Protective Security strategic planning and implementation support from the most experienced team in the market. We can help plan, implement and manage your Protective Security requirements and keep you in front of regulatory changes. We can also assist with achieving membership of the Defence Industry Security Program (DISP) for those organisations seeking to partner with Defence.
Protective Security strategic planning and implementation support from the most experienced team in the market. We can help plan, implement and manage your Protective Security requirements and keep you in front of regulatory changes. We can also assist with achieving membership of the Defence Industry Security Program (DISP) for those organisations seeking to partner with Defence.
Manage Risks
Draw on the knowledge of Australia’s most experienced protective security specialists to identify and manage risks to your business.
We live and work in the communities we protect. Our advice is always anchored in the reality of Australian commerce and society.
Improve Resilience
Gain the expertise and guidance to build fit for purpose protective security into the fabric of your organisation, for greater resilience and adaptability to respond to evolving threats. Security becomes a business enabler.
Open up new markets
Having a positive security culture in place makes you a trusted partner for not just government, but multi-national customers opening up more opportunities for your business to grow.
Protective security has never been more critical to building successful and resilient organisations across government, businesses, and critical infrastructure. However, keeping your organisation’s most valuable assets protected is becoming more complex by the day. We put Australia’s leading protective security experts by your side to help you navigate complexity, minimising risk, improving resilience and creating value for your organisation.
CyberCX provide expert Defence Industry Security Program (DISP) assistance and services, for those businesses seeking to partner with Defence and with Defence industries . We focus on managing risks and raising levels of security protection across governance, personnel security, physical security and cyber security.
With decades of experience protecting industry defence and government in Australia and New Zealand, our experts understand your specific challenges and opportunities, and how to tackle them.
Get end-to-end guidance at enterprise scale, in a language you can understand. Whether you’re taking your first steps to plan a more secure business, or want more value from your existing investments, we are with you every step of the way.
Our Solutions
Navigate complexity with end-to-end guidance from Australia’s leading protective security advisors, translating compliance challenges into meaningful business outcomes, while helping you build resilience.
Know the risk your supply chain poses to your organisation (both up and downstream). Quickly identify areas of concern and address them through simple assessments and powerful analysis to deliver meaningful results.
We can deliver the full suite of services required to meet government security and DISP membership requirements. Services include:
What is DISP?
The revised Defence Industry Security Program (DISP) was launched on 9 April 2019 to meet the requirements of a modern Defence organisation. The reformed DISP represents a fundamental change in approach to industry security, providing an effective way for Defence and industry to work together to protect sensitive, OFFICIAL and classified Defence information and assets, as well as industry’s intellectual property. The DISP:
How is DISP managed?
The DISP is managed by the Defence Security and Vetting Service (DS&VS) within the Department of Defence and involves:
Why do I need DISP membership?
An appropriate level of DISP membership is required:
If you are a foreign entity you will not qualify for DISP but your business may be recognised under a Security of Information Agreement or Arrangement (SIA). For more information, click here.
Even if DISP membership is not a requirement now, consider whether it may be beneficial in the future and to enhance the overall security posture of your business. Further, proposed changes to the definition of Critical Infrastructure to include sectors like Defence Industry are likely to mandate some form of security obligation for all Defence sector participants. Our assessment is that this will likely include DISP requirements for the management of personnel, physical, information security and an appropriate governance framework. These changes are still in consultation and we’ll have more to say about what this means for Defence Industry in the future.
What are the benefits of DISP membership?
The Australian Government is investing $270 billion over the next decade in Defence capability and we are building a world class Defence industry. The DISP offers substantial benefits to Defence and industry in terms of streamlining security services and protecting Defence information and assets, as well as industry’s intellectual property.
In some instances, DISP membership is mandated by the nature of work delivered to Defence or as a result of a Defence business requirement specified in a contract. For some entities, DISP membership will not be required however, membership is strongly encouraged to ensure they meet minimum security requirements to engage with Defence at a later stage or, as a demonstration of sound security practice even when handling OFFICIAL information. DISP benefits to industry include:
How is DISP structured?
