DISP Entry Level for HR Directors: Roles, Contracts and Clearances

What is DISP Entry Level Membership and How is it Maintained?

The Defence Industry Security Program (DISP) is Defence’s membership scheme for businesses that handle its information, people or assets.

Personnel Security Clearance vs Corporate DISP Membership

A person holds a Personnel Security Clearance, and a business holds DISP membership. Each is applied for separately and assessed by a different part of Defence.

• The Australian Government Security Vetting Agency assesses a person for a clearance, to decide whether they can be trusted with classified information. The level follows the information: baseline for PROTECTED, negative vetting level 1 for SECRET, level 2 for TOP SECRET.
• Defence assesses a business for membership, to decide whether it can protect Defence information, people and assets across four domains, at entry level or levels 1 to 3.

A driver’s licence and a company’s operator licence make a fair comparison. Each employee applies for a clearance separately, and a business needs the right membership level to sponsor clearances. Information is graded: OFFICIAL and OFFICIAL: Sensitive need care, while PROTECTED, SECRET and TOP SECRET are ‘classified’ because a leak could harm Australia. Entry level membership covers the first two grades.

Clearances reach beyond the CSO and SO. Anyone with access to Defence materiel (equipment, supplies and their data) may need one, at the level of what they handle: engineers on classified drawings, information technology administrators on Defence systems, logistics staff moving classified items, and cleaners or guards in classified areas.

Defence Industry Security Program Eligibility Requirements

Any Australian business seeking to join the Defence supply chain can apply, with or without a Defence contract. Defence assesses eligibility and suitability, including an Australian business registration, solvency, a CSO and an SO. Membership is mandatory for businesses needing PROTECTED information or whose contract requires it. A business without a contract applies for entry level in all four domains: governance, personnel, physical, and information and cyber security.

The Entry Level Assessment Process & Required Documentation

Before granting membership Defence, among other things, checks the nominated security staff, assesses cyber maturity, interviews the CSO and SO, and conducts an Entry Level Assessment, Defence’s check of security documents, covering:

• security policies and plans
• security risk assessment
• security register
• annual training arrangements
• insider threat program
• employment and screening policy

Defence’s template or the business’s own document will do. The last three items sit largely with human resources.

Annual Reporting and Ongoing Defence Audits

The CSO submits an annual security report, a yearly confirmation of compliance, on the grant’s anniversary, after a board or board equivalent of Australian citizens agrees it. Defence also runs desktop ongoing suitability assessments and deep-dive audits, interviewing human resources staff. Missing a 28-business-day audit deadline is reported to contract managers. Failure can mean limited, suspended or terminated membership and breach-of-contract action.

Defining the Roles: CSO and SO Requirements for HR Planning

CSO and SO Appointment Criteria & Security Clearances

• The CSO is a director or senior executive able to direct resources. The SO is a staff member, so the role cannot be outsourced. One person can hold both.
• Both are Australian citizens able to obtain and maintain a baseline clearance and manage security up to OFFICIAL: Sensitive.
• The business cannot sponsor clearances itself, so the application asks Defence to sponsor both. The vetting agency bills the business.
• Both complete security officer training for the application and every three years, and sign an acknowledgement letter.

Succession Planning for the CSO and SO

Notify Defence in writing within 14 business days of any CSO or SO change, through a change of circumstance in the Member Portal; senior executive and board changes are also reportable. Both roles must be retained, so a vacancy is urgent.

Managing the Register of Designated Security Assessed Positions

Every member keeps this register, available to Defence on request. A role belongs on it where it needs sensitive or classified information, Defence information and communications technology systems, or classified areas. It lists:

• each position needing a clearance, its level and its occupant, including at least the CSO and SO
• high-responsibility roles whose misuse could harm Defence, with the rationale recorded

Human resources maintains the position structure, so it is the natural custodian with the SO. Between contracts, the SO removes, then restores, the business’s interest in a clearance through myClearance, the vetting agency’s online system.

Applying the Need-to-Know Principle

Need to know means people see only the information their job needs. A clearance answers a different question: can this person be trusted? Access depends on both. A cleared payroll officer is trusted, but the job needs no project drawings. The same applies to cleared staff, so access changes with the role.

Determining Clearance Levels and Subcontractor Flow-downs

Tender documents say whether membership is needed. Requirements flow through contracts, including the Australian Standard for Defence Contracting templates. Through a prime (Defence’s main contractor) they arrive in the subcontract. Primes must pass Defence’s security rules down to suppliers, a business several tiers away can be bound, and the prime stays responsible for subcontractors. Defence may weigh significant risks from reliance on international supply chains, and contract changes are reportable. If the subcontract is silent on clearances, ask the prime in writing and keep the answer with the register.

How Staff Get Security Clearances at Entry Level

Other staff needing clearances have two routes, which set timing and cost:

• Defence sponsors, through the Defence project’s Security Officer for contract clearances.
• Once it has a contract, the business upgrades to level 1 personnel security. That needs a justification, a further suitability assessment, governance lifted to level 1, and an SO able to obtain a negative vetting level 1 clearance.

Operational Areas with Minimal HR Oversight

Physical Security and Essential Eight Cyber Frameworks

The annual security report, risk assessments and reporting of ownership, financial or supply chain changes sit with the CSO and SO; facility access controls usually with facilities. Entry level requires the Essential Eight (the Australian Signals Directorate’s eight cyber measures) at maturity level two across corporate systems used to correspond with Defence, an information technology obligation. Human resources touches it through joiner, mover and leaver processes: lagging access weakens the controls being demonstrated.

Three Things Human Resources Directors Should Confirm Before Applying

1. The CSO and SO are named, meet the requirements and have successors.
2. Contract requirements are confirmed; if silent, the prime has been asked in writing.
3. The register lists every role needing a clearance, has an owner and traces entries to the contract.

Part 2 follows in two weeks.

Find out more about DISP and HR

We support suppliers across Australia, including Queensland, New South Wales and South Australia.