Sector · Defence industry & supply chain
Meet the Essential Eight at the maturity level your contract names.
DISP membership and primes' flow-down clauses ask for a maturity level and an ISMS. Most suppliers answer with a spreadsheet and hope.
What gets asked
The stack.
The standards this sector is asked for, and why.
ACSC Essential Eight
The Australian Signals Directorate's eight mitigation strategies, assessed at maturity levels 1–3.
ISO/IEC 27001:2022
The international standard for an information security management system (ISMS).
- DISP membership
- Prime-contractor flow-down (ML2 is the common ask)
- Commonwealth procurement
The first eight weeks
A worked plan.
What a typical programme looks like on ISO Assist. Scope and existing evidence move the dates; the shape holds.
- WEEK 1
Adopt E8 and 27001. 152 requirements and 93 controls appear with owners. Scope statement drafted.
- WEEK 2–3
Assessment answered per requirement; evidence linked as you go. Exceptions register started for compensating controls.
- WEEK 4–5
Policy set from the library, adapted and approved. Access reviews and asset register populated.
- WEEK 6–7
Gaps worked through the actions engine. Internal audit scheduled and run in-app.
- WEEK 8
Maturity report and auditor pack frozen and hashed. Ready for the prime or the DISP assessor.
Registers that matter
What you will actually maintain.
Registers are data on a generic engine: pack-defined columns, CSV in and out, evidence links per row.
Example
Illustrative, a typical programme, not a named customer.
An engineering supplier reaching ML2 evidence coverage across all eight strategies in one quarter, with 27001 Stage 1 booked for the following month.
Reading
From the blog.
Book the Defence demo.
Bring your tender clause or client request. We adopt the standards it names, live.