DISP · Defence industry · Compliance
DISP membership levels, and which one you actually need
DISP runs at Entry Level and Levels 1 to 3 across four security domains. Most defence suppliers need less than they assume. Here is how to work out which.
Published 31 August 2026 · 2 min read
The Defence Industry Security Program is how Defence assures the security of the businesses in its supply chain. If you want to hold a Defence contract, at some point someone will ask whether you are a DISP member, and the next question, which trips up more organisations than the first, is at what level.
Four levels, four domains
DISP membership is not a single badge. Membership is set per security domain, and the levels align to the classification of the information you handle:
- Entry Level is for entities dealing with OFFICIAL and OFFICIAL: Sensitive information.
- Level 1 is PROTECTED.
- Level 2 is SECRET.
- Level 3 is TOP SECRET.
Because the level is set per domain, an organisation can sit at different levels in different domains. That is normal, and it is usually cheaper than levelling everything up to match the highest single requirement you carry.
Most organisations overscope this
The common failure is deciding the level from ambition rather than from contracts. A higher level is a heavier ongoing obligation, and the obligation does not pause when the contract you bought it for ends.
Defence’s own guidance points applicants at Entry Level for the physical security and the information and cyber security domains unless there is an existing accreditation or an explicit requirement for something higher. That is a useful default. Start from the classification of the information your contracts actually put in your hands, not from the classification you expect to handle one day.
One practical constraint worth knowing early: the ability to sponsor security clearances is not available at Entry Level. If your delivery model depends on cleared personnel you sponsor yourself, that shapes the level you need, and it is better established before you apply than after.
What membership costs you
There is no membership fee for DISP. The cost is not the application; it is the governance you have to stand up and then keep running: a security management plan that reflects what you actually do, a named security officer, personnel security processes, reporting obligations, and an annual cycle that has to happen whether or not anyone is chasing you for it.
Organisations that treat DISP as a form to submit tend to pass the application and then fail quietly over the following two years. The membership is the beginning of the obligation, not the end of it.
Where to start
- List the contracts and tenders that are driving this, and the highest classification each actually involves.
- Set a target level per domain from that list, not from the highest number in it.
- Establish whether you need to sponsor clearances yourself, because that decision constrains the rest.
- Work out who your security officer will be, and whether that is a role they have the time and standing to hold.
Empire Protection takes defence suppliers through the application and the governance behind it, and holds the security officer role on retainer where an organisation does not have someone to put in the seat.
General information, not advice for your circumstances. Obligations change: confirm anything you intend to rely on against the current instrument.