Most civil SMEs never look at Defence infrastructure tenders. It reads as a closed market for large contractors with security clearances, and the assumption is close enough to true at the head-contract level that it discourages a second look.
Underneath that, Defence maintains bases, training areas, airfields, ports and housing across every state and territory, and that estate needs roads, drainage, hardstand, earthworks, fencing and services in the same way any other estate does. The work exists. The buying system is what is unfamiliar. The airfield and port elements of that estate carry requirements closer to civil aviation and maritime facilities than to ordinary base works — see our guide to airport, port and freight terminal civil works.
Why Defence is worth understanding
Three characteristics make Defence structurally attractive to a civil contractor who can get in.
- Continuity. Estate maintenance and upgrade is ongoing rather than project-cyclical, which suits a business that wants a steady base load rather than peaks.
- Geographic spread. Defence property sits in regional locations where the competitive field is thinner than in capital cities.
- Industry participation obligations that favour Australian SMEs. The thresholds are materially lower than the general Commonwealth position — see §05.
Against that: the compliance overhead is higher than council work, the security requirements are real, and the head contracts are usually held by managing contractors — which shapes the route in.
What makes Defence different
| Council / state civil work | Defence | |
|---|---|---|
| Security | Site induction | Base access control, personnel vetting, and DISP membership where mandated |
| Prequalification | Road authority or council schemes | Defence’s own arrangements, plus the head contractor’s, plus DISP where required |
| Route to work | Direct tender or panel | Frequently subcontract under a managing contractor |
| Industry participation | State local content policies | Defence Policy for Industry Participation, from $4M / $7.5M[2] |
| Site conditions | Public environment | Operating base — escorts, restricted hours, live aviation or munitions areas |
How the Defence estate is actually delivered
Understanding the delivery structure matters more than understanding the security system, because it tells you who your actual client is. Defence does not, in the main, engage civil contractors directly.
Two programs matter to a civil SME.
The Estate Works Program is the recurring national program of works across Defence establishments — a pipeline in the order of $900 million a year. National Program Services for it were awarded to JLL under a six-year contract to coordinate the pipeline and advise on risk, investment prioritisation and project development, building on delivery of some 1,510 projects worth approximately $3.8 billion across Defence establishments since 2014.[4]
Capital facilities and infrastructure sits with Defence’s Capital Facilities and Infrastructure branch, which plans, develops and delivers capital works across the estate through an explicitly outsourced model — procuring industry to manage, design, construct and provide specialist skills in support of each project.[4]
Between the two sits a layer of Project Delivery Services contractors — firms appointed to manage delivery on Defence’s behalf. As PDS contractors they issue and manage numerous subcontracts for design, construction and services, many of which can be picked up by smaller businesses.[4]
| Layer | Who it is | What it means for you |
|---|---|---|
| Defence | Estate & Infrastructure Group — the asset owner | Sets the requirement, the standards and the security position. Rarely your contracting party |
| National program services | Appointed to coordinate the Estate Works Program pipeline | Shapes what comes to market and when |
| Project delivery services contractors | Managing contractors appointed to deliver projects | Your realistic client. They let the civil subcontracts |
| Head contractors | Builders and civil contractors holding project contracts | Also a realistic client, particularly on larger packages |
| You | Civil subcontractor | Earthworks, drainage, hardstand, roads, services, fencing |
The practical consequence is the same one described in our guide to subcontracting to Tier 1 civil contractors, with one difference: in Defence, the layer above you is often a project management firm rather than a builder, and its procurement behaves more like a client’s than a contractor’s — more formal, more documented, and more interested in your systems.
That also explains a common frustration. Civil contractors watching AusTender for Defence civil packages see very few, because the packages are let by the delivery layer rather than advertised by Defence. Watching the wrong level of the market produces the impression that there is no work.
Where the work is published
Defence publishes more forward information than most Australian buyers, and almost no civil SME uses it.
