If you want to work with the Department of Defence or win work from a Defence prime, sooner or later someone will ask: “What’s your DISP level?” For a growing number of tenders and subcontracts, the wrong answer ends the conversation.
The Defence Industry Security Program (DISP) is Defence’s security assurance program for Australian businesses. It sets the minimum security standards your people, premises and IT systems must meet before Defence trusts you with its information and assets. At Cyber Forte, we help Australian businesses uplift their Essential Eight maturity and security governance to the standard DISP expects, and we see the same questions from defence suppliers every week.
“DISP membership is free to apply for, but it isn’t free to achieve. The businesses that get through quickly are the ones that do the security groundwork before they open the application, not after Defence sends it back.”
This guide explains what DISP is, who needs it, the membership levels, eligibility requirements, the step-by-step application process, the Essential Eight Maturity Level 2 cyber requirement, and what you must keep doing once you’re in.
Not sure where to start? Talk to our team about a DISP readiness assessment.
What Is DISP and Who Needs It?
DISP is managed by Defence’s Defence Industry Security Branch and is underpinned by the Defence Security Principles Framework (DSPF), Principle 16 and Control 16.1. It exists to make sure industry has the right security in place for Defence tenders and contracts, and to give Defence confidence when buying from suppliers. Defence reports more than 1,400 accredited members, with the program growing quickly on the back of AUKUS.
When DISP membership is mandatory
Under the DSPF, you must hold DISP membership if your business:
- Works on classified information or assets (PROTECTED and above)
- Supplies, maintains, stores or transports weapons or explosive ordnance
- Provides security services for Defence bases or facilities
- Is required to hold DISP membership as a condition of a Defence contract
The same rules apply to subcontractors. If you do classified Defence work through a prime, you need DISP membership at the right level for that contract or project.
When it’s optional, but smart
Outside those triggers, membership isn’t mandatory. In practice, primes increasingly ask for it in supplier questionnaires, and you don’t need a current Defence contract to apply. Holding DISP before a tender lands is a genuine competitive advantage. Keep in mind it doesn’t guarantee you work: normal procurement still applies.
DISP Membership Levels and Security Domains
DISP has four membership levels, each aligned to an Australian Government security classification. You choose a level separately for each of four security domains, so a business can hold different levels in different domains.
| DISP level | Classification you can handle | Typical fit | Clearance sponsorship | Business case needed? |
|---|---|---|---|---|
| Entry Level | OFFICIAL and OFFICIAL: Sensitive | Most SMEs and first-time Defence suppliers | No | No |
| Level 1 | PROTECTED | Suppliers handling PROTECTED information, system integrators | Yes | Yes |
| Level 2 | SECRET | Suppliers on classified programs (NV1 staff) | Yes | Yes |
| Level 3 | TOP SECRET | Highly classified programs (NV2 staff, accredited facilities) | Yes | Yes |
The four security domains
- Security governance: the people, plans and processes that keep your business secure, including your Chief Security Officer (CSO), Security Officer (SO), security policies, training and incident reporting.
- Personnel security: employment screening to the Australian Standard for Workforce Screening AS 4811:2022, plus security clearances where your level requires them.
- Physical security: protecting premises and assets, scaled to the classification of information you store and handle on site.
- Information and cyber security: protecting Defence information on your corporate IT systems, assessed against the ASD Essential Eight.
Your governance level always matches the highest level you apply for in any other domain. Defence’s own guidance is to select Entry Level for physical and cyber unless you have a demonstrated need. Over-nominating costs you twice: once in controls the contract never needed, and again in a longer assessment.
You only ever need one DISP membership, no matter how many Defence contracts you hold.
