Australian entities seeking to partner with Defence have an obligation to contribute to the security of Defence people, information and assets.

There are many things an entity can do to minimise security risks and raise their level of security. The Defence Industry Security Program (DISP) supports Australian entities to understand and meet their security obligations when engaging in Defence tenders, contracts and projects.

DISP is a multi-level membership-based program. It’s underpinned by the Defence Security Principles Framework (DSPF), Principle 16, Defence Industry Security, Control 16.1, Defence Industry Security Program.

The purpose of DISP is to:

• ensure industry has the right security in place for Defence tenders and contracts
• provide industry with access to security advice and support services
• help industry to understand and manage security risks
• provide assurance to Defence and other government entities when working with DISP members.

DISP membership is mandatory for entities who:

• work on classified information or assets (i.e. PROTECTED and above)
• supply, maintain, store or transport weapons or explosive ordnance
• provide security services for Defence bases or facilities
• need to hold DISP membership as a condition of a Defence contract.

The only exceptions are when an entity is:

• working on classified information or assets, but they will be doing so only within Defence facilities or using Defence networks
• recognised under an applicable Security of Information Agreement or Arrangement (SIA).

Any Australian entity can apply for Defence Industry Security Program (DISP) membership.

Industry entities who wish to apply for DISP membership are required to meet several eligibility criteria that are defined in the Defence Security Principles Framework (DSPF) – Principle 16 Control 16.1. It provides principles, controls and instructions to support entities to understand and manage security risks when engaging with Defence.

An entity must:

• Be registered as a legal business entity in Australia with an Australian Business Number (ABN).
• Be financially solvent.
• Have a Director or senior executive who is able to:
  • obtain an Australian Personnel Security Clearance (commensurate with the level of membership)
  • obtain an Australian  Digital ID.
  • create a Relationship Manager Authorisation account and be the principal authority
  • fulfil the roles of CSO.
• Have a staff member who is able to:
  • obtain an Australian Personnel Security Clearance (commensurate with the level of membership)
  • obtain an Australian  Digital ID.
  • fulfil the role of SO (the CSO and SO can be the same individual).
• Establish and maintain security standards for their requested level of membership.
• Establish the entity’s risk of Foreign Ownership, Control or Influence (FOCI).
  • A FOCI assessment examines the extent of control the entity is under from a foreign entity or entities.
  • FOCI analysis is aligned with the The Treasury’s Foreign Investment and Review Board.
  • It provides information to Defence contracting areas to support their security risk management activities and make informed decisions when assessing security risks associated with the procurement of goods and services.
•  Submit a FOCI declaration form as part of the DISP application process, and when there are potential or actual changes in FOCI status. Information includes, but is not limited to:
  • foreign Directors
  • foreign Board members
  • foreign shareholders
  • foreign revenue streams
  • agreements with foreign persons
  • foreign investments.

All information obtained is held in accordance with legislative requirements under the Privacy Act 1988 and the Freedom of Information Act 1982.

DISP also considers the following when assessing eligibility:

• Any risks arising from an entity’s previous or current commercial activities with any listed terrorist organisation or entity linked to any listed terrorist organisations (as listed under the Criminal Code Act 1995 (Cth)), or to persons for mercenary, terrorist or other criminal activity.
• Any relationships with regimes subject to Australian sanctions laws including the United Nations Security Council sanctions regimes and Australian autonomous sanctions regimes.
• Any relationship with persons or entities on the Department of Foreign Affairs and Trade Consolidated List.

If an entity meets the eligibility criteria they can apply for DISP membership. Once an application is received by DISP an assessment to confirm eligibility and determine suitability is conducted.

Suitability is assessed against the DSPF Principle 16, Control 16.1.

Applicants self-nominate the membership level they need to meet their business needs. The entity’s suitability is assessed against the level of membership it applies for. Appropriate justification is required to support higher levels of membership.

An overseas entity cannot be a DISP member. However, foreign entities can still pursue opportunities to work with Defence on Australian classified contracts if certain conditions are met including:

• The country from where the foreign entity originates must be party to a Security of Information Agreement or Arrangement (SIA) with Australia.
• If a SIA is in place, the foreign entity’s security practices and clearances need to be verified. Foreign entity security practice verification is achieved through recognition of a Facility Security Clearance at the government-to-government level.