What is DISP doing on the gate?
The Defence Industry Security Program (DISP), managed by the Defence Security Division under the Defence Security Principles Framework (DSPF), is a mandatory eligibility requirement for businesses contracting directly or in supply chains supporting the Australian Defence Organisation. If the Request for Tender (RFT) lists DISP membership as a mandatory condition for participation, you must hold the specified level at the time of tender lodgement.
Question 6 on our scorecard represents a hard eligibility gate. Submitting an application acknowledgment or asserting that “our company is eligible to achieve DISP upon contract award” is not compliant when the tender mandates active membership. Unless the RFT conditions explicitly allow a defined onboarding pathway before contract commencement, an unheld DISP level is an immediate NO-BID.
Understanding DISP membership levels and security clearances
DISP membership is tiered across four distinct security domains (Governance, Personnel Security, Physical Security, and Information & Cyber Security). Tenders specify the minimum required level across these pillars:
- Entry Level: Basic security governance for handling unclassified or OFFICIAL / OFFICIAL: Sensitive defence information. Key personnel require Baseline clearances.
- Level 1: Storage and processing of PROTECTED information. Requires designated Chief Security Officers and personnel with Negative Vetting 1 (NV1) clearances.
- Level 2: Handling of SECRET information, secure physical storage rooms, and ICT accreditation. Key project personnel require Negative Vetting 2 (NV2) clearances.
- Level 3: Access to TOP SECRET materials, high-security Special Access Program facilities, and personnel holding active Positive Vetting (PV) clearances.
Obtaining DISP accreditation typically takes 6 to 18 months depending on the level and requires formal Defence sponsorship. You cannot secure DISP accreditation within a standard 30-day tender response window.
What does “held today” mean for bidding entities and subcontractors?
Membership must be held in the exact legal entity that is entering into the contract. A parent company or overseas affiliate’s DISP membership does not automatically cover an Australian operating subsidiary unless Defence has formally endorsed an overarching entity structure.
If you are participating as a subcontractor in a prime contractor’s consortium, verify whether the prime’s DISP umbrella covers sub-tier providers or if individual subcontractors must maintain independent DISP accreditation for the work packages they deliver. Review the prime’s security flow-down provisions in detail before committing pursuit resources.
Civilian infrastructure projects with defence-grade security gates
Major civilian critical infrastructure tenders (ports, airports, telecommunications networks, government data centres) increasingly adopt defence-like security compliance frameworks, requiring ISO 27001, SOC 2 Type II, Essential Eight Maturity Level 2/3 compliance, or Australian Government Security Vetting Agency (AGSVA) cleared personnel. Treat these requirements with identical qualification rigour: verify credentials on day one. See our guide on certifications and security prerequisites.