DISP membership is the gateway to Australia's Defence supply chain, and its personnel security domain expects organisations to screen the people who handle Defence information and keep them security-aware. A documented security awareness training programme is one of the cheapest gaps to close before a Defence Industry Security Program application or an annual security report. This guide covers what DISP expects in 2026, what to train, and how to produce the evidence assessors ask for.
TL;DR
- DISP personnel security expects staff handling Defence information to be screened and security-aware - documented training records are expected evidence.
- No single course is mandated. What counts is a programme with completion records, phishing simulation results and reporting behaviour.
- Prioritise phishing and social engineering, sensitive-information handling, clearance culture and fast incident reporting.
- A platform-delivered cadence - monthly short modules plus a phishing simulation - produces that evidence without a consultant on retainer.
What DISP is and who needs it
The Defence Industry Security Program is the Department of Defence's framework for managing security across the Defence supply chain, underpinned by the Defence Security Principles Framework, Principle 16, Control 16.1. Any Australian entity seeking to work on Defence tenders, contracts or projects involving classified or sensitive information, assets or capabilities needs DISP membership, and depending on the work it can be mandated by the contract.
Membership is multi-level and assessed across four domains: governance, personnel security, physical security, and information and cyber security. There is no membership fee, but the controls behind each domain carry real cost, and DISP membership does not guarantee Defence contracts - those still run through normal procurement.
Where security awareness training fits
Personnel security is where training lives. DISP assesses whether people with access to Defence information are appropriately screened and security-aware, higher membership levels require staff to hold Australian Government security clearances, and Defence's own membership benefits include access to security training and materials, including cyber security guidance. The obligation to train sits with the member organisation: Defence provides material and advice, and your annual security report needs to show a programme that actually runs.
In practice, assessors and prime contractors look for the same three artefacts: a training plan, completion records for every person with access, and evidence that staff report security concerns and suspected incidents. A one-off session at onboarding does not produce the third artefact.
What to train Defence staff on
- Phishing and social engineering. Cleared staff and Defence suppliers are attractive targets, and the lure usually arrives as a routine email: a changed bank detail from a prime, a document share from a project manager, a portal login that looks like your Defence systems.
- Handling sensitive information. Need-to-know access, marking, storage, transmission and destruction of Defence information, including the rules that change when staff work remotely.
- Clearance culture. What a clearance obliges staff to report - foreign contacts, travel, life changes - and why silent non-reporting is the risk, not the reporting.
- Supply-chain impersonation. Urgent payment or instruction emails that impersonate a prime, a sub or a Defence official; verify through a known channel before acting.
- Devices and media. Removable media rules, personal device boundaries and clean-desk expectations around Defence information.
- Incident reporting speed. How to report a suspected compromise in minutes rather than days, and who to tell first.
A 12-month cadence that produces evidence
| Month | Focus | Evidence it produces |
|---|---|---|
| 1 | Baseline phishing simulation | Baseline click and report rates by team |
| 2 | Phishing and social engineering module | Completion records |
| 3 | Sensitive-information handling module | Completion records, policy acknowledgement |
| 4 | Phishing simulation with a harder lure | Trend against baseline |
| 5 | Supply-chain impersonation and payment fraud | Completion records |
| 6 | Incident reporting drill | Report-rate trend, response times |
| 7-12 | Repeat the cycle, add clearance-culture refreshers | Monthly reporting pack for the annual security report |
A platform-delivered programme runs this cadence automatically: enrolment from Microsoft 365 or Google Workspace, monthly course drops, due and overdue reminders, and a phishing simulation each month with auto-enrolled remediation for anyone who clicks. Security awareness training covers what the cadence includes, phishing simulation covers the testing side, and human risk reporting turns the results into the per-team evidence an annual security report needs.
FAQ
Is security awareness training mandatory for DISP membership? Defence does not mandate a specific course, but DISP personnel security requires staff handling Defence information to be security-aware, and training records are the standard way to evidence it. Applications and annual reports that show a running programme with completion data present far better than a policy document alone.
What training does DISP actually require? Nothing prescribed. What assessors want to see is a documented programme covering the risks of your work with Defence - typically phishing, sensitive-information handling and incident reporting - delivered to everyone with access, with records.
How often should defence contractors run awareness training? Monthly short modules with a monthly phishing simulation is the cadence most programmes land on. It produces twelve evidence points a year without pulling staff off delivery work for day-long sessions.
Can we use our training platform's reporting in the DISP application? Yes - training plans, per-person completion records and phishing simulation results are exactly the kind of evidence a DISP application and annual security report draw on. The accreditation assessment itself remains Defence's.
What evidence should we keep for the annual security report? A training plan for the year, per-person completion records, monthly phishing simulation results with the trend against baseline, and any real-incident reports with their outcomes. Human risk reporting packages exactly this set.