DISP — Defence Industry Security Program

The Defence Industry Security Program (DISP) is the Department of Defence's membership-based program setting baseline security requirements for industry entities that want to engage with Defence, managed by the Defence Industry Security Branch. Membership is mandatory for entities that work on classified information or assets (PROTECTED and above), supply, maintain, store or transport weapons or explosive ordnance, provide security services for Defence bases, are Australian Community Members under the Australia-US Defence Trade Cooperation Treaty, or hold membership as a condition of a Defence contract.

DISP requires the ASD Essential Eight at Maturity Level 2 or above across the corporate ICT systems an entity uses to correspond with Defence — at every membership level, from Entry (OFFICIAL) through Level 3 (TOP SECRET). Entities handling classified information must additionally have at least one network accredited under DSPF Principle 23 and Control 23.1, in accordance with the ISM and DSPF. Defence assesses cyber posture through the Cyber Security Questionnaire, annual reporting and audits.

Yes. Cyber assessments against the top four of the Essential Eight concluded on 15 November 2025, and all DISP members are now required to achieve and maintain compliance with the full Essential Eight Maturity Level 2 standard across the corporate ICT systems used to correspond with Defence. Where an assessment falls short, the DISP Cyber Team coordinates a maturity action plan through the Essential Eight Cyber Standards Uplift Program. Defence has also introduced a conditional membership pathway, so applicants can progress before their maturity action plan is complete, and a 12-month extension for existing members awaiting a cyber assessment.

NodeZero, a continuous security validation platform, tests the ICT and cyber security stream of DISP: it produces direct technical evidence across the Essential Eight by safely executing real attacks — strongest on the six strategies governing privilege, credentials and exploitable weakness, with attack-impact evidence for macros and backups — and tests the network segmentation, access controls and system hardening that classified-system accreditation expects — attack-based evidence you can put in front of an assessor. The governance, personnel and physical security streams require organisational evidence.

No. The Annual Security Report is a self-attestation of compliance with Defence Security Principles Framework obligations — agreed by your executive (board equivalent) and submitted by your Chief Security Officer — and the Cyber Security Questionnaire is a recurring part of that assurance cycle. NodeZero puts evidence behind your answers: AD Password Audit, Endpoint Security Effectiveness and Rapid Response outputs map directly to the CSQ's Essential Eight Part B, while Part A and administrative items remain documentation work.

No. Accreditation of classified ICT systems is Defence's own process under the DSPF, and where a system needs an IRAP assessment that remains a separate certification engagement performed by a human assessor. NodeZero replaces the annual penetration test, vulnerability scanner and breach and attack simulation — producing exploit-validated evidence of which controls held under attack and which didn't — and closes the gap between accreditation cycles.