DISP, Essential Eight & compliance consulting for Adelaide businesses.

Defence & AUKUS supply chain

Adelaide is home to the Australian Submarine Corporation (the centrepiece of SSN-AUKUS), BAE Systems, Hanwha, Saab, Thales, and Lockheed Martin. The AUKUS submarine programme will draw hundreds of South Australian SMEs into the defence supply chain over the next decade — most for the first time. Every new entrant needs DISP membership, which requires Essential Eight Maturity Level 2 as its information security baseline. Many also need ISO 27001 to satisfy prime contractor procurement requirements.

Space sector

The Australian Space Agency is headquartered in Adelaide, alongside a growing cluster of space technology companies — Myriota, Fleet Space Technologies, Southern Launch, and Inovor Technologies among them. Space businesses pursuing Australian Government contracts or international partnerships need ISO 27001 for information security assurance, and increasingly ISO 42001 for AI governance as AI-driven autonomy and data processing become central to space operations.

SA Government ICT procurement

SA Government agencies — including the Department for Industry & Trade (DIT), SA Ambulance Service (SAAS), and SA Health — require ISO 27001 from ICT and technology suppliers as a procurement standard. The SA Government Cyber Security Framework aligns closely with the ASD Essential Eight, making Essential Eight ML2 a practical prerequisite for government ICT work across the state.

Healthcare & medical devices

Adelaide has a growing medtech and biotech sector, including Signostics, Scinai Immunotherapeutics, and spinouts from Flinders University and the University of Adelaide. Medical device manufacturers and digital health businesses handling patient data need ISO 27001 for clinical data protection obligations, and ISO 27701 where the Privacy Act 1988 and health information handling requirements apply.

We're an Adelaide manufacturer entering the defence supply chain. Where do we start?

With Essential Eight, almost always. It is the control set primes ask about first, it is achievable inside a Microsoft 365 environment you already own, and it is the technical foundation DISP membership assesses. ISO 27001 becomes worthwhile when you need something certifiable to show commercial buyers as well — many suppliers do both, in that order.

Does AUKUS change the security requirements for SA suppliers?

The direction of travel is toward more scrutiny of supply chains, not less, and primes have been tightening flow-down conditions accordingly. The practical implication for most SA suppliers is unchanged: DISP membership where Defence work requires it, Essential Eight maturity underneath, and ISM-aligned controls where you touch Defence data. What has shifted is how early in a tender those questions now arrive.

Do you deliver compliance consulting in Adelaide?

Both remotely and on-site. Most work is delivered remotely. For Adelaide clients we can travel for kickoff workshops, leadership briefings, and internal audit sessions where in-person presence adds value. No interstate travel cost premium — engagements are fixed-price.

What do defence suppliers in Adelaide need for AUKUS work?

Most Adelaide businesses joining the AUKUS supply chain for the first time need DISP membership as a minimum requirement from the prime contractor. DISP requires Essential Eight Maturity Level 2 as its information security baseline. Beyond DISP, primes like ASC, BAE Systems, and Lockheed Martin typically require ISO 27001 certification from their tier-2 and tier-3 suppliers for any contract involving sensitive defence information. We help businesses work through DISP and ISO 27001 together where scope allows — significantly more efficient than sequential engagements.

What's involved in DISP for a first-time applicant?

DISP (Defence Industry Security Program) is administered by the Department of Defence and requires demonstrated governance across physical security, personnel security, and information security. For most first-time Adelaide applicants, the information security workstream is the most substantive — Essential Eight ML2 controls must be implemented and evidenced before assessment. You also need a documented security policy framework, a nominated Facility Security Officer (FSO), and personnel clearance arrangements appropriate to the work you will be doing. We handle the information security workstream end-to-end and coordinate with your FSO on the broader DISP application.

How does Essential Eight ML2 relate to DISP?

Essential Eight Maturity Level 2 is effectively a non-negotiable prerequisite for DISP membership. DISP assessors use the Essential Eight as their primary lens for evaluating information security maturity. An organisation without ML2 controls in place will not pass a DISP assessment. We build ML2 controls inside your existing Microsoft 365 environment — application control, patching, macro restrictions, MFA, and the remaining strategies — with evidence structured to satisfy DISP assessors directly. Most Adelaide SMEs reach ML2 in 8–12 weeks.

DISP + Essential 8 ML2

Defence and AUKUS supply chain

South Australia's shipbuilding and sustainment programmes at Osborne draw a long supply chain into Defence Industry Security Program requirements. DISP references ISM controls, with Essential Eight maturity as the practical technical baseline.

ISO 27001 + Essential 8

Space sector

Adelaide hosts the Australian Space Agency, and space-sector suppliers frequently sit across both civil and defence programmes. That combination tends to produce commercial certification requirements and Commonwealth control expectations at the same time.

ISO 27001 + Essential 8

SA Government agencies

The South Australian Cyber Security Framework sets expectations for agencies, and those obligations reach suppliers through contract. ISO 27001 provides the independently audited posture procurement teams look for.

ISO 27001 + Essential 8 ML2

Advanced manufacturing

Manufacturers entering defence and aerospace supply chains inherit security conditions from their primes, usually well before they hold any certification of their own. Starting with Essential Eight maturity is the fastest route to being contract-eligible.