Completing the DISP membership application form: what each section needs

Royal Australian Navy MH-60R Seahawk helicopter at an Australian airshow, illustrating the DISP membership application form.

Once your officers can sign in to the Defence Industry Security Program (DISP) member portal, the next step is the DISP membership application form itself. Your Security Officer (SO) completes it online, with review from your Chief Security Officer (CSO).

The form draws on information held by different people. Ownership details often sit with finance, contract details with project leads, and cyber answers with your information technology (IT) team or provider. Applications tend to slow down when one of those inputs arrives late, or when an answer doesn’t match what Defence can see in other records.

Defence’s How to Complete a DISP Membership Application guide shows each screen in detail, so use it for the exact steps. This article covers what each section needs and where gaps appear. If you’re still deciding whether to apply or which level to choose, start with our guide to applying for DISP membership, and see our DISP membership support page for how we help.

Before you open the DISP membership application form

A few things are worth knowing before you start:

Only one SO per business has edit access. The CSO can sign in and view the application but can’t change it, so plan review sessions together.
Questions use drop-down menus (which can reveal follow-up questions), tables, search boxes and free-text fields.
Free-text answers are limited to 4,000 characters. If you need more, add a note and attach a supporting document.
Mandatory fields are marked. Optional fields give processing officers more context and may help your application move faster.
Save before moving between sections or signing out.

The form has nine sections, shown in a progress menu down the side of the page.

Entity details

This section confirms who you are. Your Australian Business Number (ABN) and business details are pre-filled from myID, Relationship Authorisation Manager (RAM) and the Australian Business Register, and can’t be edited in the portal. If something is wrong, it needs to be fixed at the source.

You’ll also verify your DISP@ email address by entering a code sent to that mailbox. This only needs to be done once, so the mailbox must be set up and working before you start. If the code doesn’t arrive, check the address and your junk folder.

Other information in this section includes:

Your registered head office address, which must match the Australian Securities and Investments Commission (ASIC) register.
Whether you hold a Defence contract to deliver a Sovereign Industrial Capability (only answer yes if you do).
Any other states or territories where you trade.
The Defence domains (Information and Cyber, Maritime, Land, Air and Space) and capabilities that match what you’ll supply.
Staff numbers, and faculty or research details for universities.

If you’re unsure which domain or capability fits, your Defence Contract Manager or the DISP team can help.

Officer details

Your own name is pre-filled based on the role you chose in your profile. If you hold only the SO role, you’ll enter the CSO’s details. The CSO’s email address must match the one on their myID exactly, so check it carefully. If your business has several SOs, record only the one with edit access.

Contracts and panels

This section describes your Defence work and helps confirm your required level. You must record any Defence contract that lists DISP membership as a requirement, involves PROTECTED or higher information or assets, or relates to weapons or explosive ordnance, security services for Defence bases, or the shipbuilding supply chain.

If you hold many contracts, list the most relevant ones and check with your Contract Manager if unsure. The Defence representatives you record will be emailed to confirm your required level, so it helps to let them know it’s coming and to check their contact details are current.

Physical and ICT

This section covers your facilities and information and communications technology (ICT) networks. You’ll say whether any facilities are already certified or accredited by Defence, whether you know you’ll need that, and the accreditation status of your ICT networks. Where accreditation exists, the evidence goes in the Attachments section.

If you have no existing or required facility accreditation, Defence asks you to choose Entry Level for physical security. The same applies to information and cyber security if your networks aren’t accredited.

Membership levels

You choose a level for each security domain. Unless you already hold Defence accreditation or a current contract explicitly needs a higher level, Physical and Information and Cyber should be Entry Level. Governance is set automatically to match your highest level.

Applying for Level 1, 2 or 3 requires a business case as an attachment, and holding a Defence contract isn’t enough on its own. Defence notes that higher levels bring a more demanding assessment and more ongoing governance and cost. Levels can be adjusted after membership is granted.

Foreign ownership, control and influence

The foreign ownership, control and influence (FOCI) part of the form has six sub-sections and replaces an older standalone form, the AE250-1. It can’t be edited once submitted, and its instructions only display once, so read them carefully. Foreign persons include dual citizens.

The sub-sections cover:

Combined foreign holdings, including thresholds of 20 per cent and 40 per cent, and any foreign interest that amounts to control or influence.
Foreign persons in leadership roles, foreign power over appointments or decisions, and managers who hold roles with foreign entities.
Foreign agreements worth 20 per cent or more of last financial year’s revenue, non-monetary arrangements, and obligations above 20 per cent of net worth.
Revenue of 20 per cent or more from a single foreign entity.
Any other factors that show foreign capacity to control or influence the business.

Regardless of your answers, you’ll need to attach information on the financial ownership of your business. Two points need care: holdings are added together across all foreign parties, and several arrangements with the same foreign entity or country count collectively. Involve whoever manages your finances, and have the CSO review before submitting.

Cyber security questionnaire

The cyber security questionnaire (CSQ) is technical, and Defence encourages you to get help from your IT staff or service provider. It can’t be edited after submission.

Part A covers your organisation and systems: which cyber standard your network aligns to, any existing accreditation, the systems you use to correspond with Defence, the protective markings you’ll observe, staff numbers (including those with administrator access), your cyber security staffing and any independent assessment, how you would handle and report a breach, and incidents reported in the past 24 months.

Part B covers cloud services, mobile device and application management, multi-factor authentication and Essential Eight controls such as application control, patching and restricting administrative privileges. Defence rates overall cyber hygiene on a four-step scale from ad hoc to embedded.

The February 2025 guide lists four standards. Defence’s current policy is clear that every member must meet or exceed the Australian Signals Directorate’s Essential Eight at Maturity Level Two across corporate systems used to correspond with Defence. Other standards can help show this in part, but you still need to show how you meet every Essential Eight strategy. Defence notes that incomplete answers or thin information delay applications.

Attachments

The attachments list is built from your answers, and you can’t submit until every mandatory item is uploaded. Typical items include your ownership structure, accreditation certificates, a business case for higher levels and evidence of any independent cyber assessment. Security policies, plans and registers may also be requested, and Defence notes DISP can help with these after submission.

Preview and submit

Review every section, add anything useful in the final free-text field, then validate and submit. Errors must be fixed before you can continue. The CSO then completes a declaration that only they can see. Because the CSO can’t edit anything, their review needs to happen before this point.

Common gaps to check

Before submitting, confirm that:

Your registered address and business details match ASIC and the Australian Business Register.
Your DISP@ mailbox is working and verified.
The CSO’s email matches their myID exactly.
Contract Manager details are current and they expect contact from DISP.
Foreign holdings and arrangements have been added together correctly.
Cyber answers describe current controls and point to evidence.

Getting help with the form

Much of the form draws on your IT environment. Our IT consulting team helps businesses gather that information, prepare cyber questionnaire responses and plan Essential Eight uplift where it’s needed.

How do we get started?

If you’d like a second set of eyes on your application before it goes to your CSO, we can help. Contact our team for a short, no-pressure conversation about where you’re up to.

DISP