Most of the conversations I have about the Defence Industry Security Program start with the application. A business has a Defence opportunity, someone has said "you'll need DISP", and the question is how fast they can get there.
That is the right first question, but it isn't the hardest one. Membership is something you keep, not something you finish. And for most small and medium defence suppliers, the organisation with the most influence over whether you keep it is your IT provider. We see both sides of that. InterIntra is a DISP member itself, so we carry the same ongoing obligations as the defence suppliers we support.
If you are new to the program, Cameron's overview of what DISP involves is the place to start. This post is about what comes after.
DISP doesn't end at membership
Defence is clear that membership comes with ongoing responsibilities at every level, set out in the Defence Security Principles Framework. In practice that means you keep a Chief Security Officer and Security Officer in place, keep training staff and screening employees, report changes that might affect your membership, and submit an Annual Security Report every twelve months. That report is a self-attestation that you are still meeting your security obligations, and members can also be checked and audited.
The technical side doesn't stand still either. Patching, privileged access, logging, backups and endpoint hardening all drift as your business changes. A new cloud application, a new site or a handful of new laptops can quietly undo work that was solid on the day you applied.
So the real question isn't "can we get DISP?" It's "can we still truthfully sign the annual report in three years' time?"
Your IT provider holds the keys
Your managed service provider almost certainly has administrator access to your environment. They manage your Microsoft 365 tenant, your endpoints, your firewall and your backups. Their tools reach into your systems, and their people can sign in to them.
That makes your provider's security part of your security, whether your DISP paperwork says so or not. If their environment is weaker than yours, an attacker doesn't need to get past your controls. They only need to get into your provider's.
A provider that is itself a DISP member has been through the same program you have, against the same expectations, and carries the same ongoing obligations. That doesn't make it immune to attack, but it does mean its security is held to the standard Defence expects of you, not just to its own marketing.
Five reasons a DISP member provider makes this easier
1. The controls already run in their own environment
A provider asked to implement Essential Eight controls in your business should be able to show the same controls working in theirs. As a DISP member, InterIntra is aligned to ACSC Essential Eight Maturity Level 2, which the program required of us. The controls we implement for clients are the ones we live with every day.
2. Access to your environment is controlled deliberately
Defence work raises the question of who can reach your systems, and from where. A provider that understands DISP will have an answer that is enforced technically, not just written in a policy. At InterIntra, support for DISP clients is delivered by our Australian team, and that boundary is enforced by access control rather than by policy alone.
3. Evidence is produced all year, not the week before
The Annual Security Report is much easier to sign when the evidence already exists: patch reports, access reviews, backup tests and logging records. A provider that knows what DISP members need will produce that as part of normal monitoring and management, so the report becomes a review rather than a scramble.
4. They notice when a change affects your obligations
Members have to report changes that may affect their membership. Many of those changes start in IT: moving data to a new cloud service, giving a supplier remote access, or opening a new office. A provider familiar with DISP will flag those before they happen, so you can deal with them properly rather than discover them at your next report.
5. They speak the same language as your advisers
DISP covers governance, personnel, physical and information and cyber security. No single provider should pretend to do all of it. We handle the technical controls and work alongside our partner De Stefano & Co, who handle governance, personnel and physical security and the submission itself. When your IT provider and your DISP adviser understand the same program, the gaps between them close.
Questions to ask your current provider
Whether your provider needs its own DISP membership can depend on your contracts and what they handle, so check with Defence or your adviser if you're unsure. Either way, these questions are worth asking:
- Are you a DISP member, and at what level?
- What Essential Eight maturity have you reached in your own environment, and how was it assessed?
- Who in your business can access our systems, from where, and how is that enforced?
- What evidence can you give us for our Annual Security Report, and how often?
- How will you tell us when a change you're making could affect our membership?
A provider that answers those clearly and in writing is one you can build a DISP program on. A provider that hasn't thought about them yet will be learning on your membership.
Your provider's security is part of your DISP security.
Membership is renewed in practice every year, through the controls you keep running and the report you sign. The provider with administrator access to your systems has more influence over that than anyone else outside your business. A provider that is a DISP member, runs the same controls in its own environment and produces your evidence as it goes makes keeping membership far simpler.
If you're working towards DISP or want a second opinion on how your current setup will hold up, our DISP alignment service is delivered with De Stefano & Co, and you can read more about how we work with defence suppliers.