A practical security architecture for small and medium enterprises focused on the Australian Defence Industry Security Program (DISP).
 
Unofficial independent research edition 1.3
Evidence cut-off: 11 September 2026
Also available as a paperback edition via Amazon.
 
DISP is free to join. Getting it wrong is not.
 
This guide is for the Australian SME that may need Defence Industry Security Program (DISP) membership up to PROTECTED, and for the business that wants a usable security baseline even if Defence is not the customer. It is written for the owner deciding whether to proceed, and for the security officer who has to turn that decision into people, premises, evidence and systems.
 
Official policy is public. What is missing is a working model: what to organise first, what not to buy, which decisions are separate, and what evidence a small firm should actually hold. That is what this edition supplies.
 
What it is
 
An 88-page planning architecture across the four DISP domains — governance, personnel, physical security, and information/cyber — with a three-environment company model and a separate Defence route through DPN/DREAMS. It shows how PSPF, DSPF, ASD’s ISM and Essential Eight meet in one business, and it keeps those frameworks from being treated as one legal pile.
 
You get:
reading routes for the owner, the security lead, and firms with no Defence trigger
a four-domain journey and a security-office operating map
personnel lifecycle procedures, including joiners, movers, leavers, contractors and visitors
premises, keys, paper, print, waste and conversation controls, not only cloud architecture
three ICT options compared on the same five-user scope, with a three-year planning cost
permitted flows and release decisions that do not confuse a transfer with a downgrade
acceptance tests across all four domains
14 open questions that must be closed with the customer before money is committed
a dated source register of 89 public references, checked to 11 September 2026
 
The language is deliberate. MUST, CONDITIONAL, SHOULD and OPTION are not decoration. Membership is not a clearance. An IRAP report is not system authorisation. A Class C container is not a room approval. A hosted desktop does not remove screens, administrators, backups or paper.
 
Why buy this when so much is free online?
 
The material that's free online is the compliance framework, not how to do it or how many ways I could meet that compliance. An employee or DISP-aware consultant will spend the first day explaining the same distinctions, usually at several hundred dollars an hour. This guide is that first week of orientation, already done, already sourced, and already stress-tested against the mistakes SMEs actually make: treating a vendor assessment as approval, putting PROTECTED work in a collaboration tenant, buying a safe and calling the site finished, or costing only the licence.
 
The planning model in the guide puts a five-user managed path near A$361,000 over three years. One avoided false start pays for this PDF many times over. The price is for the synthesis, the conflict log and the operating design. It is not a membership fee and it is not a quote.
 
What it is not
 
This is unofficial independent research. It is not a Department of Defence publication. SRMBOK does not issue government approvals. Edition 1.3 does not include supplier quotes, a completed statement of applicability, or editable worksheets. No organisation, product, site or system is declared authorised. Recheck current portal instructions, prices and customer conditions before you act.
If you need a turnkey application pack, this is the wrong purchase. If you need to know what to organise on Monday, what evidence to keep, and which questions only Defence or the customer can close, this is the guide.
 
Edition 1.3
Prepared for SRMBOK. Editorial responsibility: Julian Talbot.
Current editions and corrections: srmbok.com