The DISP cyber security questionnaire: preparing your Essential Eight evidence

Royal Australian Air Force F/A-18F Super Hornet flying above the clouds, illustrating the DISP cyber security questionnaire.

Each year, Defence Industry Security Program (DISP) members complete an Annual Security Report (ASR). Part of that report is the DISP cyber security questionnaire (CSQ), which asks how your business protects the systems it uses to work with Defence.

The questionnaire is technical by nature. Owners and security officers often know the business well but rely on an internal information technology (IT) team or an external provider for the detail. When those people are brought in late, answers can end up brief or inconsistent, and the questionnaire takes longer than it should.

Defence’s guide, Completing the Cyber Security Questionnaire through the Annual Security Report, shows where the questionnaire sits in the DISP Member Portal and how to move through it. This article explains what it’s testing, what each part covers and how to prepare. For wider membership support, see our DISP membership support page.

Why the questionnaire exists

Defence points out that holding Defence-related information makes members an attractive target for cyber threat actors. Its DISP Essential 8 Cyber Standards Uplift Program aims to align DISP with current recommendations from the Australian Signals Directorate (ASD), and widens the DISP cyber standard to the full Essential Eight at Maturity Level Two.

Defence’s current policy (May 2026) and member requirements factsheet (August 2026) state the requirement directly: every member must meet or exceed the Essential Eight at Maturity Level Two across all corporate systems used to correspond with Defence.

If you already work to another standard, such as the international standard ISO/IEC 27001:2022, the US standard NIST SP 800-171 or the UK’s Def Stan 05-138, that documentation can help show part of your position. Defence is clear that these standards aren’t equivalent to the Essential Eight, so you still need to show how you meet every strategy in the questionnaire.

Where the DISP cyber security questionnaire sits in the ASR

The ASR has several sections, and cyber security is one of them. Defence’s guide works through the earlier sections first, then opens the questionnaire from the cyber security section. You read an introductory page, then complete two parts, Part A and Part B. Each part has its own preview and submit step.

For the exact screens and buttons, use Defence’s guide. It also notes that the portal is still developing, so some details may change.

What has changed since the guide was published

Defence’s guide dates from November 2024. The core expectation, the full Essential Eight at Maturity Level Two, is the same in Defence’s newer documents, which add some detail. The requirement now explicitly covers all corporate systems used to correspond with Defence, and Defence notes that if ASD updates or replaces the Essential Eight, DISP requirements will follow the latest version.

The guide’s screenshots also show the ASR panel referring to completion within ten business days of the membership grant date. Current policy sets the due date as the anniversary of the grant, so check the date shown against your report in the portal.

Part A: your organisation and systems

Part A sets the context. After reading the overview, you confirm you want to continue with the assessment, then work through these areas:

Organisation and system information, such as how your corporate network is set up and whether any subsidiaries use it to correspond with Defence.
Supply chain and third-party managed service providers.
Cyber security governance.
Cyber security personnel.
Cyber security physical controls.
Responding to cyber incidents.

If an outside provider manages your IT, the supply chain section is where that relationship comes into view. Have your provider’s details, their role and any relevant agreements to hand.

Part B: the eight mitigation strategies

Part B assesses how well your business meets Maturity Level Two for each Essential Eight strategy. Defence uses it to judge your cyber hygiene and posture and to understand your risk profile against DISP requirements. It works through each strategy in turn:

Application control.
Patching applications.
Patching operating systems.
Restricting administrative privileges.
Configuring Microsoft Office macro settings.
User application hardening.
Multi-factor authentication.
Regular backups.

Each strategy has its own requirements at Maturity Level Two. ASD’s Essential Eight Maturity Model sets these out, and it’s the best reference for what a complete answer needs to show.

Defence’s application guide describes a four-step rating for overall cyber hygiene: ad hoc, developing, managing and embedded. It’s a useful way to think about where your business sits today.

Preparing evidence that holds up

The questionnaire works best when answers describe what is in place now and point to how you know. A few habits help:

Describe current controls in plain terms, and say clearly where something is planned or partly in place.
Keep answers consistent between Part A and Part B, especially on which systems are in scope.
Link each answer to evidence you could produce if asked, such as reports, configuration records or policies.
Include cloud services and mobile devices used for Defence correspondence, since Defence’s questionnaires ask about both.
Record any gaps alongside a realistic plan and owner for closing them.

This matters beyond the ASR. Defence’s assurance activities, such as Ongoing Suitability Assessments, also involve a cyber questionnaire, so well-organised evidence serves more than one purpose.

Questions to work through with your IT team

Before you open the questionnaire, agree answers to these points:

Confirm which systems, services and devices are used to correspond with Defence.
Identify who manages each system, including any managed service provider.
Assess where each Essential Eight strategy sits against Maturity Level Two today.
Gather the evidence that supports each answer.
List known gaps, with a plan and timeframe for each.

Getting the cyber section right

The questionnaire is easier for businesses that treat the Essential Eight as ongoing work. Our Essential Eight audit article explains how a structured review works in practice, and our IT security assessments can give you a clear view of where your controls stand before you answer. We’re ISO 27001 certified, and we help DISP members with Essential Eight uplift, security documentation and ongoing membership support.

How do we get started?

If your ASR is approaching, or you’re not sure how your systems measure up, a short conversation is a sensible first step. Get in touch with our team and we’ll talk through where you’re at.

DISP