Defence suppliers (DISP)
DISP requires members to meet ASD’s Essential Eight at Maturity Level 2 across the corporate systems they use with Defence. We assess your tenant against the ML2 controls and set out the gaps, control by control.
Packages
Security engagements, scoped to the requirement you have to meet.
Three packages for Microsoft 365 organisations with 20 to 50 staff: assess, fix, then keep it current.
Driven by your requirement
Security work is most useful when it answers a specific question. We scope every engagement against the requirement in front of you, so the findings, the evidence and the roadmap line up with it.
ASIC-regulated firms
Licensees are expected to manage cyber risk in proportion to their business, and ASIC has taken enforcement action where they haven’t. You get a dated record of the controls in place and a plan for closing the rest.
Enterprise customer security schedules
Banks, insurers, super funds and other large customers send their suppliers security schedules and questionnaires. We map your evidence to their questions so you can answer them completely and consistently.
Insurer questionnaires
Cyber insurance proposal forms ask about MFA, privileged access, backups, email security and incident response. Every assessment produces dated evidence for those controls. You answer your own proposal form.
ASD published ASD Essentials, the successor to the Essential Eight, on 15 October 2026. DISP continues to require Essential Eight Maturity Level 2 until Defence changes its requirement, and the same evidence can be mapped to either.
How Verify works
- CollectRead-only exports from your Microsoft 365 tenant, each recording the date, time and method of collection, plus copies of the supporting documents in scope, such as your incident response plan.
- ReviewWe review every export against how the control is meant to work, not just whether a setting is switched on.
- MapEach control is mapped to your named requirement: the DISP questionnaire, your customer’s schedule or the questions your insurer asks.
- ReportFindings in plain English, the evidence behind each one and a prioritised roadmap, walked through with you.
The packages
Every engagement is scoped and quoted in writing before work starts.
Assessment
Verify
- Who it’s for
- Organisations with 20 to 50 staff on Microsoft 365 that have a named requirement to meet: a DISP questionnaire, ASIC expectations, a customer security schedule or an insurer proposal form.
- Scope
- A read-only review of your Microsoft 365 tenant and supporting practices: identity and MFA, conditional access, admin roles and privileged access, email authentication (SPF, DKIM, DMARC), device and endpoint protection including EDR, backup configuration, logging, and your incident response plan and key policies, all mapped to your requirement.
- What you receive
-
- A findings report in plain English, ranked by risk
- A control-to-evidence register mapped to your requirement
- A dated evidence pack of tenant exports and supporting documents
- A prioritised remediation roadmap
- A walkthrough session with you and your MSP
- Timing
- Agreed at scoping and set out in the engagement letter.
- Annual refresh (optional add-on)
- A year on, we rerun the collection read-only and show what improved and what drifted: a current, dated evidence pack, a change summary and an updated control-to-evidence register.
Remediation
Uplift
- Who it’s for
- Organisations that have completed Verify and want the priority gaps closed.
- Scope
- We either make the changes ourselves or verify the changes your MSP makes against our design, or a mix of both. Covers the roadmap items you select: conditional access, phishing-resistant MFA for admins, privileged access management, Defender tuning, DMARC enforcement, payment-change controls against email fraud, and a dated backup restore test. Changes we make use client-approved, time-bound admin access, within agreed change windows.
- What you receive
-
- Agreed changes made, tested and logged
- As-built configuration notes your MSP can maintain
- A refreshed evidence pack showing the changes in place
- A handover session
- Timing
- Schedule and change windows agreed in the engagement letter.
Retainer
Assure: fractional security lead
- Who it’s for
- Organisations with a standing requirement, such as Defence suppliers, ASIC-regulated firms and suppliers to enterprise customers, that want a named, senior person accountable for security without a full-time hire.
- Scope
- A named security lead for an agreed number of hours each month: risk register, policies (including AI use), preparation of questionnaire answers for your sign-off, oversight of your MSP and key vendors, and an annual tabletop exercise. Incident response leadership can be added to the scope.
- What you receive
-
- A quarterly report for owners or the board
- A maintained risk register and policy set
- A quarterly evidence refresh, which includes the annual refresh
- An annual tabletop exercise and write-up
- Term
- Begins after Verify. 12-month term, with a monthly working session and quarterly reporting.
Engaging us
Each engagement starts with a twenty-minute scoping call on the requirement, your seats, your MSP and your deadline, followed by an engagement letter setting out scope, deliverables, dates and fee. Access is granted by you or your MSP and removed at close, and the findings, evidence and roadmap are presented and handed over at the end.
- Capacity. We take on a limited number of engagements, and confirm start dates at scoping.
- Least-privilege access. Verify and evidence refreshes use read-only access. Access is removed at close.
- Your evidence, your decision. Everything we produce is prepared for your sign-off and use; you decide who sees it. We don’t certify, attest or make statements to third parties on your behalf.
- Alongside your MSP. We work with your managed service provider, not against it, and we don’t take over managed services.
- Data handling. Evidence is retained only for the period set out in the engagement letter, then deleted. See the privacy policy.
- Insurance. 4IR holds professional indemnity and public liability insurance. Certificates of currency are available on request.
- For insurers and brokers. What a client receives and how it maps to common questionnaire questions: For insurers and brokers.
- Who does the work. Jack Reason, our principal security architect, leads every engagement.
Have a requirement to meet?
Send a line on what you’ve been asked for and by when, and we’ll arrange a scoping call.