# Australian DISP Member Self-Attestation Pack Playbook > **Guide Origin**: Community | **ArcKit Version**: [VERSION] `/arckit:au-disp-attestation` generates a Defence Industry Security Program (DISP) Member self-attestation pack. It consolidates the evidence base across the 4 DISP security domains (Governance, Personnel Security, Physical Security, Information & Cyber), captures the Foreign Ownership Control & Influence (FOCI) declaration, surfaces the supply-chain security posture, and structures the annual board attestation that DISP membership requires. DISP is the Department of Defence's supplier-side security accreditation. Level 2 (the most common operational ceiling for non-classified Defence work) requires demonstrable evidence across all four domains and depends on E8 ML2 as the cyber baseline. This pack is the consolidation artefact that the other AU commands feed into — run it last. --- ## Inputs This is the consolidation artefact. It draws from every other AU command's output: | Artefact | Purpose | |----------|---------| | `/arckit:au-e8-posture` (`ARC--AUE8-v1.0.md`) | E8 ML2+ baseline for the cyber domain | | `/arckit:au-ism-controls` (`ARC--AUISM-v1.0.md`) | ISM SoA underpinning Information & Cyber | | `/arckit:au-pia` (`ARC--AUPIA-v1.0.md`) | Personal information handling for Information & Cyber | | `/arckit:au-ndb-playbook` (`ARC--AUNDB-v1.0.md`) | Breach response capability | | `/arckit:au-pspf` (`ARC--AUPSPF-v1.0.md`) | PSPF maturity for Governance, Personnel, Physical, Information | | `/arckit:au-ai-assurance` (`ARC--AUAIA-v1.0.md`) | AI assurance for Defence-facing AI systems | | Stakeholders (`ARC--STKE-v1.0.md`) | Accountable authority, security advisor, FOCI signatory | | Risk register (`ARC--RISK-v1.0.md`) | Supplier-side risks | --- ## Command ```bash /arckit:au-disp-attestation ``` Output: `projects//ARC--AUDISP-v1.0.md` --- ## Pack Structure | Section | Contents | |---------|----------| | Document Control | Australian classification (UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET / TOP SECRET) | | Revision History | Version, date, author, changes, approvals | | Executive Summary | Organisation, DISP level sought, attestation readiness, key gaps, target attestation date | | 1. Organisation Profile | Legal entity and ABN, trading names, business activity, headcount, sites, Defence contracts in scope, level sought, target date | | 2. DISP Level Sought | Level, regulatory driver, justification, anticipated Defence work and classification | | 3. Security Officer Designation | Chief Security Officer, authority, clearance, deputy, contact, vetting status | | 4. Four Security Domains Coverage | Domain 1 Governance (cross-references the PSPF Governance and Risk domains), Domain 2 Personnel Security (PSPF Personnel domain), Domain 3 Physical Security (PSPF Physical domain), Domain 4 Information & Cyber Security (E8, ISM): status, evidence, gaps, remediation, sign-off | | 5. Essential Eight ML2 Evidence Per Strategy | Current ML, ML2 evidence, gap and sign-off for each of the eight strategies | | 6. ISM Applicability Highlights | The ISM control areas most material to DISP, with implementation status and gaps | | 7. Foreign Ownership, Control or Influence (FOCI) Declaration | Foreign ownership, board members, personnel access, supply-chain dependencies, mitigation plan | | 8. Supply Chain Security | Tier 1 suppliers, attestations held, last review, supply-chain risk management process | | 9. Incident Response & Reporting | Incident response plan, 24-hour Defence notification capability, NDB integration, last exercise, lessons learned | | 10. Security Awareness Training | Programme, modules, completion rate, refresher cadence, cleared-personnel briefings | | 11. Annual Self-Audit Plan | Scope, methodology, frequency, evidence retention, last and next audit | | 12. Attestation Statement | Statement of accuracy with CSO and Director sign-off, attestation date, re-attestation due | | 13. External References | Upstream ArcKit evidence, document register, citations, unreferenced documents, verification dates | | Visual Evidence Decision Rule | When a companion diagram is drawn, drafted with `Pending Input` labels, or recorded as a visual evidence gap | --- ## Regulatory Anchors - **DISP Member Manual** — authoritative source for DISP-level requirements - **Defence Security Principles Framework (DSPF)** — incorporated by reference for DISP suppliers - **ASD Essential Eight Maturity Model** — ML2 baseline for DISP Level 2 - **ASD Information Security Manual** — control evidence base for Domain 4 - **Privacy Act 1988 (Cth)** — for personal information handling - **Protective Security Policy Framework** — referenced across Domains 1, 2, 3, 4 - **Cyber Security Act 2024 (Cth)** — incident-reporting interactions --- ## When to Run - During DISP application or upgrade (Level 1 → 2 → 3) - Annually for ongoing DISP members (the attestation cycle) - On material change to FOCI, leadership, or the security posture (re-attestation may be required) - On significant security incident in attestation window --- ## Common Pitfalls - **Treating it as paperwork** — DISP attestation is a board-level statement of fact. Inaccuracies create criminal exposure under Defence security legislation. Validate every cross-reference. - **Thin FOCI declaration** — full ownership tree is required, including indirect control. Engage corporate counsel early if ownership is non-trivial. - **Inheriting evidence without verification** — if Domain 4 cites the ISM SoA, the underlying SoA must be current and accurate. Don't cite stale evidence. - **Missing sub-contractor coverage** — DISP suppliers carry obligations across the supply chain. Sub-contractor vetting evidence must be in the pack. --- ## Handoff This is the consolidation artefact for DISP attestation. It is read by the Department of Defence, Defence Industry Security Branch, and (where relevant) procurement-side security assessors. After board sign-off, the attestation cycle resets for 12 months.