DISP Accreditation & Compliance Support

DISP stands for the Defence Industry Security Program, the Australian Department of Defence’s membership-based program for entities working on Defence contracts, tenders and projects.

DISP (the Defence Industry Security Program) is a membership program run by the Australian Department of Defence that helps industry entities understand and meet their security obligations when engaging in Defence tenders, contracts and projects.

It is administered under the Defence Security Principles Framework (DSPF), Principle 16, Control 16.1, and sets requirements across four security domains: security governance, personnel security, physical security, and information and cyber security.

Membership gives Defence assurance that suppliers can protect Defence people, information and assets. There is no membership fee, but members must implement and maintain the required security measures. According to Defence’s August 2025 program overview, DISP had over 1,400 accredited members, with membership expected to grow toward 2,000.

DISP membership is mandatory for entities working on PROTECTED or higher classified Defence material, supplying, storing or transporting weapons or explosive ordinance, or providing security services to Defence facilities.

Beyond these mandatory cases, many other Defence contracts specify DISP membership as a tender requirement, so businesses working with Defence should check the individual contract or tender for its DISP requirement.

Australian legal entities may apply, provided they can meet Defence’s eligibility, governance, security and suitability requirements. DISP membership is available to Australian legal entities only. Where an entity has an overseas parent company or is subject to foreign ownership or control, these arrangements may need to be addressed through the entity’s Foreign Ownership, Control or Influence (FOCI) declaration and any associated mitigation measures.

At a minimum, an entity must be registered in Australia with an ABN or ACN, be financially solvent, nominate a Chief Security Officer (CSO) and Security Officer (SO), be capable of obtaining the required security clearances, satisfy FOCI requirements, and meet ASD Essential Eight Maturity Level 2 requirements for ICT systems used to communicate with Defence.

FOCI requirements assess whether foreign interests could affect an entity’s ability to protect Defence information, assets or contracts. Entities are also subject to sanctions screening, terrorism checks and review against the DFAT Consolidated List.

DISP has four membership levels that align with the Australian Government information classifications: Entry Level (OFFICIAL and OFFICIAL: Sensitive), Level 1 (PROTECTED), Level 2 (SECRET) and Level 3 (TOP SECRET).

Members select a level in each of the four security domains – security governance, personnel security, physical security, and information and cyber security – based on the work they undertake. An entity can hold different levels across domains, but the security governance level must always equal the highest level held in any other domain. Clearance sponsorship is not available at Entry Level, and applications for Levels 1–3 require a supporting business case.

DISP members have ongoing reporting obligations set out in DSPF Control 16.1. The two core reporting activities are the Annual Security Report (ASR) – a self-attestation of compliance submitted through the DISP Member Portal within 10 business days of the anniversary of the membership grant date – and Change in Circumstance (CiC) reports, lodged as changes arise.

Reportable changes include changes to the CSO or SO (within 14 business days), FOCI status, Defence contracts, facility or ICT accreditations, and cyber posture. Members must also report security incidents and suspicious contacts, maintain security registers (including a Designated Security Assessed Positions list), and engage with Defence assurance activities such as Ongoing Suitability Assessments and deep dive audits.

Applications are made through the online DISP Member Portal, in six broad stages:

1. Confirm eligibility and business need – establish whether membership is mandatory for your contracts or a business requirement, and which domains and levels apply.
2. Appoint a CSO and SO – nominate a Chief Security Officer and Security Officer, each of whom will need an Australian Government Digital ID linked to the entity through the Relationship Authorisation Manager (RAM).
3. Assess required domain levels – determine the level needed in each of the four security domains (governance, personnel, physical, and information and cyber security) based on the work you’ll undertake.
4. Prepare governance, personnel, physical and cyber evidence – establish a DISP@ entity email address hosted in Australia and prepare supporting documentation using Defence’s DISP Membership Requirements Checklist.
5. Submit through the portal – the SO completes the nine-section application (entity details, officers, contracts, physical and ICT security, membership levels, FOCI, the cyber questionnaire, and attachments), the CSO reviews and declares, and the SO submits.
6. Respond to Defence queries or remediation – Defence may come back with questions or ask for evidence to be corrected before granting membership.

As a guide, Defence’s “Applying for DISP Membership” factsheet (February 2025) indicates processing typically takes 2–3 months for Entry Level and 4–6 months for Levels 1, 2 and 3, assuming required clearances, certifications and accreditations are already held. Actual timeframes depend on the completeness of the application and Defence’s current processing volumes.