- The Capital Facilities and Infrastructure Forward Works Program.[4] A published forward pipeline of capital works. This is a target list — it tells you which establishments will have work, roughly when, and at what scale, well before anything reaches tender.
- AusTender. Head contracts and services contracts are published here, which is how you identify the delivery-layer firms holding work near you. Our guide to AusTender covers the mechanics.
- ICN Gateway. Used to surface subcontract packages on major projects — see ICN Gateway.
- Contract award notices. Who won the project management and head contract roles at each establishment, and when those contracts expire.
An afternoon spent cross-referencing the forward works program against establishments within your service radius, and then against award notices, produces a short list of firms who will be letting civil packages near you in the next two years. That is a far better use of time than watching for advertised Defence civil tenders that will mostly never appear.
DISP: what it is and when you need it
The Defence Industry Security Program supports Australian entities to understand and meet their security obligations when engaging in Defence tenders, contracts and projects. It is a multi-level, membership-based program, open to any Australian entity looking to become part of the Defence industry supply chain.[1]
To become a member an entity must meet the initial eligibility criteria, with additional criteria depending on the level of membership required.[1]
The question civil contractors actually need answered is when it is mandatory. Membership may be mandated depending on the type of work an entity undertakes with Defence, or by contractual requirement, and is mandatory for organisations handling classified information, weapons or munitions, providing security services for Defence facilities, or where required by contract.[1]
For a civil contractor, the practical reading:
- Straightforward civil works on an unclassified part of a base may not require DISP membership at all — but it may be required by the contract, which is the limb that catches people.
- Work touching classified information — including drawings of certain facilities — moves you into mandatory territory.
- The contract decides. Read the tender documents for the DISP requirement and its level before assuming either way.
- Head contractors may require it of subcontractors regardless of Defence’s own position.
The four membership levels
DISP offers four membership levels, each aligned to an Australian Government security classification, with each level granting access to a tier of classified information and requiring progressively more stringent controls.[5]
| Level | Classification | Personnel security | Realistic for a civil SME? |
|---|---|---|---|
| Entry Level | OFFICIAL and OFFICIAL: Sensitive | No clearance sponsorship. Relies on workforce screening to AS 4811:2022[5] | Yes — this is the one |
| Level 1 | PROTECTED | Sponsor Baseline clearances for staff handling PROTECTED information[5] | Occasionally, where the contract requires it |
| Level 2 | SECRET | Typically NV1 clearances[5] | Rarely for general civil work |
| Level 3 | TOP SECRET | NV2 clearances[5] | No |
The single most useful thing in this table for a civil contractor is the first row. Entry Level does not require you to sponsor security clearances at all — it relies on workforce screening to the Australian Standard. For a business with a rotating crew of plant operators and pipelayers, that is the difference between a workable obligation and an impossible one.
The corollary is worth stating just as plainly: if a Defence package requires Level 1 or above, every worker touching the relevant information needs a sponsored clearance, and clearance processing is measured in months. That is a programme constraint before it is a compliance one, and it should be established before you price the work.
The four security domains
Each level is assessed across four security domains — governance, personnel, physical, and ICT/cyber security — with controls becoming progressively more stringent as the level rises.[5]
Two features of that structure have real practical consequences.
Membership levels are assessed independently for each domain. An organisation can hold Entry level for physical security while holding Level 1 for personnel security.[5] That is genuinely useful for a small business: you can meet a higher requirement in the one domain a contract actually demands without uplifting everything.
Governance is the exception. Governance must always match or exceed the highest level of membership sought for any other category.[5] So if you need Level 1 personnel security for one contract, your governance has to reach Level 1 too — the domains are independent upward but governance is the floor beneath all of them.
| Domain | What it covers | What it means for a small civil business |
|---|---|---|
| Governance | Security policy, roles, risk management, reporting and incident handling | A named security officer and a documented security governance framework. Must match your highest level in any other domain |
| Personnel | Screening and, above Entry Level, sponsored clearances | At Entry Level, screening to AS 4811:2022 — an achievable standard for an ordinary employer |
| Physical | Protection of premises, documents and devices | Entry Level expects physical protections for offices and devices — proportionate to a depot and site office |
| ICT / cyber | Security of the systems you use to correspond with Defence | The hard one. See below |
The Essential Eight requirement
This is the requirement that most often surprises a civil contractor, and it is the one worth understanding before deciding whether Defence is a market you want.
