DISP cyber security requirements come down to one standard: every Defence Industry Security Program member, including Entry Level members, must meet or exceed ASD's full Essential Eight at Maturity Level Two (ML2) across the corporate ICT systems used to correspond with Defence. You show it through a Cyber Security Questionnaire (CSQ) at application, then keep proving it through Annual Security Reports and Defence's assurance activities. Penetration testing isn't named as a standalone DISP requirement, but it's one of the strongest ways to show your controls actually work.
This guide explains what DISP asks for on the ICT and cyber security side, what ML2 means in practice, how Defence checks it, and where an independent assessment or pentest fits. It's written for Australian SMBs that supply Defence, or want to.
What is DISP, and who needs to join?
The Defence Industry Security Program (DISP) is Defence's membership-based security program for industry. It sits under the Defence Security Principles Framework (DSPF), Principle 16, Control 16.1, and exists to make sure suppliers have the right security in place for Defence tenders, contracts and projects.
Any Australian entity with an ABN or ACN can apply. There's no membership fee, but Defence is clear that implementing and maintaining the required security measures costs money.
When DISP membership is mandatory
According to Defence, DISP membership is mandatory if you:
- ▸Work on classified information or assets (PROTECTED and above)
- ▸Supply, maintain, store or transport weapons or explosive ordnance
- ▸Provide security services for Defence bases or facilities
- ▸Need DISP membership as a condition of a Defence contract
Outside those cases membership isn't always required, but Defence "highly recommends" it for anyone working on, or seeking, Defence work. Subcontractors are held to the same eligibility criteria, and a prime will often push the requirement down the supply chain through contract clauses.
DISP membership levels
DISP has four membership levels, each aligned to an Australian Government security classification:
| Membership level | Classification |
|---|---|
| Entry Level | OFFICIAL and OFFICIAL: Sensitive |
| Level 1 | PROTECTED |
| Level 2 | SECRET |
| Level 3 | TOP SECRET |
You apply for a level in each of four security domains: governance, personnel, physical, and ICT and cyber security. Your governance level always equals the highest level you hold in any other domain. The cyber baseline below applies from Entry Level upwards.
What are the DISP cyber security requirements?
To meet the ICT and cyber security domain, you must demonstrate that you meet or exceed the Essential Eight mitigation strategies at Maturity Level Two across your ICT corporate systems used to correspond with Defence. That's Defence's wording, drawn from DSPF Control 16.1, Annex A.
This is a recent uplift. Defence's cyber and assurance page states that cyber assessments against the "Top 4" of the Essential Eight concluded on 15 November 2025, and that all DISP members are now required to achieve and maintain the full Essential Eight at ML2. If your last DISP conversation was about application control, patching, macros and admin privileges only, the bar has moved.
The eight strategies DISP expects at ML2
The Essential Eight are:
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
All eight need to reach ML2. A strong score on six doesn't cover a gap on the other two.
Does ISO 27001 or NIST 800-171 count?
Partly. Defence says entities that comply with ISO/IEC 27001:2022, NIST SP 800-171 or Def Stan 05-138 can use that documentation to show in part how they meet the Essential Eight. It's supporting evidence, not a substitute. You still need to answer every Essential Eight control in the CSQ.
If you're weighing up where ISO fits, our comparison of Essential Eight vs ISO 27001 covers how the two work together.
What does Essential Eight Maturity Level Two actually require?
ML2 is designed to stop attackers who put real effort into phishing, credential theft and getting around weak MFA. Compared with ML1, it adds phishing-resistant MFA, tighter control of privileged accounts, broader patching and scanning, and central logging with analysis. These are the ML2 requirements from ASD's Essential Eight Maturity Model that most often trip up SMBs.
Multi-factor authentication
- ▸MFA for privileged and unprivileged users of systems, not just online services
- ▸MFA for users of online services and systems must be phishing-resistant, so SMS codes and push approvals usually won't pass
- ▸Successful and unsuccessful MFA events are centrally logged
Restricting administrative privileges
- ▸Privileged access is disabled after 12 months unless revalidated, and after 45 days of inactivity
- ▸Separate privileged and unprivileged operating environments, with admin activities conducted through jump servers
- ▸Break glass, local administrator and service account credentials are long, unique, unpredictable and managed
Patching and vulnerability scanning
- ▸Asset discovery at least fortnightly, and vulnerability scanning at least daily for online services and internet-facing servers
- ▸Patches for online services and internet-facing servers within 48 hours when critical or a working exploit exists, otherwise within two weeks
- ▸Patches for applications beyond the core set (office suites, browsers, email clients, PDF software and security products) within one month, with fortnightly scanning
- ▸Unsupported software and operating systems removed or replaced
Application control, macros and hardening
- ▸Application control on workstations and internet-facing servers, with Microsoft's recommended application blocklist and annual ruleset validation
- ▸Office macros blocked from making Win32 API calls, with macro antivirus scanning enabled
- ▸Browsers, Office and PDF software hardened using ASD and vendor guidance, and PowerShell and command-line logging centrally collected
Backups and incident response
- ▸Backups synchronised to a common point in time, with restoration tested as part of disaster recovery exercises
- ▸Privileged accounts (other than backup admins) can't modify or delete backups
- ▸Cyber security events are analysed in a timely manner, incidents are reported to ASD, and your incident response plan is enacted
That last point matters. Several ML2 controls assume you have central logging, someone who reviews it, and a written incident response plan. Many SMBs we speak with have the technical controls half-built but no evidence trail behind them.
