Who must comply with Defence Industry Security Program (DISP)?

Defence contractors handling classified info must be DISP-accredited at appropriate level.

The Defence Industry Security Program is Defence's membership-based security program for industry, underpinned by the Defence Security Principles Framework (Principle 16, Control 16.1). It has four membership levels aligned to government security classifications: Entry level (OFFICIAL and OFFICIAL: Sensitive), Level 1 (PROTECTED), Level 2 (SECRET) and Level 3 (TOP SECRET), each assessed across four domains: security governance, personnel security, physical security, and ICT and cyber security. Applicants self-nominate the level they need and must justify higher levels. Members must meet ASD's Essential Eight at Maturity Level 2 across corporate ICT systems used to correspond with Defence, and screen staff to AS 4811:2022. There is no membership fee, but certification, clearances and physical security carry costs, and membership does not of itself secure Defence contracts, which remain subject to normal procurement.

Applies only if you supply Defence. Whether it applies turns on a fact that no industry, structure or size settles on its own.

How the regulator frames it: Australian entities that work on classified information or assets (PROTECTED and above), supply, maintain, store or transport weapons or explosive ordnance, provide security services for Defence bases or facilities, or whose Defence contract requires membership. Exceptions apply where classified work is done only inside Defence facilities or on Defence networks, or the entity is recognised under a Security of Information Agreement or Arrangement. Membership is open to, and recommended for, any Australian entity seeking to join the Defence supply chain.

What triggers it: Tendering for or performing a Defence contract that involves classified information, weapons or explosive ordnance, or base security, or a contract clause requiring DISP membership.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a trigger outside this questionnaire.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business supplies government customers: it becomes worth checking, because it applies only if you supply Defence.

The engine shows this obligation as "check whether this applies" when a business has government customers and industry: Manufacturing / Software & SaaS / Professional services (general) / Aviation (incl. drones) / Maritime & ports. It then applies only if you supply Defence. That fact is not something Rules Mate can infer from industry, structure or size.

When due

Before the classified work or contract begins; ongoing reporting documents are submitted for membership management, and a Foreign Ownership, Control or Influence (FOCI) declaration is lodged with the application and again whenever FOCI status changes.

Frequency

Ongoing

Evidence to keep

ABN or ACN and evidence of financial solvency; a Chief Security Officer (a director or senior executive) and a Security Officer able to obtain security clearances and a Digital ID; FOCI declaration covering foreign directors, shareholders, revenue and agreements; security governance documents and incident reporting; Essential Eight ML2 assessment (ISO/IEC 27001, NIST SP 800-171 or Def Stan 5-138 documentation can help); AS 4811:2022 workforce screening records; facility certification and accreditation.

Status

Current

Priority

High

Maximum penalty: DISP is a contractual and policy requirement rather than a statute, so there is no statutory fine for non-membership; an entity without the required membership cannot perform the classified or mandated Defence work, and members must keep meeting the security standards for their level to retain it.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• Defence Trade Controls Act — export of controlled goods + tech: Defence + dual-use goods + technology export-controlled — permit required.

Rules Mate tracks 2 published obligations tagged "defence", 0 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting