DISP membership requirements: How to use Defence’s checklist to find your gaps

HMAS Canberra berthed at Garden Island in Sydney, representing the DISP membership requirements Defence suppliers need to meet.

Many Australian businesses start looking at the Defence Industry Security Program (DISP) when a Defence opportunity comes up. A prime contractor asks whether you are a member, a tender lists membership as a condition, or a customer starts asking more detailed security questions.

At that point, it is often hard to tell which parts of the program need to be in place before you apply, and which parts Defence will help you build later.

Defence’s DISP membership requirements checklist is designed to answer that question. Used well, it gives you a clearer view of the level you need, the evidence you already hold and the gaps to close before you submit.

What the checklist is for

The checklist is a short table of yes or no questions, each with a comment on what Defence expects. It helps you judge how closely the business meets the DISP membership requirements for your chosen level, and what still needs work.

The questions are grouped into four areas: governance, personnel security, physical security, and information and cyber security. These are the domains DISP uses to set membership levels, so the checklist also helps you choose a level for each.

You can download Defence’s DISP membership requirements checklist from the DISP website. It was published in 2023, so we have noted where newer Defence guidance has changed the detail. Our DISP membership support page explains how we help businesses through the program.

Governance: what must be in place before you apply

Governance covers who is accountable for security. Several items must exist before you submit.

You need a nominated Chief Security Officer (CSO) who is accountable for the security of the business.
You need a nominated Security Officer (SO), who can be the same person as the CSO.
Your security policies and plans need to be documented for your membership level, kept up to date and available to Defence on request.
You need a documented process for your governing body, through the CSO, to approve and submit the Annual Security Report (ASR) each year.
If you are applying for Level 1 or above in personnel security, you need a register of Designated Security Assessed Positions (DSAP), which are roles that need access to classified material.

Defence provides templates for security policies and plans, the ASR and a security register that includes a DSAP section. You will find them in the Security Officer toolkit on the DISP resources page.

Other items are more flexible at the application stage. The checklist says you can still apply, with Defence’s help, if your CSO or SO has no clearance yet, or if you do not yet have a security awareness program, an insider threat awareness program, or a register of incidents, contact reports and travel briefings.

Newer guidance is firmer on some of these. Defence’s February 2025 application factsheet says membership will not be granted until the CSO and SO hold their clearances, and its August 2026 member requirements factsheet treats security awareness training and an insider threat program as ongoing obligations. It makes sense to plan for them early.

Personnel security: screening, clearances and sponsorship

Personnel security covers how you screen staff and whether the business needs to manage security clearances itself.

From the time you apply, your employment screening needs to meet or exceed Australian Standard AS 4811, and this must be documented before you submit. The 2023 checklist refers to the 2006 edition of the standard. More recent Defence guidance refers to AS 4811-2022, so we suggest working to the current edition.

You also need a documented process showing how the SO will support clearance holders. That includes help with change of circumstance forms, security reports and overseas travel briefings.

Staff working in a Defence establishment will need whatever clearance Defence specifies. Beyond that, your personnel security level depends on whether you need to sponsor clearances:

Entry Level suits businesses that do not need to sponsor clearances, because Defence or another government agency sponsors any that are required.
Level 1 suits businesses that need to sponsor clearances at Baseline (PROTECTED) level.
Level 2 suits businesses that need to sponsor clearances up to Negative Vetting Level 1 (NV1), which aligns with SECRET.
Level 3 suits businesses that need to sponsor clearances up to Negative Vetting Level 2 (NV2), which aligns with TOP SECRET.

Later Defence guidance adds a detail worth planning for. Whoever sponsors clearances must hold at least an NV1 clearance and cannot sponsor above their own level.

Physical security: classification and access control

Physical security questions start with the highest classification of information or assets the business needs to use. That answer maps to a level: Entry Level for OFFICIAL and OFFICIAL: Sensitive, Level 1 for PROTECTED, Level 2 for SECRET and Level 3 for TOP SECRET.

Whatever the level, you need a documented access control policy, with permissions that work in practice, before you apply. If third-party suppliers are covered by that access, they must meet the membership requirements for the relevant level, or the prime contractor must manage the risk through a security risk assessment.

Information and cyber security: the standard has moved

The information and cyber questions use the same classification mapping, this time for the information your networks store, process or communicate.

The checklist then asks which cyber standard your corporate network meets. The 2023 version lists four options: the top four strategies of the Australian Signals Directorate (ASD) Essential Eight, the US National Institute of Standards and Technology (NIST) SP 800-171, UK Defence Standard (Def Stan) 05-138, and the international standards ISO/IEC 27001 and 27002.

This is where Defence’s position has changed most. The current Defence Security Principles Framework (DSPF) control for DISP and the August 2026 member requirements factsheet both say members must meet or exceed the Essential Eight at Maturity Level 2 across the corporate information and communications technology (ICT) systems used to correspond with Defence. The DSPF says the other standards can help show part of how you meet the Essential Eight, but it does not treat them as equivalent.

If your planning was based on the older checklist, check your maturity against all eight strategies. An independent IT security assessment gives you a clear starting point and a prioritised list of gaps.

A short DISP membership requirements check

Before you start your application, work through these points.

Confirm your CSO and SO are named and understand what the roles involve.
Check your security policies and plans are written down for the level you are seeking.
Document how your board or governing body will approve the ASR.
Confirm your employment screening meets the current edition of AS 4811.
Decide the level you need in each of the four areas, and record why.
Measure your Essential Eight maturity across the systems you use to work with Defence.

Use the checklist as a working document

The checklist is most useful when you return to it as your preparation progresses. Record your answers and the evidence behind each one, give every gap an owner and a target date, and compare your answers with Defence’s newer guidance.

If you are still deciding where to begin, our article on the starting point for DISP certification covers the first steps. Businesses that do this groundwork first usually find the application far more manageable.

How do we get started?

A short conversation is a practical first step. We’ll talk through where the business is today and the level you are considering. From there, we can help you plan the documentation and cyber controls you need before you apply. Get in touch with our team to start the conversation.

DISP