IndustryMSPs & MSSPs
Many managed service providers already work to the ASD Essential Eight, NIST or other standards. [Draft] Those choices shape the cyber domain of every DISP client you support.
Domain focus/ from this brief
Scan
Defence accepts several standards, including ISO 27001/27002, the ASD Essential Eight and NIST. The choice has significant short- and long-term implications.
Entry Level requires alignment with the Essential Eight, and Level 1 raises the required maturity level.
Level 2 requires accreditation of the IT network. Pathways such as IRAP are often costly.
Cyber pathway decisions are often difficult or costly to reverse once made.
Many managed service providers already work with standards like the ASD Essential Eight or NIST. [Draft] When your clients pursue DISP, the cyber domain depends on the environment you run for them. [Draft] DISP membership of your own can also show Defence clients your security posture.
DISP members must implement a minimum standard of cyber security to protect classified data on servers, computers and in the cloud.
An IRAP assessment is often costly, though internal workflows and commercial opportunities can justify it. A standalone device, or use of the DPN, DSN or DREAMS, is more affordable but not practical for every company.
[Draft] We work alongside your technical team to map your environment to the DISP cyber requirements, for your own membership or for a client's. Our cyber implementation consultancy is part of every Entry Level engagement.
Understand the membership levels to work out the level your organisation needs.
Entry Level
EL
Clears to
OFFICIAL: Sensitive
Entry Level brings your organisation to modern information security standards. Approval clears you for information up to and including OFFICIAL: Sensitive. We deliver it as a fixed-price, all-inclusive package.
Level 1
L1
Clears to
PROTECTED
Level 1 expands the Entry Level scope to meet Defence's additional requirements, and clears your organisation for information up to and including PROTECTED. It also lets you sponsor personnel security clearances up to Baseline.
Level 2
L2
Clears to
SECRET
Level 2 lets your company store and handle SECRET information and take part in classified procurement. Defence sets high standards across all four domains, including third-party certification of your physical and IT systems and a mandatory site inspection.
Level 3
L3
Clears to
TOP SECRET
Level 3 grants access to TOP SECRET information and projects of the highest sensitivity. Defence sets its highest standards across all four domains. Implementation and maintenance are challenging and costly, but the commercial upside is typically significant.
Every engagement starts with a complete audit of your existing processes across the four DISP domains: governance, personnel, physical and cyber security.
We write the policies, processes and plans your organisation needs to meet Defence’s requirements for identifying, assessing and managing security risk.
Incorrect lodgement costs companies time and contracts, and can lead to a rejected application. We prepare and lodge your application and handle Defence’s questions.
Not necessarily. Defence accepts a number of internationally recognised standards for Level 2. ISO 27001/27002 is one of the most widely applied, but your managed services provider or internal IT team may already work to the ASD Essential Eight, NIST or another standard.
The standard you choose has significant short- and long-term implications for your application and your organisation, so we advise on it in the initial consult.
For Level 2 cyber, Defence requires accreditation of your IT network. Pathways such as an IRAP assessment are often costly, though your workflows and commercial opportunities may justify them. A standalone device, or use of the Defence Protected Network (DPN), Defence Secret Network (DSN) or DREAMS, is more affordable but not practical for every company.
These decisions have a significant business impact and are often difficult or costly to reverse, so choose the pathway with advice from someone who knows DISP well.
Please use a business email address. We reply within [Awaiting response time].
We will confirm whether DISP suits your business and which level you need, with no obligation.