By Alan Rankins · Updated October 2026
DISP ExplainedThe Defence Industry Security Program in Plain English
The Defence Industry Security Program (DISP) is the Australian Government's framework for assessing whether non-government organisations can be trusted to work with Defence information, people, and assets. This guide explains everything you need to know — sourced directly from Defence.gov.au.
What is DISP?
The Defence Industry Security Program (DISP) is the Australian Government's membership-based security accreditation for organisations that work with Defence. Administered under DSPF Principle 16 (Control 16.1), membership is granted at four levels — Entry, 1, 2 and 3 — set independently across four security domains: governance, personnel, physical, and information & cyber security. Applications go through the DISP Member Portal.
The Australian Government's Defence Supply Chain Security Framework
The Defence Industry Security Program (DISP) supports Australian entities to understand and meet their security obligations when engaging in Defence tenders, contracts, and projects. It is a multi-level, membership-based program underpinned by the Defence Security Principles Framework (DSPF), specifically Principle 16, Control 16.1.
DISP is not a single checklist. It is an ongoing security relationship between your organisation and Defence. The program assesses your security posture across four interconnected domains — Governance, Personnel, Physical, and Information & Cyber Security — and assigns a membership level aligned to the classification of information you are accredited to handle.
Membership is open to any Australian entity looking to become part of the Defence supply chain. While not mandated in every circumstance, it is highly recommended for any entity currently working on Defence projects or seeking to partner with Defence.
What's Changed Since 2021
Most older DISP guides — including the ones that still rank on Google — predate the program's biggest changes. Here is what is different now.
Essential Eight ML2 is now mandatory
Since 30 September 2024, every DISP member — at every level, including Entry — must meet Essential Eight Maturity Level 2 across systems used to correspond with Defence. This replaced the older cyber pathways (ISO 27001 certification or the "Top 4" mitigation strategies) that pre-2024 guides still reference.
Levels are set per security domain — not per business
You don't hold a single DISP level. Your membership level is assessed independently in each of the four security domains — governance, personnel, physical, and ICT — with the governance level always set equal to the highest level held elsewhere.
Applications go through the DISP Member Portal
Email-based applications are gone. Applications, supporting evidence, and ongoing obligations such as the Annual Security Report (ASR) are now managed through the DISP Member Portal, assessed by the Defence.
A conditional pathway now exists
Organisations that have not yet reached Essential Eight ML2 can be granted conditional membership via an E8 ML2 Maturity Action Plan — a committed, time-bound remediation plan agreed with Defence rather than an automatic knock-back.
The Four DISP Security Domains
DISP assesses your organisation across four interconnected domains. A weakness in one area often exposes risk in another. Your membership level within each domain is determined by the classification of data you handle.
Security Governance
Leadership accountability, documented security policies, risk-based decision-making, and evidence that security is actively managed at the executive level. The Governance domain must always equal the highest level held across all other domains.
- Security Management Plan (SMP)
- Chief Security Officer (CSO) and Security Officer (SO) appointed
- Annual Security Report (ASR) submitted
- Security risk register maintained
Personnel Security
Identifying key, relevant, and ancillary personnel; obtaining appropriate security clearances; and maintaining processes for onboarding, offboarding, and role changes. Personnel security is about trust and control, not just clearance levels.
- Security clearances obtained where required
- Personnel security obligations communicated
- Insider threat awareness program
- Clearance sponsorship processes documented
Physical Security
Protecting facilities, assets, and environments that handle Defence information. Controls must match the actual risk profile of your operations — not generic assumptions. Higher membership levels require certified secure areas.
- Access control to sensitive areas
- Visitor management procedures
- Physical security risk assessment
- Certified secure storage where required
Information & Cyber Security
How information is created, stored, accessed, transmitted, and protected. Since 30 September 2024, DISP requires the full Essential Eight Maturity Level 2 across systems used to correspond with Defence — at every membership level, including Entry.
- Information classification and handling
- Essential Eight ML2 (all levels)
- Cyber Security Questionnaire (CSQ) completed
- Incident response plan documented
Note: The Security Governance domain must always equal the highest level held across all other domains. Source: Defence.gov.au
Four DISP Membership Levels
DISP membership levels align with Australian Government security classifications. The higher the level, the more rigorous the assessment — and the greater the access to classified contracts and clearance sponsorship.
Entry Level
Suitable for entities handling unclassified or sensitive-but-unclassified Defence information. Cannot sponsor security clearances for general staff, but the CSO and SO must be able to obtain a personnel security clearance.
