The Defence Industry Security Program (DISP) is structured around four membership levels, each aligned to the sensitivity of information an organisation will access when working with Defence.
Understanding these membership levels is critical for businesses engaging with Defence, bidding for contracts, or preparing their security posture. Choosing the wrong level can create unnecessary cost and complexity, while choosing a level that is too low can prevent access to required work.
This article explains each DISP membership level, what type of information it covers, and how organisations typically determine the appropriate level.
Why DISP membership levels exist
DISP membership levels exist to ensure that an organisation’s security controls are proportionate to the sensitivity of the information it handles.
Not all Defence suppliers require access to the same information. Some organisations may only interact with unclassified or limited sensitive material, while others support highly classified programs.
The DISP framework allows Defence to:
- Scale security expectations appropriately
- Reduce unnecessary burden on lower-risk suppliers
- Ensure higher-risk organisations meet stronger security requirements
Each membership level builds on the one before it.
Overview of DISP membership levels
DISP has four membership levels:
- Entry Level
- Level 1
- Level 2
- Level 3
Each level corresponds broadly to the highest classification of information the organisation will access.
The level an organisation requires is driven by business activities and contractual requirements, not by organisational size or ambition.
Entry Level DISP membership
Entry Level is the lowest tier of DISP membership.
It is designed for organisations that:
- Do not require access to classified information above OFFICIAL
- May handle OFFICIAL: Sensitive information
- Are early in their engagement with Defence
Entry Level organisations are still required to implement basic security governance arrangements, but the overall compliance burden is lower than higher levels.
This level is commonly used by:
- Professional services firms
- Early-stage Defence suppliers
- Organisations providing indirect or advisory services
Entry Level membership provides a pathway into the Defence supply chain without imposing controls designed for classified environments.
DISP Level 1 membership
DISP Level 1 is required where an organisation needs access to information classified up to PROTECTED.
This level introduces more structured security requirements across governance, personnel, physical security, and information security.
Level 1 organisations typically:
- Handle sensitive Defence or government information
- Require personnel with Baseline security clearance
- Operate systems or environments where PROTECTED data is stored or processed
Level 1 is often appropriate for organisations supporting Defence operations without access to SECRET material.
DISP Level 2 membership
DISP Level 2 is required where an organisation needs access to information classified up to SECRET.
This level represents a significant step up in security expectations and oversight.
Level 2 organisations are typically:
- Defence contractors or subcontractors
- Involved in operational, technical, or infrastructure support roles
- Required to sponsor personnel for NV1 security clearance
Security requirements at Level 2 are more rigorous and include stronger controls across all DISP security domains.
Many Defence contracts specify Level 2 membership as a minimum requirement.
DISP Level 3 membership
DISP Level 3 is the highest level of DISP membership.
It is required where an organisation needs access to information classified up to TOP SECRET.
Level 3 membership applies to a small number of organisations involved in highly sensitive Defence and national security activities.
At this level:
- Security controls are extensive and tightly governed
- Personnel typically require NV2 or higher clearances
- Facilities, systems, and processes are subject to strict controls
Level 3 membership is uncommon and generally driven by specific Defence capability programs.
How DISP membership levels align to information classification
While exact requirements are defined by Defence, membership levels broadly align as follows:
- Entry Level – OFFICIAL and OFFICIAL: Sensitive
- Level 1 – PROTECTED
- Level 2 – SECRET
- Level 3 – TOP SECRET
An organisation’s required level is determined by the highest classification it needs to access, not by how often that access occurs.
Even limited or infrequent access to higher-classified information can trigger the need for a higher membership level.
How organisations determine the right DISP level
Choosing the correct DISP membership level is a practical decision based on business operations.
Organisations typically consider:
- Contract requirements
- Information classifications referenced in tenders
- Whether personnel require security clearances
- Access to Defence facilities or systems
Defence will not approve a membership level that is misaligned with actual business needs. Applying for a higher level than required can increase cost and complexity without benefit.
Can an organisation change DISP membership levels?
Yes. Organisations can apply to upgrade their DISP membership level if their business activities change.
This commonly occurs when:
- Winning new Defence contracts
- Expanding into higher-classified work
- Bringing additional capabilities in-house
Upgrading requires demonstrating compliance with the additional security requirements of the higher level.
Downgrading is less common but may occur if an organisation no longer requires access to higher-classified information.
Common misunderstandings about DISP membership levels
A common misconception is that higher DISP levels are “better.” In reality, the correct level is the one that aligns with operational need.
Another misunderstanding is that small organisations cannot achieve higher membership levels. DISP levels are not determined by company size, but by security requirements.
Finally, DISP membership does not automatically grant access to classified information. Access is always controlled by contract terms and need-to-know principles.
Why DISP membership levels matter
DISP membership levels affect:
- Eligibility for Defence contracts
- Ability to sponsor personnel security clearances
- Security obligations across the organisation
- Audit and reporting requirements
Understanding these levels early helps organisations plan appropriately and avoid delays during procurement or onboarding.
Final thoughts
DISP membership levels provide a structured way to align security requirements with real business risk.
For organisations engaging with Defence, clarity on the appropriate level is essential. Applying for the right level at the right time reduces friction, avoids unnecessary burden, and supports long-term participation in the Defence supply chain.
Security requirements should enable capability, not obstruct it, and DISP membership levels are designed to do exactly that when applied correctly.
Most organisations entering the Defence supply chain underestimate what DISP actually requires or assume existing policies are enough.
The DISP Readiness Quiz gives you a fast, structured way to understand where your organisation really stands.
