DISP: The Defence Industry Security Program

Overview

What is the DISP?

The Defence Industry Security Program is the framework through which Defence assures the security of the businesses it works with. It is administered by the Defence Industry Security Branch within the Department of Defence and is underpinned by the Defence Security Principles Framework, specifically Principle 16. Membership gives Defence confidence that a supplier can protect Defence people, information, and assets, and gives the supplier access to classified work and sponsorship for security clearances.

The program is built on the same protective security thinking as the PSPF, applied to the defence-industry context.

Eligibility

Who is eligible for DISP membership?

To be eligible for DISP membership, a business must be registered as a legal entity in Australia with an Australian Business Number and be financially solvent. It must nominate a Chief Security Officer, a senior person responsible for the security arrangements and for championing security culture, and a Security Officer, who develops and implements the security policies and plans. In smaller businesses the two roles can be held by the same person.⁴

Applicants also assess their foreign ownership, control or influence (FOCI) and submit a FOCI declaration as part of the application. Defence then assesses suitability against the Defence Security Principles Framework across the four security domains.

The structure

What are the DISP security domains and membership levels?

DISP requirements are set across four security domains: security governance and risk management, personnel security, physical security, and information and cyber security. A business selects a membership level for each domain, from Entry Level, through Level 1, Level 2 and Level 3.

The levels map to the information classifications: Entry Level corresponds to OFFICIAL and OFFICIAL: Sensitive; Level 1 to PROTECTED; Level 2 to SECRET; and Level 3 to TOP SECRET. A business can hold different levels across the domains, but the security governance level must always match or exceed the highest level held in any other domain. Clearance sponsorship is not available at the Entry Level.

In practice

What does each DISP domain require in practice?

• Security governance. A security policy and plan, clear accountability through the Chief Security Officer and Security Officer, a security risk assessment, insider threat awareness, and reporting of all security incidents to Defence.
• Personnel security. Workforce screening in line with AS 4811:2022, the Australian standard for workforce screening, security awareness training, and processes for clearance sponsorship at Level 1 and above.
• Physical security. Facilities protected in proportion to the classification of the work, from sound access control at Entry Level to accredited secure areas at higher levels.
• Information and cyber security. Protection of the corporate ICT environment used for Defence business, including the Essential Eight at Maturity Level 2.

For many suppliers the governance, personnel and physical domains are where applications stall, because they require written policies, trained people and evidence rather than technology alone. A security risk assessment is usually the starting point for all three.

Cyber requirement

Does DISP membership require the Essential Eight?

Cyber security has become the sharpest DISP requirement. Following the conclusion of assessments against the top four mitigations on 15/11/2025, all DISP members are now required to achieve and maintain the full ASD Essential Eight at Maturity Level 2 across the corporate ICT environment they use to deal with Defence.

This is a significant lift for many suppliers. The Essential Eight is explained in the cyber security pillar, and meeting Maturity Level 2 is now a condition of membership rather than an aspiration.

Membership

How do you apply for and maintain DISP membership?

Preparing for DISP membership means assessing where the business stands against the requirements in each of the four domains, closing the gaps, and assembling the evidence Defence will want to see. The cyber domain, with its Essential Eight Maturity Level 2 requirement, is usually the longest pole.

Membership is not a one-off. Members must maintain their security posture, report changes, and continue to meet the requirements of the levels they hold, including the Essential Eight obligation. Members also complete an annual security report and report security incidents as they occur. Treating DISP as an ongoing program, not a certificate, is what keeps a supplier eligible for the work.

How we help

How Agilient supports DISP membership

Agilient is itself a current DISP member, holding Level 2 in the governance and personnel domains and Entry Level in the physical and the ICT and cyber security domains. The firm therefore understands the program from the inside, as a member, as well as advising others on achieving and maintaining membership.

Where a DISP member must also manage foreign ownership, control or influence arising from foreign investment, Agilient extends the same discipline to FIRB and foreign investment security compliance.

Agilient helps defence-industry businesses achieve and maintain DISP membership across all four domains, and supports the wider defence and defence industry sector. As an Australian-owned security consultancy active in the defence sector, with membership of the Ai Group Defence Council and the Australian Industry and Defence Network, Agilient understands what Defence expects of its suppliers.

Agilient works across Sydney, Melbourne, Brisbane, Adelaide, Canberra and regional Australia.