Match defence supplier accreditation to the information actually handled
A supplier machining an unclassified part to a classified drawing is treated differently from one that never sees the drawing. Where the work can be structured so the supplier never holds classified information, the accreditation that protects classified information is protecting nothing.
Steps this would change
Rationale
DISP already has levels, and the Entry Level tier already does much of what this proposal asks for: it is designed for firms handling sensitive unclassified material, carries no membership fee, and does not require facility accreditation or classified ICT.
The problem is not the absence of a tier. It is that the tier a supplier needs is determined in practice by the prime contractor's flow-down of requirements rather than by an assessment of the information the subcontractor will actually hold. A prime with a Level 2 obligation has every incentive to require Level 2 of its supply chain, because that is simpler than working out which subcontractors need what, and because the cost of over-specifying falls entirely on the subcontractor.
The result is 120 days of facility accreditation and ICT certification incurred by firms that could have done the same work under an arrangement where they never receive classified information at all — build to print, with the classified context held by the prime.
The proposal is that the required DISP level for a subcontract be determined by an information-handling assessment tied to the scope of work, with the prime required to justify a level above what that assessment supports.
Filed as an idea, not a proposal, and deliberately so. This database has no visibility of how flow-down decisions are actually made, whether over-specification is as common as industry commentary suggests, or what share of subcontracted work could genuinely be structured to avoid classified handling. Every one of those is a question for someone who has sat on both sides of a defence subcontract. The structure looks wrong; the evidence that it is wrong does not exist here.
What is being traded away
Aggregation is the reason over-specification is sometimes correct. Individually unclassified components can reveal classified capability when combined, and a supplier who knows only their own part may not see what their part implies. Deciding that a subcontractor "never holds classified information" requires someone to be confident about what can be inferred from an unclassified drawing, and that judgement is much harder than it sounds. Getting it wrong is not recoverable.
The prime is currently accountable, and this diffuses that. A prime that flows down its own accreditation level has a simple, defensible position: everyone in the chain meets the standard. Replacing that with per-subcontract assessments creates many judgements where there was one, each of which could be wrong, and muddies who is responsible when something leaks.
It optimises for the wrong constraint. Even on this database's own numbers, facility accreditation is 120 days of an 810 day entry path and is modelled as optional. The larger costs are the 150 day vetting queue and the 150 day DISP decision, and Break the clearance circularity that keeps small firms out of defence is the proposal that addresses those. A reform that lowers the entry tier while leaving the clearance circularity intact helps firms that were nearly in already.
And a caution about who is asking. "Reduce the accreditation burden on small
suppliers" is a position with an obvious commercial constituency and a much less
obvious public one. The people best placed to say whether a tier is
over-specified are the people who would profit from it being lowered. That does
not make them wrong. It does mean this proposal needs evidence from someone
without that interest before it moves past idea.
Precedent
DISP is already tiered — Entry Level exists for organisations handling sensitive but unclassified material and does not require facility accreditation. The proposal is that the tiering be driven by an assessment of what the work requires rather than by what the prime asks for.
Sources
- Department of Defence, published DISP eligibility, levels and application guidance
- ANAO, Defence's Contract Administration -- Defence Industry Security Program