Applying for DISP membership is less about filling a form and more about proving, domain by domain, that your business can handle Defence information at the level you are asking for. Companies that treat it as paperwork usually stall. Companies that treat it as an evidence pack usually move.
What you are actually applying for
DISP sits under Principle 16 of the Defence Security Principles Framework. You do not receive one badge for the whole company. You seek a membership level in each of four security domains: governance, personnel, physical, and ICT/cyber.
The four domains, in application language
- Security governance always matches the highest level you hold anywhere else.
- Personnel security covers screening, clearances, and ongoing suitability.
- Physical security covers facilities proportional to the classification you handle.
- ICT / cyber currently expects Essential Eight at Maturity Level 2 across the corporate environment.
If you are still deciding levels, start with our note on DISP membership levels before you write anything for DSA.
The order that works
1. Scope the work, not the wish list
Write down the contracts, primes, and information types you actually need to touch. Defence expects a genuine business case above Entry Level. Asking for SECRET "just in case" adds years of reporting you may never need.
2. Run a gap assessment
Map current controls against all four domains. Be honest. A gap assessment that says you are ready when you are not is worse than a gap assessment that lists the work.
3. Build the evidence pack
Policies, registers, screening records, facility notes, and cyber configuration evidence. Reviewers read artefacts, not aspirations.
4. Submit and stay in the conversation
The Defence Security Authority will come back with questions. Treat that as normal. Slow replies are one of the most common reasons applications drag.
What to have ready before you apply
- A designated Security Officer with time to own the process
- Domain-by-domain target levels and the business case for anything above Entry
- Evidence that Essential Eight ML2 is either in place or on a dated plan — see our ML2 checklist
- Personnel screening aligned to AS 4811:2022
- Facility measures that match the classification, not a brochure photo of a front desk
After you submit
Membership is not the finish line. DISP is an ongoing obligation. If you need someone to stay on after the decision, that is the managed cover part of the work, not a separate "maybe later" project.