For a side-by-side view of the two levels, see Essential Eight Maturity Level 1 vs Level 2.
How does Defence check your cyber security?
Defence checks cyber posture at application and keeps checking throughout your membership. The main touchpoints are the CSQ, the Entry Level Assessment, the Annual Security Report and risk-based audits.
The Cyber Security Questionnaire (CSQ)
During the DISP application, your corporate network used to correspond with Defence is assessed through the CSQ. Defence says the CSQ includes a Part B with 107 controls for the Essential Eight, aligned with ML2, and recommends that an authorised representative who knows your ICT infrastructure completes it. Incomplete answers can delay your application, so plan early.
After you complete the CSQ, Defence says a point-in-time cyber security assessment is undertaken. Your Essential Eight maturity level is determined, and an uplift program may be required to reach ML2, with the DISP Cyber Team coordinating a maturity action plan.
Ongoing assurance
| Activity | What it is |
|---|---|
| Entry Level Assessment (ELA) | Governance assessment at application: document review, phone interview and the CSQ. Gaps must be addressed before membership. |
| Annual Security Report (ASR) | Self-attestation due on the anniversary of your membership certificate. The CSQ becomes part of it. |
| Ongoing Suitability Assessment (OSA) | Risk-based desktop audit across all four DISP domains, including a cyber questionnaire. |
| Deep Dive Audit (DDA) | Detailed assessment, including site visits, of compliance with DSPF Control 16.1. |
Implementing recommendations within mutually agreed timeframes is a condition of membership, and it's monitored. Security incidents must also be reported to Defence. Your Chief Security Officer declares the ASR, so treat every "yes" on the questionnaire as something you can back with evidence.
Does DISP require penetration testing?
No. DISP doesn't list penetration testing as a standalone membership requirement. The requirement is Essential Eight ML2 plus the broader DSPF obligations. But a self-attested questionnaire only tells Defence what you believe is configured. Testing shows whether it actually holds up.
That distinction matters because ML2 is built around an attacker who targets credentials and works around weak controls. ASD's Essential Eight Assessment Process Guide rates testing a control with a simulated activity as "excellent" evidence, above reviewing a system's configuration ("good" or "fair") and well above a policy or statement of intent ("poor").
Where testing earns its keep for DISP
- ▸Phishing-resistant MFA: confirming legacy authentication, fallback methods and conditional access gaps don't leave a way around it
- ▸Admin privileges: checking that privileged credentials aren't cached, reused or reachable from a standard user's workstation
- ▸Application control: trying to run unapproved code from user profiles and temporary folders
- ▸Patching: finding the internet-facing service your scanner missed
- ▸Backups: confirming a compromised standard or privileged account can't delete or encrypt them
In our internal and Active Directory engagements, the gaps that undo an ML2 claim usually aren't missing products. They're exceptions: the service account with domain admin rights, the old VPN without MFA, the server that was "temporary" three years ago. Our guide to Active Directory penetration testing explains why those paths matter.
Assessment, pentest or both?
| Need | Best fit |
|---|---|
| Score all eight strategies against ML2 and build a gap roadmap | Independent Essential Eight assessment |
| Prove an attacker can't get around your controls | Internal and external penetration test |
| Quick external check before you start | Automated security assessment (not a pentest) |
| Ongoing oversight between ASRs | vCISO retainer |
Many Defence suppliers do the assessment first, fix the gaps, then commission a pentest to validate the result before their next ASR or a prime's supplier review.
How much does DISP-ready security testing cost in Australia?