Since the September 2024 uplift, DISP requires the full Essential Eight at Maturity Level 2 as the minimum for every membership level, from Entry Level upward, assessed across the ICT systems you use to correspond with Defence.[5]
Read that carefully. It is not scaled by level. A civil contractor seeking Entry Level membership for unclassified works on a base faces the same cyber security baseline as a business handling PROTECTED information. The underlying controls, and the far lighter version of them that ordinary government tenders ask about, are covered in our guide to cyber and information security in civil tenders.
The Essential Eight is the Australian Signals Directorate’s set of baseline mitigation strategies — application control, patching applications, configuring macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Maturity Level 2 is a substantive standard rather than a checkbox.
Three honest implications for a civil SME:
- This is the largest single cost of DISP membership for most small contractors. A business running a couple of laptops and an off-the-shelf email account is not at Maturity Level 2, and getting there involves either capable internal IT or an external provider.
- It applies to the systems you use to correspond with Defence — which is a narrower scope than your whole business, and worth scoping carefully rather than assuming it captures everything.
- It is a standing obligation, not a one-off. Maturity has to be maintained and evidenced, like your ISO certifications — see the prequalification trifecta.
If DISP membership is not actually required for the work you are chasing — and for unclassified civil works on an accessible part of a base it frequently is not — this is a strong argument for confirming that in writing before investing anything. See §05.
Security clearances and a small workforce
Where a contract does require sponsored clearances, the practical difficulty for a civil contractor is workforce composition rather than the clearance process itself.
- Clearances attach to individuals, not to the business. A cleared operator who leaves takes the clearance with them.
- Sponsorship is an obligation. Above Entry Level the business sponsors and maintains clearances, which carries administrative work and continuing responsibilities.
- Processing takes months. A crew assembled for a job starting in six weeks cannot be cleared in time.
- Labour hire and subcontract crews complicate it. A workforce that flexes with workload is much harder to hold cleared than a stable permanent crew.
The strategic answer for most civil SMEs is to target the work that does not require clearances — external civil works on accessible parts of an establishment — and to treat clearance-requiring work as a later step, if at all. That also aligns with the sequencing in §11.
What DISP actually costs
There is no membership fee. The cost is in implementing and maintaining the security measures required to meet the initial and ongoing membership requirements — which may include facility certification and accreditation, personnel security clearances and physical security measures.[1]
That distinction matters for a small business. The application is not the expense; the standing obligations are. Before committing, establish which level you actually need — the requirements scale with membership level, and pursuing a higher level than your work requires is a self-inflicted cost.
Membership also has to be maintained, with ongoing obligations rather than a one-off assessment. Treat it as a continuing compliance commitment in the same category as your ISO certifications — see the prequalification trifecta.
Industry participation at $4M and $7.5M
This is the most commercially useful fact in this guide.
All Defence materiel and non-materiel procurements above $4 million, and procurement of construction services above $7.5 million, are captured under the Defence Policy for Industry Participation.[2]
Compare that with the general Commonwealth position, where Australian Industry Participation requirements attach at $20 million or more.[3] Defence applies industry participation obligations at roughly a third of the construction threshold that applies elsewhere.
Two consequences for a civil SME:
- Obligations attach at contract sizes a substantial SME might actually hold directly. A $7.5 million construction services threshold is within reach of a larger civil contractor or a consortium.
- More importantly, head contractors above the threshold carry an obligation to give Australian businesses opportunity. AIP requirements exist to give Australian businesses full, fair and reasonable opportunities to bid to supply goods and services, and to advertise those opportunities.[3] A capable local Australian civil subcontractor is the outcome that policy is designed to produce.
