After a DISP cyber assessment, what happens next?

After a cyber assessment supporting your Defence Industry Security Program application, the next step is to turn the findings into agreed work. Establish what each finding means, who can address it and what evidence will demonstrate the result.

Keep the scope clear. A cyber assessment addresses the systems and requirements within its agreed boundary. Its findings do not, by themselves, describe your position across the whole DISP program. Any next steps also need to account for the requirements and conditions Defence has communicated to your organisation.

Understand what the finding actually establishes

Read the scope and limitations alongside the findings. Which systems were assessed? What evidence was available? Was a control found to be absent, implemented inconsistently, or insufficiently evidenced? Those situations can require different work.

A missing record does not automatically mean a control is absent. Equally, a policy stating that a control exists does not establish that it operates across the environment. Where the position is uncertain, clarify it before commissioning a substantial change. The response may involve further validation, implementation work, better evidence, or a combination of these.

Build a useful action record

Bring the assessment findings to the people who own the systems and business processes concerned. Your internal IT team or provider may already have relevant work underway, or understand a dependency that changes the order of implementation.

For each finding, a simple action record can capture the information needed to move the work forward:

• The finding and the systems or activities affected.
• The agreed change or question that still needs resolving.
• The person accountable for the result and the team doing the work.
• Dependencies, business constraints and an agreed target date.
• The evidence needed to demonstrate completion and who will review it.
• The owner responsible for operating the control.

Sequence work around dependencies

Some findings share an underlying cause. For example, patching work can depend on having a reliable asset inventory. Assigning a separate task to improve each patch report will achieve little if nobody can establish which devices should appear in those reports.

Use those dependencies when planning the work. Also consider business exposure, contractual requirements, operational disruption and available resources. An existing assessment can inform this plan without making every recommendation an equally urgent purchase. Confirm whether the proposed engagement covers advice, implementation, validation or all three.

Make deferred work a managed decision

If a recommendation cannot be implemented immediately, record why, who owns the decision and what will happen in the meantime. Consider what alternative measures can reduce exposure and when the decision needs to be reviewed.

Putting an issue in a risk register is only one part of managing it. Someone needs to monitor the position and respond when circumstances change. Internal risk acceptance also does not remove an external requirement. Any effect on your DISP application or conditions needs to be considered separately.

Agree what happens after completion

Close each action against the evidence agreed for that finding. A configuration record may demonstrate a change at a particular time. Where the requirement concerns ongoing operation, the evidence will need to address that as well.

Confirm who maintains the configuration, reviews exceptions and keeps the relevant records. Those responsibilities belong in normal operations. Agree how future system changes will be considered and when further assurance is needed. This gives the organisation a way to retain the benefit of the work after uplift is completed.

If you have cyber assessment findings to work through, discuss the cyber component of your DISP support needs with Strategic Cyber.