The DISP has tiered levels of membership that can be tailored to suit your organisation’s needs. A DISP member may hold different levels for different categories of security. For example, a DISP member may be Entry Level for ICT and cyber security but Level 1 for governance, personnel and physical security. Note that governance must be equivalent to the highest level of accreditation sought for the other categories.
The DISP has four membership levels within each membership category that align with access to the level of information associated with security classifications (OFFICIAL, OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET).
Who is eligible for DISP?
Any Australian business can apply for DISP membership.
To successfully become a DISP member you will need to meet the eligibility and suitability requirements outlined in Control 16.1 DISP of the Defence Security Principles Framework (DSPF). In all there are 90 eligibility criteria that you must meet in order to successfully complete your DISP membership application. These criteria cover things like the potential foreign ownership, control and influence of your organisation, how you manage your facilities, personnel and information risks and whether or not the governance framework you have in place is appropriate. You also have to provide copies of your policy documents for review by the DISP team.
How do I meet the requirements of DISP?
As we said there are 90 criteria that you have to meet in order to submit your application (regardless of membership level). To meet these criteria you will need to demonstrate that you have:
What will DISP membership cost?
Although there is no direct cost associated with DISP membership, there may be costs associated with implementing and maintaining security measures to meet initial and ongoing DISP requirements. These might include, for example, facility certification and accreditation, personnel security clearances and physical security measures. Organisations should consider these costs in relation to the level of DISP membership required prior to lodging their DISP membership application. Some businesses may find their existing security practices are well advanced for membership without additional costs and others may need to address a gap in requirements. Businesses should consider these costs in relation to the level of DISP membership required prior to lodging their DISP membership application.
Some of the costs to consider are:
So while there is no fee charged for DISP membership there are costs that need to be incurred by your company if you wish to be a DISP member (even at entry level). While these may seem expensive it should be considered not as a cost to your business but as the implementation of a best practice risk management program for your business. This will enable sustained business if designed and implemented properly.
How do I apply?
Familiarise yourself with ‘Principle 16 and Control 16.1 – Defence Industry Security Program’ of the DSPF: here Decide which membership levels are most appropriate for the type of work your business provides.
To get further clarity on the appropriate DISP membership level, consider engaging with the Defence contract manager (if you have a current contract with Defence) or the DISP team. If you are supplying through one of the large Prime contractors, speak to their Australian Industry Content representatives or review the contract they have provided. This will detail their expectations with respect to DISP membership and level.
You will also need to build your evidence that demonstrates that you meet the specified requirements for: Governance; Personnel security; Physical security; and ICT and cyber security. You will need to additionally:
How long does the DISP assessment process take?
Timeframes for processing DISP membership vary based on the required level of membership, current level of security maturity and requirements and dependencies on internal Defence resources. Defence will process DISP applications in the following order, based on whether your business:
What does a good DISP application look like?
To prepare a good application (and therefore reduce the assessment time) and get DISP membership as soon as possible you will need to do the following (for Entry Level):
For DISP Level 1-3 you must meet all of the Entry Level requirements above as well as:
What is AS4811?
AS4811 is the Australian standard for employee background screening. 4811 mandates that you conduct specific checks on all employees (regardless of role) before they are employed. These include proof of identify and the ability to legally work in Australia.
Once I obtain DISP membership, is there anything else I need to do?
Absolutely. All of the requirements you had to meet in order to obtain DISP membership have to be maintained across the year. Some of these include:
If you are not compliant you will need to undertake remediation action to ensure your compliance gets back on track. If you declare that you are compliant and Defence subsequently finds that you are not, your DISP membership will almost certainly be reviewed and may be terminated.
Maintaining your compliance is just as important as getting membership in the first place and if you don’t have a system to manage everything listed above, annual compliance will be hard to achieve.
CyberCX provides true end-to-end solutions from the most experienced industry experts in Australia.
We speak your language and understand how to simplify the often complex and confusing arena of protective security and defence engagement.
Find out how CyberCX can help your organisation manage protective security and achieve DISP membership to drive long-term value.
