Compliance365 — Cyber, Privacy & AI Compliance Compliance365

DISP / ISM / IRAP readiness checklist (free)

Use this free DISP / ISM / IRAP readiness checklist to quickly gauge how prepared you are for Australian defence work. Each question maps to DISP categories, PSPF alignment, ISM baselines, system documentation, IRAP scope and evidence so you can see your gaps and plan a defensible path to assessment.

What this covers

DISP membership and governance, PSPF alignment, personnel and physical security, ISM technical controls, SSP/SRMP documentation, IRAP scope and evidence, and sovereign hosting obligations.

How scoring works

Select Yes / Partial / No for each question. We calculate an overall score and domain coverage so you can see where to focus next.

Free PDF output

Download a free, branded PDF readiness report with a score dial, domain breakdown, top gaps and detailed responses for internal governance or IRAP planning.

ISO 27001 ISO 27701 ISO 42001 Essential Eight SOC 2 DISP / ISM / IRAP

Governance & DISP

DISP categories, key roles, and alignment to PSPF / Defence expectations.

0/0 answered
DISP expectations vary significantly by category and level. Be explicit about what you are committing to.
Show examples
  • Documented decision on DISP membership categories and target levels.
  • Rationale aligned to Defence work types and data classifications.
  • Executive approval of DISP scope and roadmap.
Defence expects clear accountability for protective security matters.
Show examples
  • Formal appointment of a Security Officer (or equivalent).
  • Role description covering DISP, PSPF, ISM and IRAP responsibilities.
  • Evidence of escalation and reporting to executive or board.
PSPF alignment underpins DISP membership and Defence confidence.
Show examples
  • PSPF gap assessment or mapping document.
  • Action register addressing identified gaps.
  • Periodic review of PSPF alignment as requirements change.

People & Physical Security

Vetting, clearances, training, and facility security controls.

0/0 answered
Personnel security must match the sensitivity of information accessed.
Show examples
  • Baseline screening for all staff and contractors.
  • Active security clearances where required.
  • Clearance records and revalidation tracking.
Personnel changes are a key risk area for Defence engagements.
Show examples
  • Documented joiner/mover/leaver process.
  • Timely access removal and clearance updates.
  • Evidence of offboarding checks and attestations.
Training must be relevant to Defence obligations, not generic.
Show examples
  • Annual security awareness training with Defence-specific content.
  • Targeted training for staff handling sensitive information.
  • Training completion records.
Physical security controls must align to the sensitivity of work performed.
Show examples
  • Physical security assessment aligned to DISP/PSPF.
  • Defined security zones and visitor controls.
  • Secure storage for sensitive material.

Cyber & ISM Controls

Hardening, patching, monitoring, vulnerability management and incident response.

0/0 answered
Classification drives ISM control selection and assessment scope.
Show examples
  • Confirmed classification (e.g. OFFICIAL, OFFICIAL: Sensitive, PROTECTED).
  • Handling rules documented and communicated.
  • Alignment with Defence contract requirements.
ISM compliance is risk-based but deviations must be justified.
Show examples
  • Selected ISM baseline documented.
  • Register of deviations with risk acceptance.
  • Approval by appropriate authority.
Defence expects consistent, measurable cyber hygiene.
Show examples
  • System hardening standards aligned to ISM.
  • Patch and malware protection policies.
  • Compliance evidence from tooling or audits.
Logging supports detection, investigation and IRAP assessment.
Show examples
  • Central log collection (e.g. SIEM).
  • Defined log retention aligned to ISM.
  • Evidence of monitoring and alert response.
Vulnerability management demonstrates proactive risk reduction.
Show examples
  • Scheduled vulnerability scans.
  • Penetration test reports where required.
  • Remediation tracking and closure evidence.
Incident handling must meet Defence notification expectations.
Show examples
  • Incident response plan referencing Defence notification pathways.
  • Evidence retention procedures.
  • Post-incident reviews and improvements.

Risk Management & System Docs

System description, SSP/SRMP and keeping security documentation current.

0/0 answered
IRAP assessors rely heavily on accurate system documentation.
Show examples
  • System description document.
  • Architecture and data flow diagrams.
  • Dependencies and shared responsibility boundaries.
The SSP is a core artefact for ISM and IRAP.
Show examples
  • Current SSP aligned to ISM controls.
  • Clear ownership for each control.
  • Shared responsibility statements for cloud services.
Risk decisions must be explicit and documented.
Show examples
  • SRMP covering system threats and risks.
  • Risk treatments and acceptance decisions.
  • Regular SRMP reviews.
Resilience expectations increase with classification.
Show examples
  • Defined RTO/RPO aligned to classification.
  • Backup and DR test results.
  • Actioned improvement findings.
Clear authorisation pathways reduce IRAP friction.
Show examples
  • Identified Authorising Authority.
  • ATO briefing materials and cadence.
  • Ongoing risk and change reporting.

IRAP Planning & Evidence

IRAP scope, assessment approach, evidence packs and POA&M tracking.

0/0 answered
Clear scoping prevents assessment delays and rework.
Show examples
  • Defined systems, environments and locations.
  • Agreed assessment type (gap, full, reassessment).
  • Indicative time period.
Outstanding findings must be understood and tracked.
Show examples
  • Previous IRAP report.
  • Status of recommendations.
  • Evidence of remediation progress.
Well-organised evidence accelerates IRAP assessments.
Show examples
  • Central SharePoint or Confluence evidence register.
  • Clear folder structure mapped to ISM controls.
  • Access controls for assessors.
Defence expects transparent remediation tracking.
Show examples
  • POA&M with owners and due dates.
  • Regular status updates.
  • Closure evidence.

Contracts, Suppliers & Hosting

Security clauses, suppliers, and hosting / sovereignty expectations.

0/0 answered
Hosting location and sovereignty are critical Defence considerations.
Show examples
  • Documented hosting locations and regions.
  • Assessment against Defence sovereign requirements.
  • Risk acceptance where constraints exist.
Contracts must flow down Defence security obligations.
Show examples
  • Security and confidentiality clauses.
  • Incident notification timeframes.
  • DISP and Defence-specific obligations.
Third parties can introduce significant Defence risk.
Show examples
  • Supplier inventory and criticality assessment.
  • Defined shared responsibilities.
  • Supplier assurance evidence.
0%
Not started

Answer the questions to see your readiness.

📞 Microsoft Teams