As security threats continue to evolve, maintaining robust security practices is critical for organizations working within Australia’s defence industry. One of the key mechanisms used by the Defence Industry Security Program (DISP) to assess and strengthen member security is the Deep Dive Audit (DDA). These comprehensive assessments help organizations measure their security maturity, identify areas for improvement, and ensure ongoing alignment with Defence security requirements.  

What is a Deep Dive Audit? 

A Deep Dive Audit (DDA) is a detailed evaluation of a DISP member’s security maturity and compliance with DISP requirements. The audit examines how effectively an organization is implementing security controls and managing its security obligations across the business.  

Importantly, DDAs assess compliance against key security frameworks, including: 

• The Defence Industry Security Program requirements. 

• The Australian Signals Directorate (ASD) Essential Eight at Maturity Level 2. 

• Defence Security Principles Framework (DSPF) Control 16.1.  

• By taking a holistic view of security, DDAs help organizations understand not only whether controls exist, but also how effectively they are operating in practice 

Security Across All Four Domains 

Unlike targeted assessments that focus on a single area, Deep Dive Audits review all four DISP security domains:

• Security Governance

Assessment of policies, procedures, risk management practices, leadership oversight, and accountability arrangements that support an organization’s security program. 

• Personnel Security

Review of personnel screening processes, security awareness activities, insider threat management, and the protection of sensitive information by trusted employees and contractors. 

• Physical Security

Evaluation of physical controls is designed to protect facilities, assets, and information from unauthorized access or compromise. 

• Information and Cyber Security

Assessment of cyber security controls, system protections, monitoring capabilities, and alignment with the Essential Eight maturity requirements.  

What Happens During a DDA? 

Deep Dive Audits are designed to provide a thorough understanding of an organization’s security posture. 

Typical audit activities include: 

• Detailed reviews of security documentation. 

• Assessment of policies, procedures, and security records. 

• Interviews and discussions with key security personnel. 

• Onsite assessments and validation of security controls. 

• Examination of compliance against DISP requirements and relevant security frameworks.  

These activities allow auditors to validate whether security controls are effective, sustainable, and appropriately embedded across the organization.  

From Assessment to Improvement 

A DDA is not simply a compliance exercise. Its primary objective is to help organizations strengthen their security capability. 

Following the audit, members receive a report that outlines: 

• Areas of compliance. 

• Identified gaps or non-compliance issues. 

• Recommended improvements. 

• Required remediation activities where necessary.  

This provides organizations with a clear roadmap for enhancing their security maturity and reducing risk. 

The Importance of Remediation 

The audit process does not end when the report is delivered. 

Following a Deep Dive Audit, organizations work closely with DISP to address any identified security gaps and provide evidence that corrective actions have been implemented. Assurance activities remain open until all agreed recommendations have been satisfactorily completed.  

This focus on remediation ensures that audit findings translate into meaningful security outcomes rather than remaining as recommendations on paper 

Maintaining Continuous Assurance 

Deep Dive Audits form part of a broader DISP assurance framework that includes Annual Security Reports (ASRs) and Ongoing Suitability Assessments (OSAs). Together, these activities provide Defence with confidence that members are maintaining appropriate security standards throughout their participation in the program 

Organizations may also be selected for future assessments as part of ongoing assurance activities, reinforcing the importance of continuous improvement and sustained compliance.  

Why DDAs Matter 

For DISP members, Deep Dive Audits provide more than regulatory oversight. They offer an opportunity to evaluate security practices, strengthen organizational resilience, and demonstrate commitment to protecting Defence information, assets, and capabilities.  

As the threat landscape becomes increasingly complex, organizations that embrace the DDA process as a driver of continuous improvement will be better positioned to manage risk, meet Defence expectations, and contribute to a stronger and more secure defence industry ecosystem.