What Is DISP and Why Does It Matter?
The Defence Industry Security Program (DISP) is the Australian Government's framework for managing security obligations across the defence industry supply chain. Administered by the Department of Defence under the Defence Security Principles Framework (DSPF) Principle 16, Control 16.1, DISP provides a structured pathway for Australian entities to demonstrate that they can responsibly handle defence information and assets.
DISP membership is not simply a compliance checkbox. It is a signal to Defence and to prime contractors that your organisation has the governance, personnel, physical, and cyber security controls in place to participate safely in the defence supply chain. For many contracts — particularly those involving access to classified information or the ability to sponsor security clearances — DISP membership is a contractual requirement.
Beyond contractual requirements, DISP membership opens doors. Members gain access to Defence security services, security training and materials, and the ability to sponsor personnel security clearances. For organisations seeking to grow their defence business, DISP membership is increasingly a baseline expectation rather than a differentiator.
Eligibility Requirements
Before beginning your DISP application, your organisation must meet the following eligibility criteria as defined in the DSPF:
- Registered as a legal business entity in Australia with an Australian Business Number (ABN)
- Financially solvent — unable to apply if subject to insolvency proceedings
- A Director or senior executive who is able to obtain an Australian Personnel Security Clearance (commensurate with the membership level applied for)
- A Director or senior executive who is able to obtain an Australian Digital ID
- Able to demonstrate a genuine business need for DISP membership
- Subject to the Foreign Investment Review Board (FIRB) requirements where applicable
- Compliance with the Privacy Act 1988 and Freedom of Information Act 1982
The Four Security Domains
DISP membership is assessed across four security domains. Your membership level in each domain is determined by the classification of information you need to access and the nature of your Defence work. The governance domain level always equals the highest level applied for in any other domain.
Security Governance
All levelsSecurity governance is the foundation of every DISP application. You must demonstrate that your organisation has appropriate accountability structures, security policies, incident response procedures, and security education programs in place. The governance domain level always equals the highest level applied for in any other domain.
Personnel Security
All levelsPersonnel security ensures that employees and contractors with access to Defence information are appropriately screened and security-aware. All DISP members must meet the Australian Standard for Workforce Screening (AS 4811:2022). Higher membership levels require personnel to hold Australian Government security clearances.
Physical Security
Level 1 and abovePhysical security protects people, property, and assets from threats that could result in damage or loss. Requirements scale with membership level — Entry level has minimal physical security requirements, while Level 1 and above require certified secure zones for handling PROTECTED and above information. Zone certification is assessed by ASIO.
ICT and Cyber Security
All levelsAll DISP members must demonstrate compliance with the ASD Essential Eight at Maturity Level 2 across ICT corporate systems used to correspond with Defence. This applies from Entry level upward. The Cyber Security Questionnaire (CSQ) — reported by industry advisers as around 107 questions covering the Essential Eight — is completed as part of the Entry Level Assessment.
Essential Eight ML2: the baseline applicants underestimate
ML2 is not a checkbox exercise — each of the eight strategies has specific technical requirements that must be evidenced. For example, multi-factor authentication at ML2 must be phishing-resistant (not SMS-based) on internet-facing services and for privileged users, and critical operating system patches must be applied within 48 hours. Defence assesses your posture through the Entry Level Assessment — a review of your security documentation, a phone interview with security staff, and completion of the Cyber Security Questionnaire. Many applicants commission an independent Essential Eight assessment (e.g. from an IRAP assessor) to evidence their posture, though this is not mandated.
Read our Essential Eight ML2 for DISP guide →Membership Levels and Classification Access
DISP offers four membership levels, each aligned with Australian Government security classifications. The level you apply for determines the classification of information you are accredited to handle and the security controls you must demonstrate.
| Level | Classification Access | Key Requirement | Typical Timeline |
|---|---|---|---|
| Entry | OFFICIAL and OFFICIAL: Sensitive | E8 ML2, governance documentation, personnel screening | 3–6 months |
| Level 1 | PROTECTED | All Entry requirements + security clearances + physical zone certification | 6–12 months |
| Level 2 | SECRET | All Level 1 requirements + higher-grade clearances + enhanced physical security | 12+ months |
| Level 3 | TOP SECRET | All Level 2 requirements + highest-grade clearances + comprehensive assurance | 6–12+ months |
The Application Process: Step by Step
Confirm Eligibility
Before applying, confirm that your organisation meets the basic eligibility criteria: registered Australian entity with an ABN, financially solvent, and with a Director or senior executive able to obtain an Australian Personnel Security Clearance and Australian Digital ID. You must also be able to demonstrate a genuine business need for DISP membership — typically evidenced by a current or upcoming Defence contract, a letter of endorsement from a Defence Contract Manager, or a sponsoring entity letter.
Determine Your Membership Level
Identify the membership level you require for each of the four security domains. Your level is typically determined by the classification of information you need to access: Entry for OFFICIAL/OFFICIAL:Sensitive, Level 1 for PROTECTED, Level 2 for SECRET, and Level 3 for TOP SECRET. The governance domain level must always equal the highest level applied for in any other domain. If you are unsure, your Defence Contract Manager can advise on the level specified in your contract.
Conduct a Security Gap Assessment
Before submitting your application, conduct an honest assessment of your current security posture against DISP requirements across all four domains. Identify gaps in your governance documentation, personnel screening processes, physical security controls, and ICT/cyber security posture. This assessment will inform your Maturity Action Plan and help you prioritise remediation work. Many organisations engage a DISP consultant at this stage to ensure the assessment is comprehensive and aligned with current DISP standards.
Prepare Required Documentation
Gather and prepare the documentation required to support your application. This includes your Security Management Plan, Security Incident Response Plan, evidence of personnel screening processes, physical security documentation (for Level 1 and above), and your completed Cyber Security Questionnaire. The quality and completeness of your documentation is one of the most significant factors in application success — incomplete or inconsistent documentation is a leading cause of application delays and rejections.
Register on the DISP Member Portal
Submit your DISP membership application through the DISP Member Portal. You will need to create an account, complete the online application across its nine sections — entity details, officer details, contracts and panels, physical and ICT, membership levels, FOCI, the cyber questionnaire, attachments, and preview and submit — and upload your supporting documentation. The portal is also used for ongoing membership management, including submitting Annual Security Reports and updating organisational details. As part of your submission you must complete a Foreign Ownership, Control or Influence (FOCI) declaration — disclosing any foreign shareholders, directors, or significant foreign business relationships. Undisclosed foreign connections are grounds for rejection.
Entry Level Assessment (ELA)
Once your application is submitted, DISP will conduct an Entry Level Assessment (ELA). This involves a documentation review, a phone interview with your nominated Chief Security Officer or Security Officer, and completion of the Cyber Security Questionnaire. The ELA establishes your baseline security maturity profile and identifies any gaps that need to be addressed before membership can be granted.
Receive Your Maturity Action Plan
If gaps are identified during the ELA, DISP will issue a Maturity Action Plan (MAP) documenting the remediation steps required and the timeframe within which they must be completed. You do not need to achieve full compliance before receiving your MAP — the MAP is the mechanism through which DISP guides you to full compliance. Organisations with a credible MAP and demonstrated commitment to remediation can receive conditional membership while completing their uplift.
Membership Granted and Ongoing Obligations
Once DISP is satisfied that your organisation meets the requirements, your membership certificate is issued. From that point, you have ongoing obligations including submitting an Annual Security Report on the anniversary of your certificate, notifying DISP of significant changes to your organisation or security posture, and maintaining compliance with all DISP requirements across the four security domains.
Physical and Personnel Security: What Assessors Actually Look For
Physical and personnel security are the two domains most frequently underestimated by first-time applicants. Both require documented procedures — not just physical measures — and both must be evidenced at the time of application, not promised for later.
Physical security in practice
Requirements scale with membership level. Entry level typically requires only basic access control and visitor management. Level 1 (PROTECTED) requires demonstrated secure storage capability — typically a GSA-approved security container or equivalent. Level 2 and above require a Defence-approved secure area. Your documentation must include a facility security plan, access control and visitor management procedures, and a physical security inspection schedule.
Personnel security in practice
Beyond pre-employment screening aligned to AS 4811:2022, Level 1 and above require documented foreign contact and foreign travel reporting procedures — one of the most commonly missing elements in first-time applications. An insider threat awareness programme is also required, with initial training for all personnel with access to classified information and annual refreshers. Training records must be maintained and available for review.
The Security Officer Interview and Requests for Additional Information
For Entry and Level 1 applications, the assessment is typically a desktop review followed by a phone or video interview with your nominated Security Officer. For Level 2 and Level 3, a site visit is standard — assessors physically inspect your facilities and conduct in-depth interviews with the Security Officer and senior management. Both the Chief Security Officer and the Security Officer should complete security awareness training before submission.
