The Part of the RFT Everyone Skims
Most bid teams read a Defence Request for Tender in the same order: scope, evaluation criteria, pricing schedules, then — if time permits — the conditions of contract. That order is backwards. Inside the conditions and the additional-requirements schedule sit a small number of security clauses that determine whether you are even eligible to win, what the work will really cost you, and what obligations you will carry for years after delivery.
Here are the five to find first.
1. The DISP Membership Requirement
Defence's template documents include a dedicated clause stating whether DISP membership is required — and, critically, at what level for each security category separately: governance, personnel, physical, and information/cyber security. Because DISP levels are granted per category, an RFT might demand Level 1 physical but only Entry for ICT. Read the per-category table, not just the headline.
Two failure modes: bidding without the required membership (non-compliant — out), or over-complying (spending a year and six figures reaching Level 1 when the clause only asked for Entry). The ANAO's audit of Defence's DISP administration confirmed that where membership is required, contracts include a specific clause on obtaining and maintaining it. This is not a one-time gate — it is an ongoing condition of contract.
2. The Flow-Down Clause
Prime contracts routinely require you to impose the same security obligations on your subcontractors — and to be able to prove you have. If you are bidding as a prime with a supply chain behind you, the flow-down clause means your subs' DISP status is your problem. The common misconception that "our prime's membership covers us" fails here in both directions: your prime's membership does not cover you, and your membership does not cover your subs.
3. FOCI — Foreign Ownership, Control or Influence
Every DISP applicant makes a FOCI declaration, and tender schedules frequently ask for it again: foreign shareholders, directors, significant foreign contracts, offshore data hosting. Undeclared foreign connections are grounds for rejection — and discovered late, grounds for termination. If your cap table includes overseas investors, or your SaaS stack hosts offshore, answer the FOCI question before pricing, not after.
4. The Cyber Requirement
Since 30 September 2024, the DISP cyber baseline is the full Essential Eight at Maturity Level 2 for all members. RFTs increasingly reference it directly, and some ask for evidence in the response itself — assessment summaries, the Cyber Security Questionnaire, system scope descriptions. If your ML2 posture is aspirational rather than demonstrated, the cyber clause is where your bid quietly dies at evaluation.
5. Personnel Security and Clearance Sponsorship
Clauses requiring cleared personnel — Baseline, NV1 or higher for named roles — carry two hidden costs bid teams miss: AGSVA fees (Baseline $810.91, NV1 $1,724.55, NV2 $3,445.45 per person under the current cost-recovery schedule) and time (AGSVA's own targets run from 20 business days for Baseline to 100 for NV2, and targets are not guarantees). Pricing a six-month mobilisation around clearances that take five months is a program risk you own from day one.
Read Them Like Defence Wrote Them
The ANAO found that Defence's templates are built to capture these requirements deliberately and enforce them through the contract. That is the mindset to bring: these clauses are drafted to be used. The winning bid is rarely the one with the glossiest capability statement — it is the one that answers every security clause with current, verifiable evidence.
How Serious Defence Helps
Serious Defence works on exactly this: DISPath builds your DISP posture to submission standard, DISPulse keeps your E8 ML2 and security evidence current enough to drop straight into a tender response, and our consultants review RFT security requirements with clients before bid/no-bid decisions. See our guides to getting DISP membership and the full requirements checklist — or bring us the RFT.
Image: Legal contract and signature, via Wikimedia Commons (CC BY 2.0).