Level 1
The most common membership level for SMEs entering the Defence supply chain. Enables clearance sponsorship and access to PROTECTED-level contracts.
Level 2
Required for entities handling SECRET-level information. Significant uplift in physical security and ICT requirements.
Level 3
The highest tier, reserved for entities with access to TOP SECRET information. Requires the most rigorous security posture across all four domains.
| Level | Classification | Personnel Clearance | E8 Minimum |
|---|---|---|---|
| Entry Level | OFFICIAL / OFFICIAL: Sensitive | CSO & SO must be able to obtain a clearance | ML2 |
| Level 1 | PROTECTED | Baseline | ML2 |
| Level 2 | SECRET | NV1 | ML2 |
| Level 3 | TOP SECRET | NV2 / PV | ML2 |
Levels are assessed independently per security domain (governance, personnel, physical, ICT) — not one level per business. Per DSPF Control 16.1–18, the CSO and SO must be able to obtain an Australian Personnel Security Clearance commensurate with the membership level applied for, and employment screening under AS 4811:2022 applies to all personnel with access to government resources — cleared or not.
Benefits of DISP Membership
As stated by the Department of Defence, DISP membership provides entities with the following benefits.
Sponsor Security Clearances
DISP members at Level 1 and above can sponsor their own employees for Australian Government security clearances — removing a major barrier to winning classified contracts.
Access International Contracts
DISP membership opens doors to international defence contracts and enables security clearance recognition by international partners under arrangements such as AUKUS.
Security Training & Materials
Members receive access to Defence security training, cyber security guidance, and current security information to assist in security planning and staff awareness.
Improved Security Posture
The DISP assessment process itself strengthens your security operating environment — giving you a structured framework to identify and close gaps before they become incidents.
Assurance for Defence Partners
DISP membership signals to Defence primes, subcontractors, and government entities that your organisation meets a verified security standard — a competitive differentiator in procurement.
Access to Security Advice
DISP members can access Defence security services and expert advice to help navigate complex security obligations across the supply chain.
Note: DISP membership does not guarantee Defence contracts. Contracts remain subject to standard procurement processes. Source: Defence.gov.au
Who Needs DISP Membership?
Any Australian entity — from sole traders to ASX-listed primes — that accesses classified Defence information, works on or near Defence establishments, or holds a contract that specifies it.
Defence Primes & Tier 1 Subcontractors
BAE Systems, Thales, Lockheed Martin and other primes mandate DISP for all subcontractors as a condition of engagement. If you supply to a prime, you need DISP.
ICT & Cybersecurity Firms
Companies supporting Defence networks, data centres, mission-critical systems, or classified ICT environments must hold DISP before accessing any classified system.
Engineering & Construction
Companies working on Defence facilities, bases, shipyards, or infrastructure projects — including construction, maintenance, and facility management — require membership.
Professional Services
Legal, financial, consulting, and advisory firms that handle sensitive Defence information or advise on classified programs are within scope of DISP requirements.
R&D and Technology Companies
Organisations conducting research, development, or testing on Defence-funded programs — including universities and research institutes — must hold appropriate DISP membership.
SMEs Entering the Market
Small and medium enterprises entering the defence supply chain for the first time. Defence has specific SME guidance — membership is achievable with the right preparation.
How to Apply for DISP Membership
DISP applications are submitted through the DISP Member Portal and assessed by the Defence. The process involves demonstrating your security posture across all four domains before an application is lodged.
Timelines vary significantly based on your current security maturity and the membership level sought. Entry Level applications can be processed in as little as 3 months; Level 2 and 3 applications typically take 6–12 months or longer. And DISP is not a one-time certification — members must submit an Annual Security Report (ASR), maintain their security posture, and notify Defence of significant changes.
Readiness Assessment
Conduct a gap analysis across all four DISP security domains against your target membership level. Identify remediation requirements, estimate costs, and establish a realistic timeline. This stage determines whether you apply now or invest in uplift first.
Security Plan Development
Prepare the Security Plan — the centrepiece of your application. It must cover your governance arrangements, personnel security procedures, physical security controls, and ICT security architecture. Vague policy statements without supporting evidence are the single most common reason applications are returned.
Essential Eight Assessment
Demonstrate Essential Eight Maturity Level 2 compliance across all systems used to process, store, or transmit Defence information — required at every membership level, including Entry. Defence assesses this through a review of your security documentation, an interview with security staff, and the Cyber Security Questionnaire (CSQ). Many applicants commission an independent assessment (e.g. from an IRAP assessor) to evidence their posture, though this is not mandated.
