If your business wants to work with the Australian Department of Defence, sooner or later you will meet DISP. It is the program that sets the security expectations for Defence suppliers. Here is what it covers, how membership is graded, and where backup and recovery fit in.

Key takeaways
  • DISP is the Defence Industry Security Program, administered by the Department of Defence.
  • It spans four security domains: governance, personnel, physical and cyber (ICT).
  • Membership is offered at entry level plus Levels 1 to 3, scaled to the sensitivity of the work.
  • The cyber domain expects Essential Eight alignment, including regular, recoverable backups.

What DISP is for

The Defence Industry Security Program (DISP) gives Australian businesses the security framework they need to do business with Defence. Membership signals that a supplier can appropriately handle Defence people, information and assets. For many Defence contracts and tenders, DISP membership is a precondition rather than a nice-to-have.

The four security domains

DISP organises requirements into four domains:

  • Governance — security leadership, policies, and a Chief Security Officer and Security Officer.
  • Personnel security — clearances, vetting and the management of access to classified material.
  • Physical security — securing the facilities and assets where Defence work happens.
  • Cyber security (ICT) — protecting the systems that store and process Defence information.

Membership levels

DISP offers an entry level plus three graded levels. Higher levels correspond to handling more sensitive information and assets, and bring more demanding controls and oversight. A business applies for the level appropriate to the work it intends to do; you do not need the highest level to participate.

Where backup fits

The cyber domain expects alignment with the ASD Essential Eight and the Information Security Manual. That brings the backup strategy squarely into scope: regular backups of important data and configurations, retained and restoration-tested, and isolated so they survive a compromise. For a supplier, "important data" includes the business records that keep you operating and contractually compliant. A disciplined, independent backup regime is part of demonstrating you can recover from an incident — not just resist one.

Getting ready

Most businesses begin by appointing security officers, documenting policies, and closing Essential Eight gaps — with MFA and backups being the quickest wins. Treat DISP as an operating posture, not a one-off form: it is assessed and maintained over time.