DISP membership itself is free, but getting to ML2 and proving it isn't. Costs depend on the size of your environment and how far you are from ML2. Aussie Pentest's published fixed fees (AUD + GST, as listed on our pricing page in October 2026) are:
| Service | Published price | DISP use |
|---|---|---|
| Essential Eight assessment | $4,950 + GST (up to 50 seats; ML1 or ML2 target) | Independent ML2 baseline, maturity score, evidence documentation and remediation roadmap |
| Penetration testing | From $5,000 (Basic), $12,000 (Standard), $20,000 (Advanced) + GST | Validate controls on the network used to correspond with Defence |
| Automated security assessment | $80 to $2,000 | Fast, analyst-reviewed external check; not a penetration test |
| vCISO retainer | $2,500 to $6,500 per month | Advisory, risk register and board reporting between assurance cycles |
Full scope details are on our Essential Eight assessment, penetration testing, automated security assessment and vCISO pages.
Remediation is separate. Uplift work, such as deploying phishing-resistant MFA or application control, is usually done by your internal IT team or MSP. If you're an MSP with Defence-supplier clients, our white-label program lets you offer independent testing under your own brand.
Not sure which fits? Book a 1-on-1 call and we'll scope it with you.
How should a Defence supplier prepare for DISP?
Start by fixing the scope, then measure against ML2 before you fill in the CSQ. A practical order of work:
- Define the in-scope environment. Map every corporate system used to correspond with Defence: email, file storage, endpoints, identity, remote access and any SaaS that touches Defence information.
- Appoint your CSO and SO. Defence requires a director or senior executive as Chief Security Officer and a Security Officer (they can be the same person), both able to obtain the relevant clearance.
- Get an independent ML2 baseline. Score all eight strategies with evidence rather than guessing from a checklist.
- Close the gaps that block ML2. Phishing-resistant MFA, privileged access separation, central logging and backup protection are the usual long-lead items.
- Test the result. A penetration test of the in-scope environment shows the controls hold up against a real attacker.
- Build your evidence file. Keep screenshots, policies, scan results, test reports and retest results so the CSO can declare the ASR with confidence.
- Repeat on a cycle. Re-check before each ASR and whenever the environment changes significantly.
What about ASD Essentials?
ASD launched the ASD Essentials on 15 October 2026 as an evolution of the Essential Eight, starting with chapters for enterprise IT, operational technology and cloud. ASD says organisations should keep meeting their current regulatory obligations until regulators communicate changes, and it will maintain both frameworks during the transition. For DISP members, that means ML2 remains the requirement today. Read our breakdown of the Essential Eight changes for more.
Frequently asked questions
Does DISP Entry Level membership require Essential Eight ML2?
Yes. Defence states that all DISP members must achieve and maintain the full Essential Eight at Maturity Level Two across the corporate ICT systems used to correspond with Defence, regardless of membership level.
Can I self-assess Essential Eight for the DISP questionnaire?
The CSQ and Annual Security Report are completed by your organisation, so yes, the answers are yours. An independent assessment helps make sure those answers are accurate and backed by evidence before your Chief Security Officer declares them.
Is an Essential Eight assessment the same as DISP certification?
No. There's no "Essential Eight certified" badge, and no third party can grant DISP membership. Only Defence decides membership. An independent assessment report is evidence that supports your application and ongoing assurance.
Does DISP cover our cloud services and Microsoft 365?
If they're part of the corporate ICT systems you use to correspond with Defence, treat them as in scope. Email, identity and file sharing are often the core of that environment. Our cloud penetration testing guide covers how we test Microsoft 365 and Azure.
Bottom line
DISP's cyber security requirement is simple to state and hard to meet: the full Essential Eight at Maturity Level Two across the systems you use to correspond with Defence, proven through the CSQ, your Annual Security Report and Defence's audits. Penetration testing isn't a named requirement, but it's the most direct way to show your ML2 controls hold up before Defence or a prime asks.
Aussie Pentest provides independent Essential Eight assessments for $4,950 + GST (up to 50 seats) and fixed-fee penetration testing from $5,000 + GST. Book a 1-on-1 call to scope your DISP readiness, or see whether Essential Eight is mandatory in your situation.
Sources
- ▸Defence: Defence Industry Security Program
- ▸Defence: DISP eligibility and suitability
- ▸Defence: DISP cyber and assurance
- ▸ASD: Essential Eight Maturity Model
- ▸ASD: Essential Eight Assessment Process Guide
- ▸ASD: ASD Essentials, evolving our approach to cyber security resilience
- ▸Aussie Pentest: Pricing
This article is general information only, not legal, compliance or procurement advice. DISP requirements are set by Defence and can change, so confirm your obligations with Defence, your Defence contract manager or a qualified adviser. Prices are current as of October 2026, and Defence and ASD guidance was checked on 21 October 2026. Aussie Pentest does not grant DISP membership or certify Essential Eight compliance. Only test systems you have written authority to assess.