DISP, the Essential Eight & ISM-2074
What a Defence customer now expects of a contractor's AI posture.
The big idea
The Defence Industry Security Program (DISP), under the DSPF, is how industry demonstrates security maturity. Since Q3 2024 the cyber baseline is Essential Eight Maturity Level 2 across all eight strategies. With the December 2025 ISM adding ISM-2074 (maintain a general-purpose AI usage policy), an AI usage policy is now part of the cyber posture a DISP member is expected to hold — and a DISP audit will increasingly ask to see it, plus evidence of staff training.
Key insight: For industry, ‘doing AI safely’ is now a DISP expectation, not a nice-to-have: expect to show an AI usage policy aligned to ISM-2074 and evidence your staff are trained.
What you'll see
How DISP, the Essential Eight and ISM-2074 fit together for contractors.
What DISP now expects on AI
The contractor's compliance picture. Tap to expand.