DISP alignment · Defence Industry Security Program

DISP compliance and IT support, done properly.

The Defence Industry Security Program (DISP) sets out security requirements for Australian businesses working with Defence. We specialise in the technical security control implementation DISP membership requires, delivered in partnership with De Stefano & Co, who lead the advisory, security management framework and submission components.

Book a Discovery Call What's included

ISO 27001 certified ourselves DISP member Essential Eight Maturity Level 2, third-party audited

Defence Industry Security Program

Four security categories. All covered.

ICT / Cyber Security
InterIntra
Governance
De Stefano & Co
Personnel Security
De Stefano & Co
Physical Security
De Stefano & Co

A joint engagement

Gap assessment
Control uplift
Membership achieved
Kept current

DISP membership is achievable. We'll show you the path.

South Australia has a significant and growing defence industry. From BAE and ASC to the many small and medium businesses in the supply chain, DISP membership is increasingly a commercial requirement as well as a regulatory one. We work with De Stefano & Co - an award-winning consultancy with deep DISP expertise - to deliver both the technical and advisory dimensions of DISP compliance. We work from Adelaide and Brisbane, and support defence supply chain clients across Australia remotely, on the same terms as everywhere else.

We are DISP members ourselves. InterIntra holds DISP membership and is aligned to ACSC Essential Eight Maturity Level 2, which the program required us to meet. We have been through the process we are asking you to go through.

Back to Information Security →

What we cover, and what our partner covers.

DISP is a tiered program. The technical controls, including ICT infrastructure, system hardening, and Essential Eight alignment, are our scope. The advisory, security management framework, and compliance are handled by our partner, De Stefano & Co. Together we cover the entire program.

InterIntra

Technical control implementation

Essential Eight: Uplift to the maturity level required by your DISP tier
Endpoint hardening: Patching, application control and credential protection
Network security: Segmentation, access management and security logging
Security training: Staff awareness for defence supply chain requirements
Incident detection: Technical detection and response procedures
Ongoing monitoring: Continuous evidence collection for compliance maintenance

Our partner

In partnership with De Stefano & Co

The governance, personnel security, physical security, and the submission side of DISP engagements are handled by our partner De Stefano & Co, national leaders in DISP membership attainment and compliance services. We focus on what we're best at; they focus on what they're best at.

DISP sits naturally alongside Essential Eight compliance, and many of the technical controls overlap. Our vCISO service can maintain the ICT security program under a single ongoing engagement.

Where we fit

We support Entry Level and Level 1.

DISP membership runs from Entry Level through to Level 3, and the level decides what your IT provider has to be able to hold. We are a managed service provider built for the first two, which is where the great majority of the Australian defence supply chain sits: the small and medium businesses supplying the primes, rather than the primes themselves.

We support

Entry Level

Environments holding OFFICIAL and OFFICIAL: Sensitive information.

We support

Level 1

Environments holding PROTECTED information.

Beyond our scope

Level 2

Environments holding SECRET information.

Beyond our scope

Level 3

Environments holding TOP SECRET information.

Level 2 and Level 3 cover SECRET and TOP SECRET, and bring obligations well beyond an IT provider’s scope, including facility and personnel requirements. If that is where you are heading, tell us early and we will tell you honestly whether we are the right fit.

The internal controls behind that.

We hold the membership ourselves. InterIntra is a DISP member, aligned to ACSC Essential Eight Maturity Level 2 as the program required of us. The controls we implement in your environment already run in ours.

Access to defence environments stays onshore. Support for DISP clients is delivered by our Australian team, and that boundary is enforced by access control rather than by policy alone.

Our own security is audited, not asserted. InterIntra is independently certified to ISO/IEC 27001. The management system behind how we run client environments is examined by an external auditor every year.

How a joint engagement actually works.

De Stefano & Co lead the advisory, compliance and submission elements of the engagement. We lead the technical control implementation. In practice, we work in parallel - one team doesn't wait for the other. It is the model behind our defence supplier service.

01
Technical gap assessmentIn collaboration with De Stefano & Co, and as part of a broader gap analysis, we assess your ICT environment against the technical controls required for your target DISP level - Essential Eight maturity, network architecture, endpoint configuration. You then receive a report and implementation plan before any work begins.
02
Technical control upliftWe implement the required ICT security controls - Essential Eight hardening, network segmentation, access management, logging and monitoring, patch management. This is done alongside the De Stefano & Co team, who implement the framework, policy and compliance requirements.
03
Ongoing maintenanceAfter membership is achieved, the technical controls need to be maintained. We provide ongoing monitoring, evidence collection, and ICT security management to keep your environment compliant, so your membership stays current, not just initially attained.

Questions

Got questions? We have answers.

Something else? Call 1300 080 000 and you'll get a straight answer.

Is InterIntra a DISP member?

Yes. InterIntra holds DISP membership, and we are aligned to ACSC Essential Eight Maturity Level 2, which we were required to meet as part of it. We are also independently certified to ISO/IEC 27001. It means the ICT controls we implement for your membership are controls we already run in our own environment, and we know what Defence looks for in the evidence.

Does our business need to join DISP?

If you are, or want to become, a supplier to the Australian Department of Defence and you handle defence information or assets, DISP membership is likely required. The obligation is triggered by the nature of the work and the classification of information involved, not just the size of the contract. If you're uncertain whether DISP applies to you, we can help you assess that as a first step.

What security controls does DISP require?

DISP is comprised of four security categories: Governance, Personnel Security, Physical Security and ICT/Cyber Security. Within these security categories, four levels of membership are available, depending on your business requirements. These are Entry Level, Level 1, Level 2 and Level 3. The controls required depend on your membership level. At a minimum, DISP requires a security management framework, personnel security procedures, physical security controls, and an ICT security program aligned to the ISM (Information Security Manual). Higher levels of membership require increasingly rigorous controls. We can assess the membership level you wish to target, and design a program around those specific requirements.

How long does DISP membership take to achieve?

As a guide, the preparation and uplift required to apply for DISP membership generally takes approx. 12 weeks, based on our teams receiving the required information and input from your business within a timely fashion. Assessment of applications is then dependent upon Defence's processing timeframes. We recommend allowing six to twelve months or even longer, depending on your starting point. We can give you a realistic estimate based on your target membership level and current security posture.