Four levels, one for each classification

All questions→

1. Which DISP level do I need?

   In our experience, Entry Level is sufficient for most companies in the supply chain. Level 1 suits companies that want to self-sponsor security clearances, and Levels 2 and 3 suit organisations working on classified projects. We confirm the right level in your initial consult.

2. Can we hold different levels in different domains?

   Yes. The level is set for each of the four domains, so you can select the level each one needs. Many of the consultants we work with hold a higher level for governance and personnel, which allows self-sponsorship of security clearances, and Entry Level for cyber and physical security. This keeps costs down, but it does not suit every business. We confirm the right mix in the initial consult.

3. Which levels let us sponsor our own security clearances?

   Entry Level does not allow self-sponsorship. Level 1 lets you manage personnel clearances in-house and sponsor up to Baseline. Level 2 lets your Security Officer sponsor and manage clearances up to Negative Vetting 1 (NV-1). Many firms seek Level 3 for self-sponsorship up to Negative Vetting 2 (NV-2).

   Your CSO and SO need clearances of their own to sponsor others. At Level 2, for example, the SO must hold at least NV-2.

4. Do we need ISO 27001 for Level 2 cyber requirements?

   Not necessarily. Defence accepts a number of internationally recognised standards for Level 2. ISO 27001/27002 is one of the most widely applied, but your managed services provider or internal IT team may already work to the ASD Essential Eight, NIST or another standard.

   The standard you choose has significant short- and long-term implications for your application and your organisation, so we advise on it in the initial consult.

5. Is Defence accreditation of our IT network mandatory?

   For Level 2 cyber, Defence requires accreditation of your IT network. Pathways such as an IRAP assessment are often costly, though your workflows and commercial opportunities may justify them. A standalone device, or use of the Defence Protected Network (DPN), Defence Secret Network (DSN) or DREAMS, is more affordable but not practical for every company.

   These decisions have a significant business impact and are often difficult or costly to reverse, so choose the pathway with advice from someone who knows DISP well.

6. Should we apply for Level 3?

   Only after careful evaluation. Level 3 suits mature organisations with considerable expertise and history in the Defence sector, working on the most classified technologies, operations and projects. We discourage firms without Defence experience or active Defence contracts from applying.

   Weigh the commercial case, implementation cost and ongoing cost first. If your main goal is self-sponsorship up to NV-2, there may be pathways that reduce cost. We can evaluate the options with you.