Membership context
Confirm the intended Defence work and the level you are preparing for, with your CSO or SO.
DISP Readiness Assessment
A DISP readiness assessment checks how prepared your business is for a Defence Industry Security Program (DISP) application at the membership level you need. Umbrella Tech reviews your information and cyber security controls against the DISP requirements for that level, notes dependencies on governance, personnel and physical security, and gives you a prioritised plan so your application is supported by evidence.
When this assessment is useful
Use it before you submit a DISP application, when a prime contractor asks about membership during a tender, or when you are considering a higher membership level. It is also useful when IT has grown without a security baseline and nobody is sure which DISP requirements would be met today.
Assessment scope
Cyber security baseline
Review identity, multi-factor authentication, endpoints, patching, backups, networks and information handling.
Essential Eight position
Assess maturity against the strategies relevant to your level.
Dependencies
Note where cyber controls rely on governance, personnel or physical security work owned by others.
Evidence and access
Depending on scope, evidence may include Microsoft 365 and identity settings, device and patch reports, network diagrams, backup records, security policies, incident procedures, and interviews with your security personnel. We agree access and handling, including any sensitivity of Defence-related information, before the assessment begins.
Microsoft 365 and identity settings
Device and patch reports
Network diagrams
Backup records
Security policies
Incident procedures
Interviews with your security personnel
Findings that lead to action
You receive a view of which DISP requirements you meet for your target level, the cyber security gaps, the dependencies on other categories, and a prioritised roadmap. Findings make clear what evidence the application will need.
Illustrative findingsExamples only
- ExampleAdministrator accounts without multi-factor authentication
- ExampleIncident response procedure that names nobody
- ExampleDefence-related files stored alongside general business data with no access restriction
These are examples of what an assessment can uncover, not findings about your business.
How it runs
Assessment method
01
Confirm the level
Agree the intended work, membership level and scope with the people running the application.
02
Review controls
Examine settings, records and procedures against the DISP cyber security requirements.
03
Rate and prioritise
Record gaps and dependencies and rank them by risk and effort.
04
Plan the next steps
Walk through findings and agree who will close each gap before the application.
From assessment to remediation
Close the gaps with your own team or provider, or through DISP Cybersecurity Implementation. Many of the technical actions overlap with Essential Eight Remediation.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
DISP
The Defence Industry Security Program (DISP) is the Department of Defence membership program for businesses in the Defence supply chain, with an Entry Level and Levels 1 to 3.
About DISP services →Membership scope and responsibilities
Our assessment covers information and cyber security. Governance, personnel and physical security are prepared by your CSO, SO and other responsible people, and Defence determines membership outcomes.
Frequently asked questions
Can't see your question? Ask us directly →
What does a DISP application include?
A DISP application is made to Defence and sets out the membership level you are seeking, your nominated security officers and how the business meets the requirements across governance, personnel, physical, and information and cyber security. Defence's current guidance sets the exact forms; our assessment helps you prepare the cyber security part with evidence behind it.
How long does the assessment take?
It depends on the membership level, the size of your environment and how quickly evidence can be provided. We confirm scope and timing in discovery.
What evidence or access is required?
Read-only access to key systems such as Microsoft 365 and device management, current policies and procedures, and time with your IT and security personnel. We agree the list first.
What happens after the assessment?
You decide how to close the gaps. We can implement the cyber security changes, support your team, or recheck before submission.
How much does it cost?
Cost depends on the membership level, environment size and existing controls. We confirm scope and cost in discovery. The assessment supports preparation; membership decisions belong to Defence.
Establish your current position
Tell us about the Defence work you are pursuing and the level you are preparing for. We will scope an assessment that supports your application.