Personnel Clearances
Nominate your Chief Security Officer (CSO) and Security Officer (SO) and initiate AGSVA clearance processing for both roles. Applications cannot be assessed until cleared personnel are in place. AGSVA's target processing times are around 20 business days for Baseline, 70 for NV1, and 100 for NV2 — start early.
Defence Submission & Assessment
Submit the completed application through the DISP Member Portal. The Defence conducts a detailed review, may request additional information or a site visit, and issues a decision. A well-prepared, complete application at the right level is the most effective way to achieve first-attempt approval.
What DISP Costs and How Long It Takes
There is no DISP membership fee. The real cost is achieving and maintaining compliance — indicative total for most SMEs at Entry Level or Level 1 is $30,000–$100,000.
Indicative Cost Breakdown
All figures are indicative market ranges, not quotes.
Indicative market rates; varies by scope and systems in scope
Consultant-led; higher for complex organisations
Depends on existing infrastructure and target level
Charged to the sponsor per person: Baseline $810.91, NV1 $1,724.55, NV2 $3,445.45
ASR preparation, monitoring, training, and reviews
Indicative Timeline by Level
Assumes a complete, compliant application at the correct level.
No clearance sponsorship required; the fastest pathway
Assuming complete application and cleared personnel in place
Personnel clearance processing is typically the critical path
Most intensive assessment process
Critical: incomplete applications are the leading cause of DISP delay. Defence is working through a significant application backlog, and most applications require at least one round of additional documentation before a decision.
"DISP is not about perfection. It's about a demonstrated, credible security maturity."
— GRC4, DISP Explained, December 2025
DISP Membership FAQ
Q.What is DISP membership?
The Defence Industry Security Program (DISP) is a multi-level, membership-based program administered by the Australian Department of Defence. It supports Australian entities to understand and meet their security obligations when engaging in Defence tenders, contracts and projects. DISP is underpinned by the Defence Security Principles Framework (DSPF), Principle 16, Control 16.1.
Q.Is DISP membership mandatory?
DISP membership is not mandated in all circumstances. However, depending on the type of work an entity undertakes with Defence, or any contractual requirements, DISP membership may be mandated. It is highly recommended for any entity currently working on Defence projects or seeking to partner with Defence.
Q.How much does DISP membership cost?
There is no direct membership fee for DISP. However, there are costs associated with implementing and maintaining the required security measures, which may include facility certification and accreditation, personnel security clearances, and physical security upgrades.
Q.What are the four DISP membership levels?
DISP has four membership levels aligned to Australian Government security classifications: Entry Level (OFFICIAL / OFFICIAL: Sensitive), Level 1 (PROTECTED), Level 2 (SECRET), and Level 3 (TOP SECRET). The higher the level, the more rigorous the assessment.
Q.What are the four DISP security domains?
DISP assesses organisations across four security domains: (1) Security Governance — leadership accountability, policies, and risk management; (2) Personnel Security — clearances, vetting, and access control; (3) Physical Security — facility protection and access management; (4) Information and Cyber Security — ICT controls, data handling, and cyber resilience.
Q.Can DISP members sponsor security clearances?
Yes. DISP membership gives entities the ability to sponsor their own employees for Australian Government security clearances. This benefit is not available for Entry Level membership — it requires Level 1 or above.
Related DISP Guides
How to Apply for DISP Membership
Step-by-step guide to the DISP application process, eligibility criteria, and the DISP Member Portal.
DISP Essential Eight ML2 Requirements
What Essential Eight Maturity Level 2 means for DISP members and how to achieve it.
DISP Annual Security Report (ASR)
What the ASR is, what it covers, and how to prepare a compliant submission.
DISP Support from Serious Defence
Serious Defence has supported 50+ DISP engagements across Australian defence, ICT, engineering, and professional services sectors.
DISPath
End-to-end DISP application management. We prepare your Security Plan, coordinate your IRAP assessment, manage your AGSVA clearance nominations, and guide your application through Defence assessment to first-attempt approval.
Learn moreDISPulse
Purpose-built software for DISP compliance management. Automates Annual Security Reports, maps control evidence to DSPF requirements, tracks clearance expiry dates, and provides real-time compliance visibility.
Learn moreDISPeer
A fully managed, DISP-compliant ICT environment that meets Essential Eight ML2 requirements out of the box. Eliminates the need to build and maintain your own compliant infrastructure.
Learn moreReady to Start Your DISP Journey?
Serious Defence helps Australian businesses achieve DISP membership using structured workflows, GRC software, and sovereign cloud infrastructure — without the $80k consultant bill.