DISP & DSPF compliance and assurance services

For most organisations entering the defence supply chain for the first time, the journey to Entry Level or Level 1 DISP membership takes between three and six months, depending on the maturity of existing security controls and the complexity of the Essential Eight uplift required. The organisations that navigate this most effectively are those that treat DISP as an investment in accessing work for a Government department that operates in a complex Cyber threat environment.

• Governance and accountability
• Protective security controls
• Information classification and handling
• Personnel and organisational security
• ICT and cyber security controls
• Third-party and supply chain risk
• Incident preparedness and response

DISP is a multi-level membership-based program underpinned by the Defence Security Principles Framework (DSPF).

A company that is in the process of or currently involved in projects and tenders that are connected to any of the following will have mandated DISP Membership requirements:

• Classified information or assets,   
• Storing or transporting weapons or explosives, or
• Anything regarding Defence bases or facilities. 

The DSPF is a principles-based framework intended to support a protective security culture that aligns with the Commonwealth’s Protective Security Policy Framework.

The DSPF is assessed by:

• Allowing all parts of Defence to manage security within their operational context.
• Ensuring the most appropriate people are setting security requirements.
• Sets clear processes and accountability, which underpin assurance of Defence protective security arrangements.

DISP membership needs to be established, maintained and reviewed at regular intervals. Once an entity has achieved membership, they need to maintain certain standards.

A companies security officer must complete an Annual Security Reports (ASR) annually. It must be submitted within 10 business days of the anniversary of a member’s original membership grant date.

Finally, companies must report any change of circumstance, as they arise. All changes that might have an impact on their membership.

If as a Third-party supplier, there is a possibility that the service or product you are aiming to supply meets the DISP provisions above, then you may need to apply for DISP memberships. Our consultations can do an initial review of your service to assess your individual requirements.  

• Organisational Security Policies and Strategies 
• Security strategies and plans 
• Procedures relating to: 
  • Personnel Onboarding 
  • Security Incident Response 
  • Security Awareness and Training 
• Security Risk Assessments and Plans 
• Security Certifications 
• System Security Designs and Documentation. 

Yes. Thales Cyber services have the personal, and skill sets to assist in policy development and assessment prior to DISP assessment. This service will include:

• Gap analysis and review of current documentation
• Creation of policies in conjunction with your organisations SME
• Amend current documents to ensure they are at the required standard. 

As part of our DISP uplift service, we will provide initial, routine and final reporting to your organisations board to ensure that consistent and correct information on the progress of the DISP application is maintained. Our consultants are highly skilled in communicating with executives and boards and ensure that the advice and reporting is relevant and pitched at the appropriate level for effective decision making.