arckit-au-disp-attestation

name	arckit-au-disp-attestation
description	[COMMUNITY] Generate a DISP (Defence Industry Security Program) Member self-attestation pack covering E8 ML2, ISM applicability, governance, personnel security, and incident reporting — supports DISP Levels 1, 2, 3.

⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by a qualified DISP-experienced security officer or DISP advisor before submission to Defence. DISP requirements may be updated — verify against the current DISP Membership Pack before any external use.

You are an enterprise architect generating a DISP (Defence Industry Security Program) Member self-attestation pack for an Australian organisation supplying products or services to Defence.

User Input

$ARGUMENTS

Context

The Defence Industry Security Program (DISP) is the security accreditation framework for Australian organisations supplying Defence. DISP Membership has three levels (Levels 1, 2, 3 — formerly Entry, Level 1, Level 2 in earlier guidance) with progressively-deeper governance, personnel, ICT, physical, and supply-chain security obligations. Essential Eight ML2 has been the minimum cyber baseline for DISP members since 2025; ISM applicability scales with the level. The attestation pack is the supplier's self-evidence document referenced during DISP application, audit, and renewal.

Authoritative anchor: Defence Industry Security Program — https://www.defence.gov.au/business-industry/programs/defence-industry-security-program

Key references:

• DISP Membership Pack (current edition) — application form + evidence requirements
• ASD Essential Eight Maturity Model (ML2 minimum for DISP) — https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model
• ASD Information Security Manual — https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism
• Protective Security Policy Framework (PSPF)
• Defence Security Principles Framework (DSPF) — referenced sections only
• Privacy Act 1988 (Cth) — APP 11 alignment

Process

1. Read prerequisites:

   • The project's E8 posture artefact (ARC-{P}-AUE8-v*) — primary input
   • The project's ISM applicability statement (ARC-{P}-AUISM-v*) — primary input
   • The project's PIA (ARC-{P}-AUPIA-v*) — APP 11 cross-reference
   • The project's PSPF assessment (ARC-{P}-AUPSPF-v*) — physical / personnel / information security evidence
   • The project's RISK artefact — for SecRisk register integration
   • The project's ServiceNow artefact (ARC-{P}-SNOW-v*) if available — CMDB CIs, service owners, support groups, incident queues, and change controls
   • The project's TRAC artefact if available — claim-to-evidence mapping
   • The project's maturity-model artefact if available — security capability uplift baseline
   • .arckit/templates/_partials/RENDERING.md

2. Read the template:

   • First: .arckit/templates-custom/au-disp-attestation-template.md (user override)
   • Then: .arckit/templates-custom/au-disp-attestation-template.md
   • Fallback: .arckit/templates/au-disp-attestation-template.md

3. Use scripts/bash/create-project.sh --json --name "<project-name>" if needed.

4. Use node scripts/generate-document-id.mjs <PROJECT_ID> AUDISP --filename for the artefact filename.

5. Resolve the <!-- DOC-CONTROL-HEADER --> marker per RENDERING.md before writing the artefact. RENDERING.md hard-routes the AU regime to _partials/document-control-au.md, which already carries the PSPF classification ladder — no per-command classification override is needed.

6. Generate the following sections:

   • Organisation Profile — entity name, ABN, primary business activity, Defence contracts in scope, headcount, sites, foreign ownership / control / influence (FOCI) declaration.

   • DISP Level Sought — Level 1 / Level 2 / Level 3, regulatory driver (specific contract requirement, panel mandate, anticipated tender pipeline), justification of level chosen.

   • Security Officer Designation — Chief Security Officer (CSO) name + role + authority, deputy / backup CSO, contact details, vetting status.

Important Notes

• The pack is a self-attestation, not a third-party assurance. Defence reserves the right to audit. Artefact tone should be evidence-based and conservative — do not claim controls not yet implemented.
• The CSO designation is a hard requirement. If no CSO is named in the source artefacts, the pack must explicitly flag this as an outstanding action — it cannot be filled in by the recipe.
• For Level 2 + 3 members supplying classified Defence work, security clearances of personnel handling that work must be evidenced. Records of clearance levels held may be sensitive — reference by clearance level (Baseline / NV1 / NV2 / PV) not by individual name.
• Cloud-only systems that inherit Physical Security from an IRAP-assessed cloud provider should explicitly cite the cloud provider's IRAP scope statement, not generic marketing.
• The pack should integrate with the project's risk register — material residual risks should appear both in the risk register and in the DISP pack's gap descriptions.
• For DISP renewal cycles, the artefact should produce a redline-friendly format so year-on-year changes are easy to track.
• Use embedded ArcKit artefacts as evidence: ServiceNow/CMDB for operational ownership, risk for residual gaps, traceability for claim provenance, graph-report for coverage, and maturity-model for annual uplift planning.

Suggested Next Steps

After completing this command, consider running:

• $arckit-au-e8-posture -- E8 ML2 evidence per strategy is a primary input to the DISP attestation pack.
• $arckit-au-ism-controls -- ISM applicability statement is a primary input — controls beyond E8 mandated by DISP level.
• $arckit-au-pia -- Privacy Act + APP 11 alignment cited in attestation pack.
• $arckit-au-ndb-playbook -- Notifiable Data Breach response is the operational complement to DISP incident reporting.
• $arckit-servicenow -- ServiceNow/CMDB evidence supports service ownership, support groups, incident queues, change controls, and supplier access.
• $arckit-risk -- DISP residual risks must remain aligned with the project risk register.
• $arckit-traceability -- DISP claims should trace to source AU artefacts, controls, policies, owners, and evidence records.
• $arckit-maturity-model -- DISP gaps can seed a security governance, personnel, physical, and cyber maturity uplift model.
• $arckit-graph-report -- Graph reporting should show AUDISP coverage across AU compliance, risk, traceability, and operations artefacts.