DISP levels and member requirements: What Defence expects once you join

RAAF Roulettes flying in formation at an Australian airshow, illustrating the DISP levels available to Defence suppliers.

Being granted membership of the Defence Industry Security Program (DISP) is a milestone, and most of the ongoing work starts from there. Defence expects members to keep their security arrangements current, report changes, train their people and take part in audits.

For owners and security staff in smaller businesses, it can be hard to see how those obligations fit together and which ones change with your membership level.

Defence’s August 2026 factsheet on the requirements of a DISP member brings the ongoing obligations into one place. This article explains how DISP levels work, what changes as you move up, and what every member needs to keep doing.

How DISP levels work

DISP membership is set across four security domains: governance, personnel security, physical security, and information and cyber security. Each domain has four levels that line up with Australian Government security classifications.

Entry Level covers OFFICIAL and OFFICIAL: Sensitive information.
Level 1 covers PROTECTED information.
Level 2 covers SECRET information.
Level 3 covers TOP SECRET information.

You can hold different levels in different domains, based on what the business needs. Your governance level must equal the highest level you hold in any of the other three. Defence asks for a business case for Levels 1 to 3, and its application guidance says a Defence contract alone is not enough justification. New applicants are generally asked to choose Entry Level for physical and cyber security unless they already hold Defence accreditation or a current contract explicitly requires more.

The level structure is set out in the Defence Security Principles Framework (DSPF) and Defence’s application guidance, while the factsheet focuses on what members must do. If you are still working out where your business fits, our DISP membership support page explains how we help before and after you apply.

What changes as DISP levels go up

Most obligations apply to every member. A few scale with your level.

Your Chief Security Officer (CSO) and Security Officer (SO) must hold and maintain the security clearance required for your membership level. Any clearances the business sponsors must also be in line with the level you hold.

Sponsorship has its own limits. Whoever sponsors clearances must hold at least a Negative Vetting Level 1 (NV1) clearance, so a Baseline clearance holder cannot sponsor. Sponsors also cannot sponsor above their own clearance, which means an NV1 holder cannot sponsor a Negative Vetting Level 2 (NV2) clearance.

Physical accreditation comes into play once you need to receive or store classified material above OFFICIAL: Sensitive. You need the right level of accreditation from Defence’s accreditation body, and you must meet the physical security requirements in the Australian Security Intelligence Organisation (ASIO) Technical Notes. Defence notes that endorsement of a facility by the Security Construction and Equipment Committee (SCEC) is not enough on its own to hold PROTECTED material or above.

Cyber security is the notable exception. Every member, at every level, must meet or exceed the Australian Signals Directorate (ASD) Essential Eight at Maturity Level 2 across the corporate information and communications technology (ICT) systems used to correspond with Defence.

Governance and reporting obligations

DISP is governed by DSPF Principle 16 and Control 16.1, together with related requirements in the Protective Security Policy Framework (PSPF) and the Information Security Manual (ISM). Those documents change over time, and members are responsible for keeping their own policies, procedures and processes aligned with the current versions.

The main governance obligations are:

The CSO and SO keep their clearances current and complete the Security Officer training course every three years.
Someone monitors the DISP email address regularly and responds to Defence’s requests promptly.
The business submits its Annual Security Report (ASR) through the DISP Member Portal on the anniversary of its membership.
An Australian board, or a board equivalent made up of Australian citizens, agrees to the ASR and any recommendations before it goes to Defence.
The business reports security incidents to Defence on an XP188 form within 24 hours of the incident happening or becoming known, and records them in its security register.

The ASR is easier when evidence is gathered through the year. Defence suggests assurance activities such as checking your Designated Security Assessed Positions (DSAP) register against new starter and leaver lists and clearance records, completing overseas travel briefings and debriefs, running new starter briefings and exit debriefs, confirming training is current, and checking that Defence-engaged staff have acknowledged your security policies and plans each year.

People, training and clearances

All security cleared and Defence-engaged personnel, including contractors, must complete Defence-endorsed Annual Security Awareness Training (ASAT) every 12 months. Defence lists its endorsed training options, and a business can run its own course if the relevant Defence branch endorses it. Either way, you need a way to track completion and keep evidence.

Members also need an insider threat program that suits their size, operating environment and risk profile. At a minimum, it should cover governance and accountability, awareness activities for cleared and Defence-engaged staff, clear reporting and escalation paths, and links to personnel security, incident reporting and risk management.

The DSAP register records every Defence position that needs a clearance, with the level required. Some roles do not need classified access but carry enough responsibility that misuse could cause Defence significant harm or reputational damage. Defence expects those roles to be recorded as DSAP too, with your reasoning or risk assessment.

If you sponsor clearances, you also manage the people who hold them. That includes briefing them on their responsibilities, managing any clearance granted with an eligibility waiver, watching for concerning behaviour or attitudes towards security, making sure they take part in training, reporting concerns to the Australian Government Security Vetting Agency (AGSVA), and making sure staff report changes in their personal circumstances. Withdraw sponsorship when it is no longer needed, and deactivate or reactivate clearances between Defence engagements.

Information, cyber and data

Defence information must be handled according to its classification. The DSPF and Defence’s guide to assessing and protecting official information cover handling, copying, disposal and transfer, and a separate DSPF control governs the release of OFFICIAL and OFFICIAL: Sensitive material.

Two email and data requirements are worth checking early:

Your DISP email must be a central address in the form DISP@yourdomain that is not attached to one person, and web-based mail services such as Google or Yahoo are not accepted.
The email system used for DISP must be hosted in Australia, and Defence data must not be stored or processed in places where foreign governments have ways to access it.

CSOs and SOs can also ask Defence for access to the DISP Security Portal, which holds the DSPF, factsheets and training packages. It is separate from the DISP Member Portal used for reporting.

Suppliers, audits and changes

Members are expected to manage security risk across the life of each supplier arrangement. That covers assessing potential suppliers, applying controls such as passing Defence contract terms down and allowing audits, requiring suppliers to report actual or suspected incidents to you, and handling the return or destruction of Defence assets when an arrangement ends.

Members must also take part in Ongoing Suitability Assessments (OSAs) and Deep Dive Audits (DDAs), and fix any recommendations within a timeframe agreed with Defence. An independent IT audit can test your controls beforehand.

Many changes must be reported. These include a change of CSO or SO within 14 days, changes in ownership or control, key personnel, financial position, international supply chain activity, foreign partnerships, dealings or staff, business name, locations and DISP email, contract requirements, major network changes, and a decision to withdraw from DISP. Many of these can be lodged as a Change in Circumstance report in the DISP Member Portal.

A short DISP levels and obligations check

Confirm the level you hold in each domain and that your governance level matches the highest.
Check that your CSO and SO clearances suit your level and their training is less than three years old.
Put your ASR anniversary in the calendar and schedule assurance activities through the year.
Confirm every Defence-engaged person has completed ASAT in the last 12 months.
Review your insider threat program, DSAP register and supplier arrangements.
Test your Essential Eight maturity across the systems you use with Defence.

Keeping membership steady over time

DISP obligations are easier to meet when they sit in the normal business calendar, with a clear owner, a yearly plan and good records. For answers to common questions, see our DISP FAQ.

Where to from here?

If you’d like a second view on your obligations, we’re happy to help. We are ISO 27001 and ISO 9001 certified, and we work with Defence suppliers on security documentation, Essential Eight uplift and ongoing membership support. Contact our team for a short, no-pressure conversation.

DISP