DISP Maturity Action Plans: Explained

A Maturity Action Plan (MAP) sets out the work needed to address identified cyber security gaps.

The practical priority is to make the work deliverable. Assign an owner to each action, set achievable milestones and provide the resources to meet them. Build evidence collection into implementation so progress can be demonstrated at each review.

The starting point is a cyber assessment report. It records the findings of a review of systems and security controls, identifies weaknesses and recommends improvements. An assessment may be prompted by a customer requirement, a significant system change, a security incident or a scheduled review. Its conclusions depend on the scope and evidence examined.

Agree the implementation timeframe with the Defence Industry Security Program (DISP) and confirm the completion date for each action. Set milestones that allow time to implement changes, collect evidence and verify that the identified gaps have been addressed.

Translate the findings into prioritised actions. Define what needs to change and how completion will be verified. Account for dependencies, supplier involvement and operational constraints when setting the schedule.

Use a Plan–Do–Check–Act cycle to guide delivery:

• Plan: Agree the actions, owners, resources and evidence needed.
• Do: Implement the changes and record the results.
• Check: Verify that the changes address the gaps and that controls work as intended.
• Act: Resolve remaining weaknesses and update the plan using review findings.

Use existing governance and reporting processes to track milestones, escalate obstacles and resolve risks that remain unacceptable.

Close actions when the evidence supports completion. Continue reviewing controls as systems, suppliers and business needs change. A useful MAP gives management a clear view of the work remaining and the decisions needed to move forward.