DISP Eligibility Requirements
Any Australian entity can apply, but Defence assesses both your eligibility and your suitability before granting membership. At a minimum, your business must:
- Be an Australian legal entity with an ABN (overseas entities cannot be DISP members)
- Be financially solvent
- Appoint a Chief Security Officer (CSO): a director or senior executive who is an Australian citizen able to obtain and maintain a security clearance at the level your membership requires (Baseline at minimum)
- Appoint a Security Officer (SO): a staff member who meets the same clearance requirements. The CSO and SO can be the same person in a small business
- Have the required security governance documents in place, including security policies and plans, an annual security awareness training program and an insider threat awareness program
- Meet the security standards for each domain at the level you’re applying for
- Complete a Foreign Ownership, Control and Influence (FOCI) declaration, covering foreign directors, shareholders, revenue, agreements and investments
What Defence also checks
During the suitability assessment, Defence considers any links to listed terrorist organisations, relationships with sanctioned regimes, and any connection to persons or entities on DFAT’s Consolidated List. For foreign-owned businesses and new market entrants, FOCI is often the step that takes longest, so tackle it early.
If your CSO or SO doesn’t hold a clearance yet, you can still apply. Defence sponsors the CSO and SO for a Baseline clearance as part of the application, processed through the Australian Government Security Vetting Agency (AGSVA).
How to Get DISP Membership: Step-by-Step
Defence’s own process has three headline steps: understand the requirements, determine your level, then apply through the DISP Member Portal. In practice, the work splits into seven stages.
-
Understand the framework
Read DSPF Principle 16 and Control 16.1, Defence’s Working Securely with Defence guide and the DISP Membership Requirements Checklist. The checklist is the single most useful document, because it mirrors the questions you’ll answer in the application.
-
Determine your membership level
Choose a level for each domain based on your current or likely Defence work. If a contract specifies a level, use that. For Level 1 and above, you’ll need a business case, usually a Notice of Engagement from your Defence Contract Manager or a letter of endorsement from Defence or the prime you’re subcontracting to.
-
Run a gap assessment
Assess your business against the requirements for your chosen levels across all four domains. Most businesses find their biggest gaps in governance documentation and in Essential Eight cyber controls.
-
Appoint your CSO and SO
Nominate your Chief Security Officer and Security Officer, confirm they’re Australian citizens who can obtain a clearance, and brief them on their responsibilities.
-
Build your governance and close the gaps
Put the required documents in place before you apply: security policies and plans, a security risk assessment, an annual security awareness program, an insider threat awareness program, and registers for incidents, contact reports and overseas travel. Defence publishes templates you can adapt. Uplift your IT controls in parallel.
-
Lodge your application in the DISP Member Portal
Apply online through the DISP Member Portal. You’ll submit your application details, FOCI declaration and the Cyber Security Questionnaire (CSQ) with supporting evidence. Have someone who knows your IT environment complete the CSQ, because incomplete answers are a leading cause of delays.
-
Defence assessment and onboarding
Defence checks completeness, confirms your level, prioritises the application, and runs FOCI, personnel clearance and cyber assessments. If you’re approved, you’ll receive a member brief, your SO will complete Security Officer training, and your membership certificate date sets the anniversary for your annual reporting.
DISP Cyber Security Requirements: Essential Eight Maturity Level 2
The information and cyber security domain is where most applications stall. Defence requires DISP members to demonstrate they meet or exceed the ASD Essential Eight at Maturity Level 2 (ML2) across the ICT systems they use to correspond with Defence.
From “Top Four” to the full Essential Eight
You’ll still find older material describing the DISP cyber requirement as the Essential Eight “Top Four”, or offering ISO 27001, NIST SP 800-171 or Def Stan 05-138 as alternatives at Entry Level. Defence’s eligibility page still lists those four standards. However, the DISP Essential 8 and Cyber Standards Uplift Program has expanded the cyber standard to the full Essential Eight at ML2, and the Cyber Security Questionnaire is assessed against all eight strategies. Under the November 2023 version of the maturity model, that’s 107 controls at ML2.
The eight strategies you’ll need to evidence
| Strategy | What ML2 looks like in practice |
|---|---|
| Application control | Only approved programs can run on workstations and internet-facing servers |
| Patch applications | Internet-facing apps patched within two weeks, or 48 hours if an exploit exists; unsupported apps removed |
| Microsoft Office macro settings | Macros blocked unless there’s a business need, with macros from the internet blocked |
| User application hardening | Browsers, Office and PDF software hardened against common attack techniques |
| Restrict administrative privileges | Privileged access approved, limited, separated and logged |
| Patch operating systems | OS patches applied on time, or within 48 hours if an exploit exists; unsupported versions replaced |
| Multi-factor authentication | Phishing-resistant MFA for users and privileged accounts accessing systems and data |
| Regular backups | Backups performed, retained, protected from modification and restoration tested |
The Essential Eight doesn’t give partial credit. A control applied to most devices, or enforced for most users, doesn’t count. If you fall short, Defence may issue a Maturity Action Plan for uplift, but you’ll present a far stronger application by closing gaps first.
