Australia’s defence industrial base is expanding at pace. Record defence budgets, AUKUS commitments, foreign direct investment and a deliberate policy of broadening the supply chain mean that foreign organisations looking to invest into Australian Defence industry businesses, or organisations that have never previously worked with Defence, including technology companies, research institutions, foreign-owned businesses and mid-market manufacturers, are now looking to participate.

For many of these organisations, one of the first and most important requirements is the Defence Industry Security Program (DISP). Despite its significance, DISP can be an opaque framework for newcomers.

This article sets out some of the essentials that need to be considered when looking to invest in an existing Defence industry participant or establish operations in the Australian Defence industry.

What is DISP?

The DISP is a mandatory policy for Defence. Participation and compliance with DISP is generally applied by Defence on suppliers under contractual arrangements, often through the ASDEFCON contracting suite. It is the mechanism through which Defence assures itself that organisations handling its sensitive and classified information, assets and systems can do so securely.

DISP members must comply with Australian Government and Defence security legislation and policies, including the Defence Security Principles Framework (DSPF) (including control 16.1), the Protective Security Policy Framework (PSPF) and the Information Security Manual (ISM). Control 16.1 aims to provide assurance to Defence and other entities regarding the security practices of DISP members. It sets processes and accountabilities to manage security risks effectively to ensure that entities can protect sensitive information and maintain operational integrity when engaging with Defence.

These impose requirements around four security domains:

• Information and cyber security: Protecting sensitive digital information and systems. To meet the information and cyber security DISP membership requirements, an entity will need to demonstrate how they meet or exceed the Australian Signals Directorate (ASD) Essential Eight (E8) Mitigation Strategies at Maturity Level 2 across its ICT systems used to correspond with Defence.
• Personnel security: Ensuring the suitability of an entity’s employees and contractors to access government information and assets. This involves ensuring personnel have an appropriate standard of security competence, integrity and honesty.
• Physical security: Protection of people, property, and physical assets from actions and events that could result in damage or loss.
• Security governance: Ensuring suitable plans, processes, training, governance and people are in place to maintain the relevant level of security.

Under contractual arrangements with Defence, suppliers are required to obtain and maintain DISP accreditation throughout the term of the contract.

Failure to do so will be a breach of the contract and could lead to remedies including contract termination.

When is membership of DISP required?

DISP membership is mandatory when the relevant entity is working on classified information or assets; supplying, maintaining, storing or transporting weapons or explosive ordnance; providing security services for Defence bases or facilities; or DISP membership is mandated in a contract. In certain circumstances, the mandatory policy requires Defence not to contract with an entity that does not have (or at least has contractually committed to having within a specified period) DISP membership.

Who is eligible?

DISP membership is only open to Australian businesses and is subject to foreign ownership, control or influence (FOCI) tests. Foreign-owned entities looking to participate in the defence supply chain must carefully consider their corporate structure and governance arrangements. A company that does not meet the FOCI tests will not be eligible, regardless of its technical capabilities.

Foreign companies without an Australian business will need to establish a legal business entity in Australia with an Australian Business Number (ABN) or an Australian Company Number (ACN) to be eligible for DISP membership. Additionally, foreign companies will need at least one Australian director or senior executive who can obtain the relevant personnel security clearance to fulfil the roles of Chief Security Officer (CSO) and Security Officer (SO).

As an alternative, some foreign companies will, at least initially, team with an Australian prime and provide services through subcontracting arrangements. Depending on the nature and scope of services or goods to be offered, certain information may be able to be shared with foreign companies if there is a relevant country-specific security of information agreement in place and the foreign entity’s security practices and clearances are verified at a government-to-government level.

Personnel security clearances

Where providers are dealing with security classified information, Defence requires personnel to hold an Australian Government security clearance in accordance with the PSPF, which requires individuals to hold Australian citizenship, apart from some very limited exceptions.

This has significant implications for workforce planning, recruitment strategies and project staffing timelines.

DISP impact on transactions or investments

For organisations looking to enter the Australian market, DISP introduces a further layer of complexity.

For organisations looking to establish a new Australian business, in our experience, assessment of a DISP membership application can depend on the level of membership sought, the priority of Defence work to be undertaken, the suitability of the entity and the level of preparedness undertaken by the applicant.

While there is no direct cost associated with DISP membership (i.e. there is no membership fee), there are costs associated with implementing and maintaining security measures to meet both initial and ongoing DISP membership requirements. There are also ongoing obligations, including notifying Defence of any changes potentially impacting DISP membership, including matters relating to changes in ownership or control.

For organisations looking to acquire an existing Australian business that has current DISP membership, any change to ownership or control will need to be notified and will be subject to an updated FOCI assessment.

Breaches of DISP membership obligations could result in membership being terminated, which will adversely impact the entity’s ability to undertake Defence work, including that existing contracts may be terminated.

Any transaction involving a DISP member must therefore be carefully planned, with Defence engagement built into the timetable from the outset.

The broader regulatory landscape

DISP does not operate in isolation. Investors in the Australian Defence industry and new entrants will also need to consider other regulatory and contractual requirements relating to foreign ownership, including:

• any Foreign Investment Review Board (FIRB) approval;
• ACCC merger control clearances;
• the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) requirements;
• export controls permits/licences and arrangements if any export of controlled goods, services or technology will be required; and
• change of control contractual requirements of a DISP member target. Under existing contracts with Defence, it is highly likely that a transaction would constitute a change of control requiring Defence’s written consent. Often the contracts will allow Defence to terminate if consent is not obtained.

Each imposes its own requirements and timelines, and they frequently interact.

Takeaways for organisations considering entry into Australia’s defence supply chain:

• Assess early: Determine whether DISP membership is required and factor application timelines into your planning.
• Understand eligibility: Ensure your corporate structure satisfies FOCI requirements or consider what structural arrangements may be needed.
• Plan your workforce: Identify which personnel will require clearances and confirm they hold Australian citizenship.
• Build in Defence engagement: For transactions or restructures, incorporate notification and consent processes into your timetable from the outset.
• Recognise the complexity: The interaction between DISP, PSPF, ISM, contractual and other foreign ownership and interference regime requirements can be very intricate.

Australia’s growing investment in defence capability presents significant opportunities across many sectors. But participating in the supply chain carries rigorous security requirements that demand careful navigation. Understanding, and taking the appropriate approach to DISP is fundamental to operating successfully in this environment.