and which level you need, with no obligation.