Find out how close you are to Essential Eight ML2
Book a free 30-minute consultation with a Cyber Forte consultant. We’ll review your current posture against DISP’s cyber requirements, identify your biggest gaps and outline a practical path to ML2.
How Long Does DISP Membership Take , and What Does It Cost?
Timeframes
Defence says a DISP application generally takes 90 to 180 days from submission, depending on:
- The membership level you’re seeking
- The priority of the Defence work you’ll be doing
- Your business’s suitability, including FOCI
- How well prepared your application is
That clock starts when you lodge. The preparation beforehand, particularly governance documents and Essential Eight uplift, can add weeks or months if you start from scratch. Higher levels take longer, because personnel clearances and physical security accreditation add their own lead times.
Costs
There is no membership fee for DISP. The costs come from meeting and maintaining the requirements, such as:
- Cyber security uplift to Essential Eight ML2
- Developing security policies, plans and training programs
- Personnel security clearances (sponsored at Level 1 and above)
- Physical security measures and facility accreditation at higher levels
- Ongoing time for your CSO and SO
Grants can help
Under the Defence Industry Development Grants Program, eligible small and medium businesses can apply for grants of up to $100,000 to help establish and maintain DISP security accreditation and controls, including cyber security. Check current grant rounds and eligibility before you budget.
Ongoing DISP Obligations After Membership
Getting DISP membership is the start, not the finish. Defence runs a layered assurance framework, and members who persistently ignore requirements can be downgraded, suspended or have their membership terminated, cutting off their access to Defence work and supply chains.
What you’ll need to keep doing
- Submit an Annual Security Report (ASR) every 12 months on the anniversary of your membership certificate. The ASR is a self-attestation that must be tabled with your board or executive before it goes to Defence, and it now includes the Cyber Security Questionnaire against the full Essential Eight at ML2
- Keep a CSO and SO in place, and tell Defence about any change
- Report changes in circumstances, including ownership, FOCI, key personnel or premises, through the DISP Member Portal
- Run annual security awareness training and induction training for all staff
- Maintain ongoing employment screening and suitability checks
- Report security incidents using an XP188 Security Report form, and notify your contract manager
- Maintain a classified document register if you handle information at OFFICIAL: Sensitive or above
Audits you may face
Defence selects members for review using a risk-based framework:
- Ongoing Suitability Assessments (OSA): a desktop audit with a documentation review, a phone interview with your security staff and a cyber questionnaire
- Deep Dive Audits (DDA): a detailed assessment, including site visits, of your controls against DSPF Control 16.1, with recommendations tracked to completion
Outcomes from audit activity are shared with your Defence Contract Manager, so treat every ASR as if it will be checked.
7 Questions to Ask Before You Apply for DISP
Use these questions to test how ready your business is. If you can’t answer them confidently, that’s where to focus first.
- Which DISP level does our work actually require? Check your contracts and tenders, and resist nominating higher than you need.
- Who will be our CSO and SO? Both must be Australian citizens able to obtain at least a Baseline clearance.
- Are our security policies, plans and training programs documented? Defence expects them in place before membership is granted, not promised.
- Do we meet Essential Eight ML2 across every in-scope system? Controls applied in pockets won’t pass the Cyber Security Questionnaire.
- Is our MFA phishing-resistant? SMS codes and basic push notifications are a common point of failure.
- Do we have any foreign ownership, control or influence to declare? Foreign shareholders, directors, revenue or agreements all need to be disclosed.
- Can we sustain this every year? The Annual Security Report, training and incident reporting are ongoing commitments.
Not sure how you’d answer? Ask our team all seven questions.
