Question 1

What is DISP membership?

Accepted Answer

DISP — the Defence Industry Security Program — is Australia's mandatory security framework for businesses that work with the Department of Defence on classified or security-sensitive contracts. DISP membership demonstrates that your organisation meets the personnel, physical, ICT, and governance security standards required to access classified Defence information, sponsor security clearances, and participate in sensitive Defence projects. Membership is administered by the Defence Industry Security Office (DISO) and is a prerequisite for many Defence contracts.

Question 2

How long does DISP accreditation take?

Accepted Answer

The DISP accreditation process typically takes between 6 and 18 months from initial application to membership grant, depending on your membership level and the completeness of your application. Entry-level applications with no classified requirements can be processed in as little as 3–6 months. Level 1 and above applications — which require ASIO zone certification and Essential Eight ML2 compliance — typically take 12–18 months. The most common cause of delays is incomplete applications, particularly gaps in the Essential Eight Maturity Level 2 cyber security requirements or incomplete security governance documentation.

Question 3

What are the four DISP membership levels?

Accepted Answer

DISP has four membership levels: Entry, Level 1, Level 2, and Level 3. Entry level is for organisations that need to sponsor BASELINE security clearances or access OFFICIAL: Sensitive information, but do not require access to classified facilities. Level 1 is for organisations that need to sponsor PROTECTED-level clearances or access PROTECTED information, requiring ASIO-certified secure zones. Level 2 is for organisations that need to sponsor SECRET-level clearances or work with SECRET information, requiring more stringent physical and personnel security controls. Level 3 is the highest level, for organisations that sponsor TOP SECRET clearances or work with TOP SECRET information, requiring the most rigorous security controls across all four domains.

Question 4

What is the Essential Eight requirement for DISP in 2026?

Accepted Answer

As of 15 November 2025, all DISP members are required to demonstrate compliance with the Australian Cyber Security Centre's Essential Eight at Maturity Level 2 (ML2) across their ICT corporate systems. This requirement applies to all membership levels — Entry, Level 1, Level 2, and Level 3. ML2 requires organisations to implement all eight mitigation strategies (application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict admin privileges, patch operating systems, multi-factor authentication, and regular backups) in a way that makes it significantly harder for adversaries to compromise systems. Compliance is self-attested annually via the Cyber Security Questionnaire (CSQ) Part B in the Annual Security Report.

Question 5

How much does DISP membership cost?

Accepted Answer

DISP membership itself does not carry a government fee — there is no charge from the Department of Defence to apply for or maintain DISP membership. However, the cost of achieving and maintaining compliance is significant. Organisations typically spend between $20,000 and $150,000+ to prepare for DISP membership, depending on their starting security posture and membership level. Key costs include Essential Eight ML2 uplift (often $15,000–$80,000 for ICT remediation), ASIO zone certification for Level 1+ (typically $10,000–$40,000 for fit-out and certification), security governance documentation, staff security awareness training, and ongoing annual compliance costs. Traditional consulting-led DISP engagements average $80,000+. Software-led approaches like DISPulse can significantly reduce these costs.

Question 6

What happens if my DISP application is rejected?

Accepted Answer

If your DISP application is rejected, DISO will issue a Notice of Intention to Refuse (NOIR) explaining the specific grounds for rejection. You have the right to respond to the NOIR and provide additional information or evidence before a final decision is made. If the application is formally refused, you can reapply once you have addressed the identified deficiencies. The most common grounds for rejection are: failure to meet Essential Eight Maturity Level 2 requirements, incomplete or inadequate security governance documentation (Security Management Plan, Security Incident Response Plan), failure to meet employment screening requirements under AS 4811:2022, and adverse findings during the suitability assessment of key personnel. Addressing these issues before reapplying — rather than after receiving a rejection — is strongly recommended.

DISP Membership FAQ

Download the Full DISP Checklist

Still Have Questions?