DISP Questions

The Defence Industry Security Program (DISP) is run by the Department of Defence. It sets the security standards Australian businesses must meet to work on Defence projects, contracts and tenders that involve security requirements.

Businesses whose Defence contracts or prime contractors require it, businesses that handle classified Defence information, and businesses that need to store Defence weapons or explosive ordnance or sponsor security clearances.

It depends on the information you handle. Entry Level covers up to OFFICIAL: Sensitive, Level 1 covers PROTECTED, Level 2 covers SECRET and Level 3 covers TOP SECRET. Most suppliers start with Entry Level.

Defence does not charge a membership fee. The costs come from putting the required security measures in place and keeping them running.

It depends on your starting point and target level. Our typical timeline from gap analysis to submission is 3–6 months for Entry Level, 6–8 months for Level 1 and 12 months or more for Levels 2 and 3.

Defence’s assessment time is set by Defence and is not part of that estimate.

The Chief Security Officer (CSO) is a senior person accountable for security in your business. The Security Officer (SO) runs the security program day to day. Both are required for membership.

The Essential Eight is a set of cyber security strategies published by the Australian Signals Directorate. DISP members must meet the Essential Eight requirements set for their membership level.

No. Membership shows you meet Defence’s security requirements. It can be a condition of a contract or tender, but it does not guarantee one.

Members must keep their controls in place, report changes to Defence and submit an annual security report. We can support you with these ongoing obligations.