Why Australian Defence Suppliers Choose Cyber Forte
Cyber Forte is an Australian-owned cybersecurity company founded in Melbourne, supporting organisations across Australia and New Zealand. Our team brings more than 25 years of combined cybersecurity experience and has worked with organisations including ANZ Bank, CPA Australia, Origin Energy, Australia Post and Accenture.
For DISP readiness, we offer:
- DISP gap assessments across all four security domains, mapped to the DISP Membership Requirements Checklist
- Essential Eight ML2 assessments and uplift, with evidence prepared the way the Cyber Security Questionnaire expects it
- Security governance support, including security policies and plans, risk assessments and awareness programs
- Security-cleared professionals experienced across government, defence and critical infrastructure
- CREST ANZ Approved Company Member status, with CREST-certified testers who validate that controls actually work
- Annual Security Report support so you stay compliant year after year
- Integrated compliance mapped to ISO 27001, the ISM, SOC 2 and the SOCI Act, so one control set serves several frameworks
- A long-term security partner, not a one-off report
The result is a DISP application that’s ready the first time, and a security program that keeps you there.
From DISP to End-to-End Cybersecurity
DISP membership rarely stands alone. Defence suppliers usually need broader support across testing, governance and monitoring to meet contract requirements and keep their membership in good standing.
Our broader capabilities include:
- Essential Eight compliance
- CREST penetration testing
- ISO 27001 certification and consulting
- ISO 42001 certification
- SOC 2 compliance
- PCI DSS
- SOCI Act compliance
- Security monitoring
- Security awareness as a service
- Digital forensics and incident response
This means you can work with one cybersecurity partner for DISP readiness, technical validation, compliance and ongoing security operations.
Explore Cyber Forte’s cybersecurity and compliance services.
Get DISP-Ready Without the Guesswork
DISP membership opens the door to Defence contracts and prime supply chains, but Defence won’t wave anyone through. The businesses that get accredited fastest pick the right level, have their governance documents ready before they apply, and can evidence Essential Eight ML2 across their environment.
With 90 to 180 days of processing time after you lodge, every week of preparation you do now brings your membership certificate closer.
Start your DISP journey with confidence.
Request a consultation with Cyber Forte about DISP readiness.
Frequently Asked Questions
DISP membership is Defence’s security accreditation for Australian businesses. It confirms your business meets Defence’s minimum security standards across governance, personnel, physical and information and cyber security, at the level you’ve applied for.
It’s mandatory if you work on classified information or assets (PROTECTED and above), handle weapons or explosive ordnance, provide security services for Defence bases, or your Defence contract requires it. Otherwise it’s optional, but increasingly expected by primes.
There is no membership fee. Costs come from implementing the security measures, such as Essential Eight uplift, governance documentation, clearances and physical security. Eligible SMEs can apply for Defence grants of up to $100,000.
Defence says applications generally take 90 to 180 days after submission, depending on your level, the priority of your Defence work, your suitability and how well prepared your application is.
Apply for the level your current or likely Defence work requires. Entry Level covers OFFICIAL and OFFICIAL: Sensitive information and suits most SMEs. Levels 1 to 3 require a business case, such as a contract or a letter of endorsement.
No. You can apply for Entry Level without a contract. For Level 1 and above, you’ll need to demonstrate a business need, usually through a contract, Notice of Engagement or letter of endorsement.
DISP requires the ASD Essential Eight at Maturity Level 2 across the IT systems you use to correspond with Defence, assessed through the Cyber Security Questionnaire across all eight strategies.
An Australian-registered entity with foreign ownership can apply, but must complete a FOCI declaration and assessment. Overseas entities cannot become DISP members directly.
Yes. Cyber Forte provides DISP gap assessments, Essential Eight ML2 uplift, security governance documentation and ongoing Annual Security Report support for Australian defence suppliers.
Get your Essential Eight maturity assessed before Essentials arrives
Don’t wait for an auditor, a tender panel or an attacker to find the gaps first. Book a free 30-minute consultation with a Cyber Forte consultant. You’ll get a clear view of your current maturity and a practical path to ML2 or ML3, with no obligation.
