Defence Industry Security Program (DISP) Essential Eight Consulting

If you are considering applying for DISP membership or wish to discuss your Annual Security Review (ASR) or Ongoing Suitability Assessment (OSA) we are here to help.

DISP membership is based on 4 pillars: Cyber, Personnel, Governance and Physical. IML works jointly with Elysium EPL to provide DISP consulting in all pillars at all DISP levels. Our combined experience across all four DISP pillars ensures you are the given the right advice for the level of DISP membership you are seeking.

At its core DISP Membership is focused on security - which ideally for a DISP member is something done by you and with you - not for you. If a DISP member is under the impression that a security officer (SO) role can be outsourced then the DSPF has some news for you. This role needs to be fulfilled by an employee who holds a suitable clearance based on the level of your membership. In addition whilst the use of an MSP is acceptable in some circumstances (especially around Cyber) - additonal disclosure will be required for this to be assessed and has the potential for your application to be considered a complex case. It is important to understand DISP membership is not to be taken lightly and you should consider the costs and internal staffing requirements before applying.

Timing - As of 2026 there is still a significant backlog of DISP applications. Occasionally an application can be obtained within 6 months, but 1-2 years is not uncommon. Applications are triaged based on whether you have an existing or upcoming contract with Defence and/or whether you have obtained a letter of endorsement from Defence for your application to be expedited (for example AUKUS related). Consequently, an applicant should be cautious about any expectations of receiving a DISP certificate by a certain date. As the variables involved include whether your application is considered complex, whether you have a Defence contract, at what level you choose for the four pillars, the capability of your employees to meet CSO and SO obligations and the available staffing levels within DISB at the time of your application.

There is often also confusion around what a DISP entity can store and process in relation to their DISP Corporate network and DISP Non Corporate Network - which is linked to your DISP Cyber Level. This is an area which should be researched before applying for DISP based on what existing ICT systems your business currently operates and what sort of contract you intend to perform with Defence.

We enjoy working with clients to support them through the DISB Assessment process for DISP and provide uplift and education where required. The DISB Audit Teams also offer advice and support via their Outreach team in helping you with the process.

IML is an Australian Cyber Security Centre (ACSC) Network & CTIS Partner and maintains the appropriate requirements to perform consulting work with Defence Industry Security Program applicants or members. Both IML and Elysium EPL are happy to provide references from other DISP members we work with.

Further information on Elysium EPL's extensive capabilities can be found on the Elysium EPL website