That second point is the practical opening, and it is the same mechanism described in our guides to local content, skills and training requirements and subcontracting to Tier 1 civil contractors.
The realistic route in
- Find the work. Defence opportunities are published on AusTender, and Defence estate and construction programs are publicly described. ICN Gateway is also used to surface subcontract packages on major projects.
- Identify the managing contractors. Most Defence estate work is delivered through head contractors who subcontract civil packages. They are the realistic client.
- Check the security requirement before investing. Ask, in writing, what DISP level the work requires and whether subcontractors are captured.
- Get your general compliance in order first. Certified management systems, insurance at Commonwealth levels, and a clean safety record — see insurance requirements for government civil tenders.
- Approach the head contractors with a specific trade offer, exactly as set out in subcontracting to Tier 1 civil contractors.
- Start with the unclassified work. External roads, drainage, hardstand and fencing on the accessible parts of a base carry the lowest security overhead and build the record.
What working on a Defence site involves
Practical differences that affect your price and programme, and which contractors routinely under-cost:
- Access control. Personnel and vehicle passes, lead times for approval, and escorts in some areas. Every new worker is an administrative event.
- Restricted hours. Base operations take precedence, and work windows can be narrower than commercial sites.
- Photography and device restrictions, which affect the site records discipline in our guide to contract administration for civil SMEs. Establish what you may record before you rely on photographs for claims.
- Unexploded ordnance and contamination protocols in training areas and historic sites — directly relevant to latent conditions and worth confirming before pricing ground risk.
- Aviation and munitions constraints where applicable, with their own exclusion zones and permits.
- Documentation. Handover and asset data requirements are typically heavier than council work — see practical completion and the final claim.
Price the access and administrative overhead explicitly. A crew that loses forty minutes a day to gate processing across a twenty-week job is carrying a real cost that does not appear in any rate.
The commercial side: what to expect
Defence subcontract work behaves differently from council work commercially, and the differences are predictable enough to price for.
- Contract administration is more formal. The delivery layer is staffed by project managers and quantity surveyors, which means notices, claims and variations are assessed against the contract rather than negotiated over the phone. That favours a contractor who administers properly — the discipline in our guide to contract administration for civil SMEs pays off here more than anywhere.
- Programme is constrained by base operations. Restricted hours, escorted areas and operational priority mean your programme is not entirely yours. Where those constraints cause delay, the extension of time position depends on how the subcontract allocated access risk — read it before you price.
- Documentation obligations flow down heavily. Quality records, conformance evidence and asset data requirements on Defence work are typically closer to major-project standard than council standard. Price the administration.
- Security requirements can constrain your records. Photography and device restrictions in some areas directly affect the evidence you can create for claims. Establish what you may record before you rely on photographs.
- Payment sits under the ordinary statutory regime. Security of payment applies to Defence subcontracts as it does elsewhere — see security of payment in Australia.
- Back-to-back terms will be firm. Expect compressed notice periods and flowed-down obligations. Negotiate the liquidated damages cap in particular, as covered in our guide to subcontracting to Tier 1 civil contractors.
None of this is unusually onerous. It is simply a more documented environment than a council job, and contractors who arrive with functioning systems find it easier rather than harder — because the things that are being assessed are things they can actually evidence.
One further point worth planning for: ground risk on an operating establishment carries an unusual profile. Long-established bases frequently contain undocumented services, historic fill and, in training areas, ordnance protocols. The latent conditions position and what the tender information actually discloses are worth resolving during the clarification period rather than after you break ground.
