DISP Membership: What Defence Suppliers Should Know

The Defence Industry Security Program (DISP) is how Defence checks that the businesses in its supply chain can protect its information, people and assets. For a small or mid-sized business chasing Defence work, it can look like a wall of acronyms. Underneath, it is a security management system with four parts, and businesses that already run ISO 27001 are a long way down the track.

Short answer

DISP is Defence’s security accreditation for industry, set out in Principle 16 of the Defence Security Principles Framework. Membership is mandatory for classified work, weapons and explosive ordnance, base security services and contracts that require it, and voluntary otherwise. There are four levels, from Entry to Level 3, assessed across governance, personnel, physical and cyber security. The cyber baseline is the Essential Eight at Maturity Level 2. There is no membership fee, and ISO 27001 helps but is not an equivalent.

Why this is coming up now

A few of our ISO 27001 clients are now looking at DISP because they want to bid for Defence work, or because a prime contractor has started asking. That is the common path: the ISO 27001 system is in place, then Defence opportunities raise the question of what else is required. The answer is usually less than people fear on governance and more than they expect on the Essential Eight.

Who needs DISP membership

Under Defence’s eligibility rules, membership is mandatory for businesses that:

• need access to classified information or assets at PROTECTED or above
• supply, maintain, store or transport weapons or explosive ordnance
• provide security services for Defence bases or facilities
• are Australian Community Members under the Australia and United States Defence Trade Cooperation Treaty, or
• are required to hold it under a Defence contract.

Contract managers should state in tender and contract documents whether DISP is required and at what level. Outside those cases, membership is voluntary, and a business can apply without a contract. Membership does not guarantee work, but it does show a business is ready for it. DISP members are also expected to assess the security of their own suppliers and flow down security terms, which is why primes often raise it with their subcontractors.

The four membership levels

Levels are set separately for each of the four domains, so a business might hold Entry Level for cyber and Level 1 for personnel. Governance has to match the highest level held in any other domain, and anything above Entry Level needs a business case.

The four domains

Governance

A Chief Security Officer (a director or senior executive who is an Australian citizen and can hold at least a Baseline clearance) and a Security Officer, who can be the same person. Both complete DISP Security Officer training. Behind them sit security policies, a risk-based approach, registers and an insider threat programme proportionate to the size of the business.

Personnel security

Pre-employment screening to AS 4811-2022, annual security awareness training for staff engaged on Defence work, and, from Level 1, sponsoring security clearances through AGSVA.

Physical security

Documented physical security for each facility at Entry Level, and accredited facilities for PROTECTED and above. Security-rated equipment on its own is not enough at those levels.

Cyber security

All eight Essential Eight strategies at Maturity Level 2 across the corporate ICT used to correspond with Defence. This replaced the older “Top 4” baseline, and Defence has confirmed that Top 4 assessments have concluded. Members also use a central DISP email address on an Australian-hosted email service. Higher levels add formal ICT assessment and authorisation.

Where ISO 27001 fits

Defence is clear that ISO/IEC 27001 can support DISP cyber evidence but is not equivalent to it. Each Essential Eight strategy still has to be demonstrated in the cyber security questionnaire. That is the gap I see most often in ISO 27001 businesses: a well-run management system, but application control, macro settings or patching timeframes that fall short of Maturity Level 2.

Where ISO 27001 does carry real weight is everything around the controls. A working ISMS already has a risk register, an information security policy, supplier assessments, incident management, internal audit and management review. Those map closely to DISP governance and to the ongoing obligations below. Our comparison of Essential Eight vs ISO 27001 shows where the two overlap, and the Essential Eight explainer covers what Maturity Level 2 means in practice.

ASD has also announced ASD Essentials as the successor to the Essential Eight. At the time of writing, DISP still requires Essential Eight Maturity Level 2, and Defence has not announced a change.

How to apply

1. Confirm the level. Check the tender or contract, and talk to the prime if it is a subcontract.
2. Appoint the security officers. The Chief Security Officer also sets up the business’s digital identity and Relationship Authorisation Manager access for the portal.
3. Close the cyber gaps. Run an honest Essential Eight assessment against Maturity Level 2 before applying, not after.
4. Prepare the policies and registers. Security policy, risk assessment, personnel screening records and facility arrangements.
5. Apply through the DISP Member Portal. The application covers governance, foreign ownership and influence, the four domains and the cyber security questionnaire.

Defence indicates around two to three months for Entry Level and four to six months for Levels 1 to 3 when clearances and accreditations are already in place. The DISP pages on the Defence website set out the current process.

Keeping membership

• An Annual Security Report each year, drafted by the Security Officer and declared by the Chief Security Officer.
• Annual security awareness training for relevant staff.
• Changes to the Chief Security Officer or Security Officer reported within 14 days.
• Security incidents reported within 24 hours.
• Changes in foreign ownership, control or influence reported.
• Defence suitability assessments and deeper audits, selected on risk.

For an ISO 27001 business, most of this slots into processes that already exist: the annual report draws on internal audit and management review, and incident reporting sits inside the incident procedure.

What it costs

There is no DISP membership fee. The costs are the security clearances the business sponsors (fees are set by AGSVA), the cyber work to reach Maturity Level 2, any physical security or ICT accreditation for higher levels, and the time of the people running it. Defence Industry Development Grants can help eligible small businesses with some of these costs.

How Streamline helps

As a veteran-owned business, we understand how Defence thinks about security. We help businesses build the ISO 27001 management system that DISP governance sits on, run a gap analysis against the four DISP domains, and keep the ongoing obligations working inside one system rather than a separate set of documents. Read about our ISO 27001 consulting and Essential Eight services, or talk to us about getting ready for DISP.

Frequently asked questions

Is DISP membership mandatory?

It is mandatory where a business needs access to classified information or assets at PROTECTED or above, supplies or handles weapons or explosive ordnance, provides security services for Defence bases, or where a Defence contract requires it. Otherwise it is voluntary, and a business can apply without holding a contract.

Does ISO 27001 certification meet the DISP cyber requirement?

Not on its own. Defence treats ISO/IEC 27001 as supporting evidence only, not as an equivalent. Every Essential Eight strategy still has to be shown at Maturity Level 2 through the DISP cyber security questionnaire. What ISO 27001 does provide is the governance, risk, supplier and incident discipline that DISP expects members to keep up.

How long does DISP membership take?

Defence indicates around two to three months for Entry Level and four to six months for Levels 1 to 3, assuming clearances and accreditations are already in place. Missing documents, clearance processing and facility or ICT accreditation are the usual causes of delay.

Is there a fee to join DISP?

There is no membership fee. The costs sit in security clearances, which the sponsoring business pays to AGSVA, plus any cyber uplift, physical security and ICT accreditation work needed to meet the level applied for.

What are the DISP membership levels?

Entry Level, Level 1, Level 2 and Level 3, broadly aligned to OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET. Levels are set separately for governance, personnel, physical and cyber security, and Levels 1 to 3 need a justification.