Home Industries Defence
IT for Defence industry: DISP and Essential Eight Maturity Level Two
Townsville is a Defence city. If you supply Defence, or want to, your IT has to meet the Defence Industry Security Program’s cyber standard. We help you get there and stay there.
In short
Curity IT Solutions helps Townsville and North Queensland Defence suppliers meet the ICT and cyber security requirements of the Defence Industry Security Program (DISP). DISP members must meet the full ASD Essential Eight at Maturity Level Two (ML2) across the corporate systems they use to work with Defence. We assess your current maturity, prepare you for the DISP Cyber Security Questionnaire, deliver the ML2 uplift and keep the controls and evidence maintained.
What DISP requires of your IT
According to the Department of Defence, DISP members must meet or exceed the Essential Eight Mitigation Strategies at Maturity Level Two across the ICT corporate systems used to correspond with Defence. Assessments against only the “top four” strategies concluded on 15 November 2025, and all members are now required to achieve and maintain the full Essential Eight at ML2.
- Applicants complete a Cyber Security Questionnaire, which includes 107 Essential Eight controls
- A point-in-time cyber assessment follows, and a Maturity Action Plan may be required to reach ML2
- Members submit an Annual Security Report and must report changes to their cyber posture
- A new or changed managed service provider is one of the changes members must report
Requirements change. Always check the current DISP cyber and assurance guidance.
How we deliver Essential Eight ML2 uplift
- Assess each of the eight strategies against ML2 and record the evidence
- Agree a prioritised plan that fits your Maturity Action Plan timeframes
- Implement the controls in stages, mostly within Microsoft 365, Intune and the tools you already have
- Prepare the evidence you need for the Cyber Security Questionnaire and annual reporting
- Monitor and maintain the controls, so you stay at ML2 rather than slipping back
Do you need to be a DISP member to help us?
No. DISP membership applies to the businesses that work directly with Defence. Curity isn’t a DISP member, but we follow the same practices in our own business, and our job is to support the companies that work for Defence to meet and maintain their DISP obligations.
More than a one-off project
ML2 has to be maintained, not just reached. Our managed IT plans keep patching, application control, MFA, backups and administrator access in line, with 24/7 SOC and NOC monitoring for Full Managed and Remote Managed clients.
Questions Defence suppliers ask us
What Essential Eight level does DISP require?
Maturity Level Two across all eight strategies, applied to the corporate ICT systems you use to correspond with Defence.
Can we join DISP before reaching ML2?
Defence has introduced a conditional membership pathway that lets applicants progress before their Maturity Action Plan is fully complete. Check current DISP guidance for your situation.
Is Curity a DISP member?
No. Curity doesn’t work directly for Defence, so it doesn’t need DISP membership itself, but we follow the same practices. Our role is to support the businesses that do.
How long does Essential Eight ML2 uplift take?
Typically 5 to 8 weeks, depending on your starting point and the level of detail the uplift program requires.
Do we have to tell DISP if we change IT providers?
Yes. DISP lists a new or changed managed service provider among the cyber changes members must report.
Is DISP membership mandatory?
It is mandatory for some work, such as handling classified information or where a Defence contract requires it, and recommended for businesses seeking to work with Defence.
Find out how far you are from ML2
A free security review with a trained security professional, onsite or remote: one 30-minute session to collect information and a second to present our findings.