During the interview, assessors probe the Security Officer's understanding of your obligations under the PSPF and DSPF, incident reporting procedures, personnel screening and foreign contact reporting, ICT security controls and Essential Eight ML2 implementation, and the physical security measures in place. The Security Officer must be able to speak confidently to the Security Management Plan they are accountable for — a plan produced by consultants without genuine organisational engagement is quickly identified.
If gaps are identified, assessors typically issue a Request for Additional Information (RFAI) rather than rejecting the application outright. Respond promptly and completely — partial responses extend the assessment timeline. Where the gaps are substantive, the assessor may recommend withdrawing the application and resubmitting after remediation.
Realistic Costs and Preparation Approaches
There is no Defence application fee, but the total cost of achieving accreditation varies significantly with your starting security posture, target level, and how you prepare. The single biggest predictor of cost blowouts is premature submission — incomplete applications are the leading cause of DISP delay, and Defence reports it is working through a significant application backlog. Most applications require at least one round of additional documentation before a decision.
Traditional consulting
Premature submission drives costly rework. Costs are driven by hourly consulting fees for manual document production and rework.
Structured readiness programme
Structured workflows and defined milestones reduce rework, compress the timeline, and materially improve first-attempt success.
DISPath guided application
Defined milestones, measurable outcomes, and expert oversight at every stage — with no hourly billing surprises.
Common Application Mistakes to Avoid
Based on our experience supporting organisations through the DISP application process, the following are the most common mistakes that cause delays, additional assessment rounds, or outright rejection. For a deeper analysis, see our article on why DISP applications are rejected.
Incomplete governance documentation
Submitting a Security Management Plan that does not address all required elements, or providing generic policy templates without tailoring them to your organisation's specific context.
Underestimating the cyber security requirements
Assuming that existing IT security practices will satisfy E8 ML2 without conducting a formal gap assessment. Many organisations discover significant gaps only after submitting their application.
Nominating the wrong membership level
Applying for a higher level than your contracts require, or failing to apply for the level specified in your contract. Both create unnecessary complexity and cost.
Inadequate business need justification
Failing to provide sufficient evidence of a genuine business need for DISP membership. Without a contract, letter of endorsement, or sponsoring entity letter, applications are typically rejected.
Delayed security clearance applications
Not initiating security clearance applications for key personnel early enough. Clearance processing times can add months to your overall DISP timeline.
No Maturity Action Plan for cyber gaps
Submitting a CSQ that reveals significant E8 gaps without a credible remediation plan. DISP expects to see a realistic MAP with achievable timelines.
Ongoing Membership Obligations
Receiving your DISP membership certificate is not the end of the process — it is the beginning of an ongoing compliance obligation. DISP members must maintain their security posture and demonstrate continued compliance through a structured cycle of reporting and assessment.
The most important ongoing obligation is the Annual Security Report (ASR), submitted via the DISP Member Portal every 12 months, within 10 business days of the anniversary of membership being granted. The ASR is a self-attestation of compliance across all four security domains, including the Cyber Security Questionnaire for the ICT and cyber security domain. Members must also notify DISP of significant changes to their organisation, security posture, or personnel within specified timeframes.
DISP conducts periodic Ongoing Suitability Assessments (OSAs) and, where warranted, Deep Dive Audits (DDAs) to verify that members continue to meet their obligations. Failure to maintain compliance can result in membership suspension or cancellation, which would prevent you from accessing classified information or sponsoring security clearances.
Frequently Asked Questions
How Serious Defence Supports Your Application
Serious Defence's three interconnected products cover the full DISP lifecycle — from initial readiness through to sustained membership management. Each addresses a distinct part of the accreditation journey described in this guide.
DISPath
Structured gap assessment methodology, SMP templates, Security Officer competency frameworks, and a pre-submission review checklist — taking you from initial assessment to submission-ready.
Learn moreDISPeer
An Australian-hosted cloud environment pre-configured to align with DISP ICT security requirements — eliminating the burden of building and maintaining your own Essential Eight ML2-compliant infrastructure.
Learn moreDISPulse
Continuous compliance tracking across all four DISP domains — personnel security, training records, and foreign contact reporting — keeping your evidence current for Annual Security Reports and Ongoing Suitability Assessments.
Learn moreNavigate Your DISP Application with Confidence
DISPath is Serious Defence's structured DISP application workflow engine. It guides your organisation through every step of the application process — from gap assessment to documentation preparation to submission — with expert oversight at every stage.