Preparing your DISP application: What to have in place before you apply

Most businesses apply to the Defence Industry Security Program (DISP) because a Defence opportunity depends on it, which creates pressure to lodge the form quickly.

The online form is one part of a longer process. Defence’s Applying for DISP Membership factsheet describes five stages: learn about the program, choose your membership level, check you can meet the requirements and gather documents, complete the form in the DISP Member Portal, and submit. The first three stages happen before you log in, and they tend to decide how smoothly the rest goes.

We covered the full sequence in our guide to applying for DISP membership. This article focuses on preparation: what to confirm, decide and collect before you start your DISP application.

Confirm you are eligible

Defence’s factsheet lists the baseline conditions. To apply, your business must:

• Be registered in Australia with an Australian Business Number (ABN).
• Be financially solvent.
• Have a Chief Security Officer (CSO) and a Security Officer (SO) who meet Defence’s role requirements and can obtain a Digital ID, such as myID, linked to the business through Relationship Authorisation Manager (RAM).
• Satisfy Defence’s requirements on foreign ownership, control or influence (FOCI).
• Have no relationships with listed terrorist organisations, sanctioned regimes, or people and entities on the Department of Foreign Affairs and Trade (DFAT) Consolidated List.
• Have an information and communications technology (ICT) network that meets Defence’s cyber security standard.

The last point needs care. The February 2025 factsheet lists four accepted standards, including the Australian Signals Directorate (ASD) Essential Eight and ISO/IEC 27001. Defence’s current policy and its August 2026 member requirements factsheet say all members must meet or exceed the ASD Essential Eight at Maturity Level 2 across the corporate systems used to correspond with Defence. We recommend planning your cyber work around that requirement.

A business needs only one DISP membership, however many Defence contracts it holds, and Defence policy says you do not need a contract to become a member. Our DISP membership support page explains how we help businesses check these foundations.

Decide your level in each domain

DISP has four membership levels (Entry Level and Levels 1 to 3) across four domains: personnel security, physical security, information and cyber security, and governance. You choose a level for each domain, and your governance level is the highest level chosen across the other three.

Before you choose, keep Defence’s guidance in mind:

• Levels 1 to 3 need a business case, and holding a Defence contract is not enough justification on its own.
• Choose Entry Level for physical and cyber security unless you already hold Defence certification and accreditation, or a current contract explicitly requires a higher level.
• Higher levels mean longer and more complex assessments, more governance and administration, and higher costs for physical and ICT accreditation.
• To sponsor clearances, your SO needs at least a Negative Vetting Level 1 (NV1) clearance, and members cannot sponsor Positive Vetting (PV) clearances.
• Your level can be upgraded or downgraded after membership is granted.

Get your security people ready

Only one person can work on the application in the portal, and that person must be an SO. The CSO cannot edit it, but must review the full application and complete a declaration before it is submitted, so the two roles need to coordinate from the start.

Before you begin, make sure:

• Both the CSO and SO have a Digital ID and are linked to the business in RAM.
• The SO has their clearance details ready, including their clearance ID (CSID) from myClearance or emails from the Australian Government Security Vetting Agency (AGSVA), and the date it was granted.
• The SO has their Security Officer Training status, completion date and certificate, if they have completed it.
• Staff who hold information the SO will need, such as finance or IT, know they will be asked for input.

You can apply before your CSO and SO have clearances or have completed training. Defence notes that membership will not be granted until both hold their clearances and have confirmed their intent to complete the training.

Gather your DISP application documents

Defence treats two items as mandatory: the applicant’s clearance and training details (where they exist), and a statement, list or chart showing the financial ownership of the business. The ownership document should cover parent companies and their affiliates, ultimate beneficiaries, joint ventures, limited partnerships and subsidiaries.

All business details should match the Australian Securities and Investments Commission (ASIC) register, particularly your registered address and your ABN or Australian Company Number (ACN).

Depending on your level and answers, Defence may also ask for evidence of:

• Security policies and plans.
• An annual security awareness program and insider threat awareness for all staff.
• Employment practices that meet Australian Standard AS 4811-2022.
• A process for your governing body, through the CSO, to approve Annual Security Reports.
• Policies showing you will carry out regular security risk assessments.
• A Designated Security Assessed Position (DSAP) list and a security register covering travel, incidents and training.
• ICT accreditation, depending on your Cyber Security Questionnaire answers, and facility accreditation for physical security at Levels 1 to 3.

If a Defence contract requires you to hold membership, the Defence contract manager also needs to confirm that engagement. The factsheet refers to a form for this, while Defence’s current policy points contract managers to an online notification, so confirm the current process with your contract manager.

Defence says it can help you create documents after you submit, but drafts reduce the back and forth. Defence policy also notes that if it requests more information and does not receive it within 75 days, the application becomes inactive until it arrives. Defence’s DISP Membership Requirements Checklist, on the DISP resources page, is a useful way to test your answers first.

Check your systems and mailbox

Two technical items come up during the application: your DISP@ email address, which should be set up, hosted in Australia and monitored before you apply, and the Cyber Security Questionnaire, which asks how your systems meet the Essential Eight. An IT security assessment before you apply gives you accurate answers and a clear list of gaps.

Before you press submit

Once submitted, the application cannot be edited, so allow time for a full review.

After submission, Defence triages applications. Priority factors include holding, tendering for or negotiating a Defence contract or panel, and being part of the shipbuilding supply chain. A DISP Processing Officer then becomes your main contact. Where clearances, certifications and accreditations are already in place, Defence expects processing to take around two to three months for Entry Level and four to six months for Levels 1 to 3, depending on complexity.

While you wait, Defence recommends subscribing to the Australian Security Intelligence Organisation (ASIO) Outreach program and the Australian Cyber Security Centre (ACSC) Partnership program.

A short DISP application readiness check

• Confirm your ABN, ACN and address match the ASIC register.
• Confirm your CSO and SO have Digital IDs linked through RAM.
• Agree your level for each domain, with a written reason for anything above Entry Level.
• Prepare your ownership chart and your clearance and training details.
• Draft or update your security policies, plans, DSAP list and security register.
• Check your Essential Eight maturity and test your DISP@ mailbox.

Where to from here?

If you’d like help getting your application ready, we can work through the preparation with you, from documentation to cyber controls and mailbox setup. Get in touch and we’ll start with a short conversation about where the business is today.