DISP Accreditation Support | Cyber & Governance Evidence
If your business is bidding on, or delivering, Defence work, you've probably run into DISP, and probably found that most explanations of it are either a government factsheet or a sales page. This one's meant to be neither: a straight explanation of what DISP actually requires, and exactly where Novaguard fits into getting you there. Where we don't fit, we'll say so.
Included
Essential Eight readiness for Iron Dome clients
$8,500+
new or standalone clients
ML2
Essential Eight minimum at every DISP level
2–6 mo
realistic timeline, Entry through Level 3
Worth saying up front: this page is for a different kind of business than most of our site. Novaguard primarily works with Microsoft 365-based professional firms of around 10–40 staff. DISP engagements also serve eligible businesses entering the Defence supply chain, including engineering, IT services, logistics, and manufacturing. If that's you, keep reading. If you're looking for general managed IT or cyber security, our managed IT services and managed cyber security pages are the better starting point.
What DISP is, in plain language
The Defence Industry Security Program (DISP) is the Department of Defence's program for assessing and managing security risk across the private businesses it works with. Defence's own material consistently calls it "DISP membership," not "accreditation" or "certification", worth knowing before you're in a conversation with a Chief Security Officer or Defence contact who uses the correct term.
Who actually needs DISP membership
DISP membership is effectively required to participate in most Defence tenders, contracts, and projects. If your business is in, or wants to be in, the Defence supply chain, as a prime contractor or as a subcontractor to one, DISP membership is increasingly a condition of tender eligibility, not just something that makes your bid look stronger.
The four domains and four levels of DISP membership
DISP isn't a single pass/fail badge. A business chooses a membership level, Entry, Level 1, Level 2, or Level 3, separately for each of four domains:
- Security governance and risk management
- Personnel security
- Physical security
- Information and cyber security
The levels line up with Australian government classification handling, Entry roughly matches OFFICIAL and OFFICIAL: Sensitive information, up through Level 3 for TOP SECRET. Your governance domain level always has to match or exceed whichever of the other three domains you've gone highest in.
Why the cyber domain is now the same for every level
Since a 2024 uplift, every DISP member, including Entry Level, must achieve and maintain the full ASD Essential Eight at Maturity Level 2 across the systems used to correspond with Defence (DSPF Principle 16, Control 16.1, Annex A). Whatever level you're pursuing, the cyber security domain asks for the same standard Novaguard already builds for Essential Eight compliance clients.
What Novaguard actually helps with, and what we don't
Our founder's own description of this capability is "a full risk governance breakdown with evidence for DISP assessment." Read against the four domains above, here's precisely what that means:
- Information and cyber security domain: this is Essential Eight Maturity Level 2 work, assessing your current environment against the standard, closing the gaps, and maintaining it.
- Security governance and risk management domain: a full evidence pack, the controls in place, how each is met, and evidence against your actual environment, not a generic checklist.
What sits outside our lane
We're upfront about this because a defence-industry audience will notice if we're not: personnel security clearance sponsorship and physical security domain certification are not things an IT/MSP provider delivers. If your DISP application needs those two domains addressed, that's a separate specialist conversation, we're not going to pretend otherwise to win the work.
If you're already thinking about Essential Eight, you're already most of the way there
Because Essential Eight Maturity Level 2 is now mandatory for every DISP level, the work of preparing for Essential Eight compliance and the work of preparing your DISP cyber-domain evidence are, in practice, the same project. If your business runs on Novaguard's Managed IT Services Iron Dome plan, Essential Eight Level 2 is already included in your baseline.
Realistic timeline
For a typical 10–20-seat organisation, we can usually roll out the Essential Eight technical controls in 2–3 weeks. We have completed technical rollouts in as little as one week. Timing depends on your existing systems, access and the changes required.
Once the rollout and evidence collection are complete, we hand over the cyber evidence package for you to submit to the Defence team as part of your DISP application. Technical implementation is one part of preparation; governance, personnel clearances and other application requirements may have their own timelines.
Defence's own processing estimate is 2–3 months for Entry Level, 4–6 months for Levels 1 through 3. That is application processing time, separate from our technical rollout, and assumes the required clearances and controls are already in place when you submit.
DISP Accreditation Readiness, what it costs
We've delivered this kind of risk governance and evidence work before, and we've now turned it into a named, priced offer: DISP Accreditation Readiness. Two paths, depending on where you're starting from:
- Already an Iron Dome managed client? You’re already covered for Essential Eight ML2 readiness. We’ll review your implementation, show you any gaps and exceptions, close the gaps and provide the evidence pack for your DISP submission.
- New to Novaguard, or not yet on a managed plan? DISP Accreditation Readiness starts from $8,500. We’ll start with an Essential Eight gap assessment, then build a project plan around the work needed to get your implementation and evidence ready.
- Targeting Level 2 or Level 3, a multi-entity structure, or need the personnel/physical security domains coordinated too? That's outside our productized scope, talk to us for a scoped quote.
For new or standalone clients, the starting price and project scope are confirmed after a conversation about your target level and current environment. Talk to us to find out where you stand.
Who this is for
DISP membership work makes sense if you're an Australian business (or planning to be) bidding on or delivering work in the Defence supply chain, engineering, IT services, logistics, manufacturing, professional services, and you need to demonstrate the cyber and governance side of DISP eligibility. It's a genuinely different buyer than most of our site: if that's not your situation, our managed IT services and managed cyber security pages describe what we do for general Australian SMBs. DISP is one part of our broader cyber compliance work, see that page if you're also weighing Essential Eight or SMB1001.
Looking to become a Defence supplier, but not sure where to start?
We've met the friendly team at the Australian Industry & Defence Network (AIDN) and encourage you to reach out. AIDN represents small and medium businesses in the Defence sector, with industry connections, events and updates that can help you get to know the landscape and the people in it.
If you're still exploring where your business fits in the Defence supply chain, that conversation is a useful starting point. When you're ready to work through the cyber security controls and evidence for DISP, we can help with that part of the journey.
Frequently asked questions
Is it "DISP accreditation," "DISP certification," or "DISP membership"?
Defence's own documentation calls it "DISP membership", there's no separate accreditation or certification issued. "Accreditation" and "certification" are the terms most people search, so you'll see them used loosely, including by us in places like this page's title, but the correct term in an actual application or conversation with Defence is "membership."
Does DISP membership cost anything?
There's no direct membership fee. The real cost is implementing and maintaining the security measures each domain requires, facility work, personnel clearances, and (the part Novaguard helps with) the Essential Eight uplift and governance evidence.
Do I need Level 1, 2, or 3, or is Entry Level enough?
It depends on the classification of information your Defence work involves, not on company size. Entry Level covers OFFICIAL and OFFICIAL: Sensitive information; Levels 1 through 3 step up through PROTECTED, SECRET, and TOP SECRET. Many businesses supplying Defence at the subcontractor level only need Entry Level.
Can Novaguard get my whole business DISP accredited?
No, and we'd rather tell you that upfront than have you find out later. We help with the cyber security and governance evidence domains. Personnel security clearance sponsorship and physical security certification are separate processes outside what an IT provider delivers.
We're already an Essential Eight client, does this cost extra?
If you are on our Iron Dome managed plan, your Essential Eight ML2 readiness work is already covered. We review your implementation, identify gaps and exceptions, close the gaps and provide the evidence pack for your DISP submission.