What entering this market actually costs
Defence is the most compliance-heavy market in this library, and the honest way to approach it is to price entry as an investment with a payback period rather than as a bid cost.
| Cost | When it lands | Notes |
|---|---|---|
| Cyber uplift to Essential Eight Maturity Level 2 | Before DISP membership | Usually the largest single item for a small contractor. Scope it to the systems used to correspond with Defence rather than the whole business |
| Security governance framework and a named security officer | Before membership | Documentation plus an ongoing internal role. Governance must reach your highest level in any domain |
| Workforce screening to AS 4811:2022 | Before and during | At Entry Level this replaces clearances — an achievable ongoing HR process |
| DISP membership fee | — | Nil. There is no membership fee[1] |
| Access administration per worker | Every mobilisation | Passes, vetting and escort arrangements. Real, recurring, and rarely priced |
| Lost productivity from gate processing and restricted hours | Every shift | Price it into the rate. Forty minutes a day across a twenty-week job is a material number |
| Heavier handover documentation | At completion | Typically more than council work — see practical completion and the final claim |
Set against that, the payback is continuity rather than margin on a single job. Estate work recurs, the delivery firms are stable, and a contractor who has cleared the compliance bar once faces a much thinner competitive field than on an open council tender.
The decision that follows is a market-entry decision, not a tender decision, and it deserves the same discipline as our go/no-go framework applied one level up: what does entry cost, what is the realistic volume within reach, and over how many years does it pay back?
One sequencing point that materially reduces the cost. Work out whether DISP is required at all before you spend anything on it. Straightforward civil works on an unclassified part of a base may not require membership — but it may still be required by the contract, or by the head contractor regardless of Defence’s own position. A written answer on that question, obtained early, is the difference between a modest entry cost and a substantial one.
Whether it suits your business
| Defence suits you if… | Defence does not if… |
|---|---|
| You are near a base or training area | The nearest establishment is a long mobilisation away |
| You want steady base-load work | You need fast payment cycles and minimal administration |
| Your compliance systems are already certified | Your systems are informal |
| You can absorb an access and vetting overhead | Your crews change frequently |
| You are prepared to subcontract first | You will only bid head contracts |
As with any new market, this is a go/no-go question at the market level rather than the tender level. Entering Defence is a twelve-month investment, and it should be a decision rather than an opportunistic response to a single advertised package.
Checklist
- Which Defence establishments are within your service radius?
- Who holds the estate and construction head contracts there?
- Does the work you want require DISP membership, and at what level?
- Have you confirmed the DISP position in writing rather than assuming?
- Are your management systems certified and insurances at Commonwealth levels?
- Have you priced access control, escorts and restricted hours?
- Have you confirmed what site records you are permitted to keep?
- Is there an unexploded ordnance or contamination protocol affecting ground risk?
- Which establishments appear in the Capital Facilities and Infrastructure Forward Works Program near you?
- Who holds the project delivery services and head contract roles at those establishments?
- If DISP is required — at what level, and in which security domains?
- Are your ICT systems at Essential Eight Maturity Level 2, and scoped to what actually corresponds with Defence?
- Do you have a named security officer and a documented governance framework?
- Does the work require sponsored clearances, and can your workforce realistically hold them?
The short version
- Defence runs a continuous national estate needing ordinary civil work, in regional locations where competition is thinner.
- DISP has no membership fee, but real ongoing security costs. Establish the required level before applying.
- DISP is mandatory for classified work, weapons and munitions, security services, or where the contract requires it. The contract limb is the one that catches people.
- Defence industry participation attaches at $4M generally and $7.5M for construction services — far below the $20M Commonwealth threshold.
- The realistic route is subcontracting to the managing contractors, starting with unclassified external works.
- Price the access and administrative overhead. It is real and it does not appear in any rate.
- Four DISP levels, four security domains, assessed independently — except governance, which must match your highest level anywhere.
- Entry Level needs no sponsored clearances, only workforce screening to AS 4811:2022. That is what makes it workable for a civil crew.
- Essential Eight at Maturity Level 2 applies at every level including Entry. It is usually the biggest entry cost.
- Read the Forward Works Program and the award notices. The packages are let by the delivery layer, not advertised by Defence.
References
This guide is general information for Australian civil construction businesses and is not legal or security advice. Defence security, prequalification and procurement requirements change and are set by Defence and by the individual contract. All examples are illustrative. Always work from current Defence guidance and the tender documents, and confirm security requirements directly with Defence or the head contractor.
