DISP explained: defence industry security for SMEs

What DISP is, and why it decides who can bid

The Defence Industry Security Program (DISP) is the Department of Defence's framework for making sure the businesses it works with can protect Defence people, information and assets. Membership is Defence's way of verifying that your company, not just your product, meets its security expectations before you handle anything sensitive.

Here's why it matters commercially: most Defence contracts, and most subcontracts under the major primes, effectively require DISP membership or the demonstrated ability to obtain it. Tender documents ask for your DISP status directly. Prime contractors flowing work down through their supply chains ask for it before they'll shortlist you. Without it, you're not competing on capability or price, you're simply not eligible for the conversation.

With $330B+ of investment flowing into Australian defence capability over the decade, the prize for getting security-ready is real. But the order of operations is unforgiving: security status first, tender second. Businesses that discover this mid-bid rarely recover the tender.

How membership is structured

DISP membership is tiered. There's an entry level suited to businesses working with Official-level information and services, and higher levels tied to more sensitive work. The level you need depends entirely on what the contracts you're chasing require, and the RFT or the prime will tell you.

Whatever the level, Defence assesses members across four security categories:

• Security governance. Accountable security roles inside your business, policies, and a culture of reporting. Defence wants named people responsible for security, not a folder of documents nobody owns.
• Personnel security. How you vet, manage and offboard the people who will touch Defence work, including eligibility for security clearances where the work demands them.
• Physical security. How your premises, and any Defence material in them, are protected.
• Information and cyber security. How your ICT systems handle, store and transmit information, the category where most SMEs have the most work to do.

Deliberately, we're keeping this general. Entry requirements, evidence, and processes are set by Defence and they change. The authoritative source is the official Defence security site at defence.gov.au/security/industry , read the current requirements there before you plan anything around what a guide (including this one) tells you.

Sponsorship, and how SMEs typically start

Most SMEs enter at the base membership level, which is designed to be achievable for a well-run small business and covers the majority of unclassified but security-relevant work. Higher levels are generally pursued when a specific contract, program or sponsor requires them, you don't collect security levels for their own sake, you obtain the level the work demands.

Sponsorship is the other pathway question. Depending on the level and the nature of the work, an application may need backing from a Defence entity or flow from a contractual requirement, often a prime contractor that wants you in its supply chain. This is one of the strongest arguments for building prime relationships early: a prime that wants your capability becomes an advocate for your security uplift, and its supplier development teams have walked dozens of SMEs through the same journey.

The practical starting point for most SMEs is honest self-assessment against the four categories above. Governance and cyber are usually the gaps. Both are fixable, but neither is fixable in the final weeks before a tender closes.

Where DISP meets ASDEFCON and AIC plans

Defence buys through a suite of standardised tendering and contracting templates known as ASDEFCON. If you bid on Defence work, you'll meet them, and their security requirements aren't an attachment, they're woven through the conditions of tender and the draft contract. Tender schedules ask you to state your DISP membership status and level, and to describe how you'll meet the security obligations of the work. "We intend to apply" scores very differently from "we hold membership."

Then there's AIC. An Australian Industry Capability (AIC) plan is the mechanism by which prime contractors commit to involving Australian businesses in the work they win. Primes are assessed on those commitments, which means they are actively looking for capable, security-ready Australian SMEs to name in their plans. That's your way in, but a prime can't credibly commit work to a business that can't pass the security gate. DISP-ready SMEs get named in AIC plans; the rest get sympathy.

Our defence industry page covers how we position clients across ASDEFCON tenders and prime supply chains.

The mistakes that cost SMEs defence work

Bidding before checking DISP eligibility. The most expensive mistake in defence tendering. If the RFT requires a membership level you don't hold and can't realistically obtain, your bid is non-conforming, disqualified regardless of how good your solution is. Check the security requirements the day the tender lands, before anyone starts writing. It's the first thing we check in every go / no-go review.

Boilerplate security plans. Evaluators read security responses copied from templates every week, and they mark them accordingly. A credible response names your security officers, describes your actual systems and premises, and maps your controls to this contract's requirements. Generic assurance reads as generic risk.

Treating security as a post-award problem. Some businesses plan to "sort out DISP if we win." Defence contracts don't work that way, eligibility is assessed at tender, and the obligations start at contract signature, not at your convenience.

Underestimating the cyber category. For most SMEs, information and cyber security is the category needing the most genuine uplift. Starting that work when a tender is already live means submitting promises instead of evidence.