The DISP chief security officer and security officer: Who does what

HMAS Sydney berthed at Garden Island in Sydney, representing the DISP chief security officer's accountability for security.

Every business in the Defence Industry Security Program (DISP) needs two named security roles: a Chief Security Officer (CSO) and a Security Officer (SO). You need both in place to apply for membership and to keep it.

In a small business, these roles often fall to people who already have full workloads, such as the owner and an operations or IT lead. The titles sound similar, and it is not always clear where one role ends and the other begins.

Defence’s CSO and SO roles and responsibilities factsheet sets out that division. This article explains what the DISP chief security officer and the SO each do, where they share responsibility, and what to think about when you appoint them.

What Defence requires of both roles

Both the CSO and SO must be Australian citizens. Each must be able to obtain and keep a personal security clearance from the Australian Government Security Vetting Agency (AGSVA) at the level that matches your DISP membership. Defence will sponsor those clearances where required.

Depending on the size and needs of the business, one person can hold both roles, and many small businesses start that way. A business can have only one CSO, but it can appoint more than one SO.

If you are still deciding whether DISP is right for you, our DISP membership support page outlines how we help businesses through the process.

The DISP chief security officer role

The CSO is a senior executive who is responsible for the business’s security arrangements and for championing a positive security culture. They can delegate day-to-day protective security work to the SO, while remaining accountable for security overall.

To qualify, the CSO must belong to at least one of the business’s Australian leadership groups: the board of directors or a similar governing body, the executive, a partnership group or senior management. They also need the authority to put policy in place and direct resources.

The CSO’s responsibilities include:

Reviewing the membership application and completing the declaration in the DISP Member Portal.
Meeting every obligation in the Defence Security Principles Framework (DSPF) for the business’s membership level.
Reporting any change in circumstances that could affect membership, including changes in ownership and control.
Running an appropriate system of risk oversight and management, and giving the board oversight of the security register.
Meeting DISP reporting obligations, including submitting the Annual Security Report (ASR).
Making sure security training is available to all staff.

In the portal, the SO prepares entries and the CSO reviews and declares them. The CSO does not start or edit any submission, and does not have edit access to the application.

The current DSPF control adds two points. The CSO’s clearance must match the membership level, so a Level 3 member needs a CSO with a Negative Vetting Level 2 (NV2) clearance. The CSO must also complete the DISP Security Officer Training course as part of the application and every three years after that.

The security officer role

The SO develops and puts in place the business’s security policies and plans, acting on behalf of the CSO. In the portal, the SO starts and edits entries and submits them to the CSO. The SO does not approve or declare submissions.

The SO’s responsibilities include:

Completing the DISP membership application, which only one SO can access.
Developing and applying security policies and plans.
Keeping the Designated Security Assessed Positions (DSAP) list and the security register, including incident reports, contact reports and overseas travel briefings, ready for Defence on request.
Sponsoring, managing and withdrawing clearances, where the SO holds at least a Negative Vetting Level 1 (NV1) clearance and the business has the right membership level.
Supporting clearance holders with change of circumstance notifications, incident and contact reports, and overseas travel briefings.
Arranging Defence-mandated security education for staff on Defence work, and making sure all staff complete security training, including on insider threats.
Meeting the physical security requirements in DSPF Principle 72.

Shared responsibilities

Some duties sit with both roles. Together, the CSO and SO are responsible for:

Complying with the requirements of DISP membership.
Completing Defence’s security training course, with a refresher every three years.
Responding to security incidents and reporting them to Defence as soon as possible.
Taking part in an interview with Defence to confirm they understand their security obligations.
Protecting official, sensitive and classified material in line with DSPF requirements at all times.
Telling Defence about any change of CSO or SO through a Change in Circumstance in the DISP Member Portal.

On training, the factsheet notes that a Baseline clearance is the minimum needed to attend. You do not need to finish the course before membership is granted, but you must confirm your intent to complete it.

On role changes, the roles factsheet allows 14 business days, while Defence’s August 2026 member requirements factsheet says 14 days. Working to the shorter timeframe is the safer approach.

Choosing the right people

The factsheet sets the minimum. The practical question is who can carry each role well over time.

For the CSO, look for someone with the authority to make decisions and fund security work, and the time to review and question what the SO brings forward. For the SO, look for someone organised and comfortable with process and record keeping, who can work across HR, IT and operations. Both need to be eligible for the clearance your level requires.

Plan for leave and turnover as well. A second SO can provide cover and continuity. Where much of the SO’s work touches IT, our technology leadership and virtual CIO services can support your CSO and SO with planning, controls and reporting, while the roles themselves stay within the business.

A short check before you appoint

Confirm each person is an Australian citizen who can obtain the clearance your level requires.
Confirm your CSO sits on the board, executive, partnership group or senior management and can direct resources.
Make sure your SO has the time and support to keep policies, registers and training records current.
Agree who covers the SO’s duties if they are away or leave.
Make sure both people understand how the portal splits preparing, reviewing and declaring.

How do we get started?

If you’re weighing up who should take on these roles, we’re happy to talk it through. Contact our team and we’ll help you think about the support your CSO and SO will need.

DISP