- Australian Government Department of Defence — Defence Industry Security Program and Maintaining membership (defence.gov.au); Australian National Audit Office — Defence’s Contract Administration — Defence Industry Security Program. DISP described as supporting Australian entities to understand and meet their security obligations when engaging in Defence tenders, contracts and projects, as a multi-level membership-based program open to any Australian entity looking to become part of the Defence industry supply chain; the requirement that an entity meet initial eligibility criteria with additional criteria based on the level of membership required; that depending on the type of work undertaken with Defence, or any contractual requirements, DISP membership may be mandated, and that membership is mandatory for organisations handling classified information, weapons or munitions, providing security services for Defence facilities, or where required by contract; and that there is no direct membership fee, but there are costs associated with implementing and maintaining security measures to meet initial and ongoing requirements, which might include facility certification and accreditation, personnel security clearances and physical security measures. ↩ ↩ ↩ ↩ ↩
- Australian National Audit Office — Maximising Australian Industry Participation through Defence Contracting (anao.gov.au): all Defence materiel and non-materiel procurements above $4 million, and procurement of construction services above $7.5 million, captured under the Defence Policy for Industry Participation. ↩ ↩
- Australian Government Department of Defence — Capital Facilities and Infrastructure Forward Works Program (defence.gov.au) and DEQMS: Estate Works Program, Service Delivery Division, Estate & Infrastructure Group; JLL — JLL secures contract for Defence Estate Works Program, and Defence Connect coverage of the same appointment; Australian National Audit Office — Maintenance of the Defence Estate. National Program Services for the Defence Estate Works Program awarded to JLL under a six-year contract to coordinate and steer a national infrastructure pipeline in the order of $900 million a year while providing strategic advice on risk, investment prioritisation and project development, building on delivery of approximately 1,510 projects valued at some $3.8 billion across Defence establishments since 2014; the Capital Facilities and Infrastructure branch planning, developing and delivering capital works across the Defence estate through an outsourced model that procures industry to manage, design, construct and provide specialist skills in support of each project; and Project Delivery Services contractors issuing and managing numerous subcontracts for design, construction and services, many of which can be picked up by smaller businesses. ↩ ↩ ↩ ↩
- Australian Government Department of Defence — Applying for DISP Membership factsheet (defence.gov.au) and Eligibility and suitability; together with DISP practitioner guidance from Serious Defence, DISP Membership Levels Explained, Siege Cyber, DISP Levels and Requirements Explained, and Agilient, DISP Explained. Four membership levels aligned to Australian Government security classifications — Entry Level to OFFICIAL and OFFICIAL: Sensitive, Level 1 to PROTECTED, Level 2 to SECRET and Level 3 to TOP SECRET — with each level granting access to a tier of classified information and requiring progressively more stringent controls across four security domains: governance, personnel, physical, and ICT/cyber security; membership levels assessed independently for each security domain, such that an organisation may hold Entry level for physical security while holding Level 1 for personnel security; governance required always to match or exceed the highest level of membership sought for any other category; Entry Level not permitting clearance sponsorship and relying on workforce screening to AS 4811:2022, with Level 1 permitting sponsorship of Baseline clearances for staff handling PROTECTED information, Level 2 typically requiring NV1 clearances and Level 3 requiring NV2 clearances; and the position that since the September 2024 uplift DISP requires the full Essential Eight at Maturity Level 2 as the minimum for every membership level from Entry Level upward, assessed across the ICT systems used to correspond with Defence. ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩
- Australian Government Department of Industry, Science and Resources — Australian Industry Participation (industry.gov.au), and Department of Finance — Commonwealth Australian Industry Participation plan (CAIP plan) (finance.gov.au): Commonwealth AIP requirements applying to Australian Government contracts, grants, payments or investments of $20 million or more, and the purpose of AIP plans being to give Australian businesses full, fair and reasonable opportunities to bid to supply goods and services on the project and to advertise those opportunities. ↩ ↩