Achieving accreditation under the Defence Industry Security Program (DISP) is an important milestone, but it is not the end of the process. DISP accreditation comes with ongoing compliance obligations that organisations must continue to meet for as long as they remain members.
Many organisations underestimate what happens after accreditation is granted. This can lead to missed reporting obligations, unmanaged changes, or gradual erosion of compliance over time.
This article explains what ongoing DISP compliance involves, what annual reporting requirements typically apply, and why maintaining compliance is an operational responsibility rather than a paperwork exercise.
Why ongoing compliance matters under DISP
DISP is designed to manage security risk across the Defence supply chain on an ongoing basis. Accreditation provides Defence with assurance at a point in time, but that assurance must be maintained as organisations, systems, and people change.
Security risks evolve. Personnel move roles, systems are upgraded, facilities change, and business activities expand. Ongoing compliance ensures that security controls remain aligned with current risk, not just historical conditions.
For Defence, ongoing compliance is how trust is sustained.
DISP accreditation does not expire automatically
DISP accreditation does not operate on a fixed-term certification cycle. Once accredited, an organisation remains a DISP member unless:
- Accreditation is suspended or revoked
- The organisation withdraws
- Defence determines that compliance has lapsed
However, this does not mean accreditation is permanent or unconditional. Defence expects organisations to actively demonstrate that security requirements continue to be met.
Annual reporting under DISP
One of the most visible ongoing obligations under DISP is annual reporting.
Each year, organisations are required to provide Defence with an update confirming that:
- Security arrangements remain in place
- There have been no unreported material changes
- Any identified issues have been addressed
Annual reporting is not intended to be burdensome, but it does require organisations to review their security posture honestly and systematically.
What annual reporting typically covers
While the exact format may evolve, annual reporting generally requires organisations to consider changes across the DISP security domains.
This may include:
- Updates to governance and security roles
- Changes in key or relevant personnel
- Personnel clearance status
- Changes to physical facilities or access arrangements
- Updates to cyber security controls or systems
- Any security incidents or near misses
The purpose is to confirm that accreditation remains appropriate and valid.
Managing changes between reporting periods
Ongoing compliance is not limited to annual reporting.
DISP requires organisations to notify Defence of material changes when they occur, rather than waiting for the next reporting cycle.
Material changes may include:
- Changes in ownership or control
- Appointment or departure of key personnel
- New facilities or relocation
- Changes to systems handling Defence information
- Changes in business activities affecting information classification
Failure to report material changes is a common compliance issue.
Personnel security as an ongoing obligation
Personnel security does not stop once clearances are granted.
Organisations must:
- Monitor clearance status
- Manage role changes and access adjustments
- Initiate clearance upgrades or cessations where required
- Ensure access aligns with current responsibilities
Changes in personnel circumstances may also need to be reported through appropriate channels.
Maintaining cyber security compliance
Cyber security is one of the most dynamic aspects of ongoing DISP compliance.
Organisations are expected to:
- Maintain implemented cyber controls
- Monitor systems for emerging threats
- Update policies and procedures as environments change
- Respond appropriately to cyber incidents
- Retain evidence that controls remain effective
Cyber compliance under DISP is about sustained capability, not one-time implementation.
Physical security over time
Physical security arrangements can change as organisations grow or relocate.
Ongoing compliance includes:
- Reviewing access control arrangements
- Managing visitor and contractor access
- Ensuring secure storage arrangements remain appropriate
- Updating controls when facilities change
Physical security controls that were appropriate at accreditation may not remain so indefinitely.
Governance and oversight expectations
DISP places strong emphasis on security governance.
Ongoing compliance requires:
- Clear ownership of security responsibilities
- Senior management oversight
- Regular review of security risks
- Effective reporting and escalation pathways
Where governance weakens over time, compliance issues often follow.
What happens if compliance issues arise?
If Defence identifies compliance concerns, it may:
- Request clarification or additional information
- Require remediation within a defined timeframe
- Conduct further assessment or review
- Impose conditions on accreditation
- Suspend or revoke accreditation in serious cases
Early identification and transparent communication are critical to managing issues effectively.
Common pitfalls in ongoing DISP compliance
Organisations often encounter difficulties where:
- DISP is treated as “done” after accreditation
- Annual reporting is rushed or delegated without oversight
- Changes are implemented without security review
- Knowledge is lost when key personnel leave
These issues are rarely intentional but can have significant consequences.
Building sustainable DISP compliance
Sustainable compliance is achieved when DISP obligations are integrated into normal business operations.
This includes:
- Embedding security into governance processes
- Aligning change management with security review
- Maintaining clear records and evidence
- Treating DISP as part of operational risk management
When security is embedded, compliance becomes manageable rather than burdensome.
Final thoughts
DISP accreditation is not a one-time achievement. It is an ongoing commitment to protecting Defence information and managing security risk responsibly.
Annual reporting and continuous compliance provide Defence with confidence that organisations remain trustworthy partners over time.
Organisations that understand and plan for ongoing DISP obligations are better positioned to maintain accreditation, avoid disruption, and support long-term engagement within the Defence supply chain.
Sustained compliance is what turns accreditation into lasting capability.
Most organisations entering the Defence supply chain underestimate what DISP actually requires or assume existing policies are enough.
The DISP Readiness Quiz gives you a fast, structured way to understand where your organisation really stands.
