If you supply a prime, or you want to, DISP membership is no longer a nice-to-have. Many primes will not on-board a subcontractor who cannot show membership. That does not mean a ten-person workshop needs a TOP SECRET facility. It means you need the right level in each domain, evidenced, and maintained.
Why SMEs get stuck
Smaller businesses often hear two bad pieces of advice at once: "just apply for the highest level" and "we are too small, Defence will not care." Both are wrong. Defence cares about the information you handle. Primes care that you can sit in their supply chain without becoming the weak link.
Proportionate is not optional
Above Entry Level you need a business case. For most SMEs the honest answer is Entry or Level 1 in some domains and Entry in others. Overbuilding burns cash and creates a reporting burden that a small team cannot keep up.
What a proportionate path looks like
- Map which contracts actually require access to classified or sensitive Defence information
- Set domain levels from that map, not from a competitor's brochure
- Put Essential Eight ML2 on a real plan if cyber is in scope — it usually is, even for SMEs. See why ML2 is the cyber gate
- Name a Security Officer who can actually do the job
- Keep evidence in one pack so you are not hunting screenshots the week DSA asks
Subcontractor-specific traps
Prime questionnaires are not the application
A prime's security questionnaire is a commercial filter. DISP membership is a Defence membership. Passing one does not complete the other.
Shared offices and home workshops
Physical security at Entry Level is not a SCIF. It is still access control, visitor handling, and storage that matches OFFICIAL handling. If staff work from home on Defence material, say so and control it. Hiding hybrid work is worse than describing it.
"Our IT guy will do cyber"
Essential Eight ML2 is an operating posture. It is not a weekend job for whoever looks after laptops. If you need uplift, budget it as a project, then keep it as ongoing cover.
SMEs that stay in the Defence supply chain are the ones who scope tightly, evidence honestly, and do not disappear after the membership letter arrives.