RoleDirectors & CEOs
DISP has outgrown its origins as a Defence-only framework. It is fast becoming the standard for information security across government and the broader supply chain, and a fair test of a modern, resilient Australian company.
Domain focus/ from this brief
Scan
Defence requires a senior executive, typically a director or board member, as Chief Security Officer.
Implementing DISP internally takes senior time and wages that are hard to justify.
Higher levels carry significant cost, so the commercial case must be evaluated first.
Lodging before requirements are in place can cost time and contracts, and lead to rejection.
DISP is a fast-growing compliance framework. Government and Primes increasingly mandate it in tenders, and it is spreading across government and the broader supply chain as the benchmark for information security.
Defence requires every member to designate a Chief Security Officer (CSO). The CSO must be a senior executive, typically with a board position or directorship. The CSO is directly responsible for the company's ongoing DISP compliance with Defence, and must build and promote a culture of information security.
We advise that your CSO holds at least a Baseline security clearance for business continuity, although this may not be mandatory at your chosen level.
Entry Level is sufficient for most companies in the supply chain. Higher levels open more sensitive work but expand cost and scope significantly. Evaluate the commercial viability, implementation cost and ongoing cost before pursuing the highest levels.
Many executives prefer to outsource DISP to specialists and spend their time on growth in their own areas of expertise. With fixed-price, predictable fees and clearly defined deliverables, we take on the implementation so your leadership team does not have to.
We start with a complimentary consult to confirm DISP suits your business and which level you need, then run the project to a fixed price and a predictable timeline.
Understand the membership levels to work out the level your organisation needs.
Entry Level
EL
Clears to
OFFICIAL: Sensitive
Entry Level brings your organisation to modern information security standards. Approval clears you for information up to and including OFFICIAL: Sensitive. We deliver it as a fixed-price, all-inclusive package.
Level 1
L1
Clears to
PROTECTED
Level 1 expands the Entry Level scope to meet Defence's additional requirements, and clears your organisation for information up to and including PROTECTED. It also lets you sponsor personnel security clearances up to Baseline.
Level 2
L2
Clears to
SECRET
Level 2 lets your company store and handle SECRET information and take part in classified procurement. Defence sets high standards across all four domains, including third-party certification of your physical and IT systems and a mandatory site inspection.
Level 3
L3
Clears to
TOP SECRET
Level 3 grants access to TOP SECRET information and projects of the highest sensitivity. Defence sets its highest standards across all four domains. Implementation and maintenance are challenging and costly, but the commercial upside is typically significant.
Every engagement starts with a complete audit of your existing processes across the four DISP domains: governance, personnel, physical and cyber security.
Incorrect lodgement costs companies time and contracts, and can lead to a rejected application. We prepare and lodge your application and handle Defence’s questions.
DISP obliges members to keep their Chief Security Officer and Security Officer trained. We train both roles and support them as obligations come up.
Every DISP member must designate both roles, and each has prerequisites a staff member must meet before taking it on.
The Chief Security Officer (CSO) must be a senior executive, typically a director, board member, involved shareholder or other high-level executive. The CSO owns the company's DISP compliance and builds its security culture.
The Security Officer (SO) is the hands-on role: advising staff and management on security, annual reporting, annual security awareness training, managing clearances and reporting to Defence. An office manager, operations manager, IT manager or Defence project lead often fills it. The SO reports to the CSO.
In our experience, Entry Level is sufficient for most companies in the supply chain. Level 1 suits companies that want to self-sponsor security clearances, and Levels 2 and 3 suit organisations working on classified projects. We confirm the right level in your initial consult.
Only after careful evaluation. Level 3 suits mature organisations with considerable expertise and history in the Defence sector, working on the most classified technologies, operations and projects. We discourage firms without Defence experience or active Defence contracts from applying.
Weigh the commercial case, implementation cost and ongoing cost first. If your main goal is self-sponsorship up to NV-2, there may be pathways that reduce cost. We can evaluate the options with you.
Please use a business email address. We reply within [Awaiting response time].
We will confirm whether DISP suits your business and which level you need, with no obligation.