Defence industry
Defence industry IT and security consulting
Identity, network and cloud security for Australian defence industry suppliers, delivered by a Defence Industry Security Program (DISP) member that runs the same controls in its own business. The result is a secure environment and the evidence that Defence, the primes and auditors ask for.
Who it is for
- This is for small and mid-sized suppliers to Defence and to the primes, including companies applying for DISP membership or preparing an annual security report, and for engineering businesses that have won their first Defence contract and now need an IT environment that meets its security conditions.
What the work covers
- Identity and access on Microsoft Entra ID, including conditional access, phishing-resistant MFA, privileged access and device compliance with Intune.
- Microsoft 365 and Azure configuration against the Essential Eight and the new ASD Essentials, and against the Information Security Manual where a contract requires it.
- AWS and Azure environments for engineering and data workloads, with logging, encryption and access designed for Defence information handling.
- Network segmentation, remote access, VPN and the separation of Defence work from the rest of the business.
- PKI, certificates and cryptographic hygiene, including the retirement of weak algorithms and protocols.
- Security governance documents and the technical evidence behind them, so that policies describe what the systems actually do.
- Supply chain questions from the primes, including security questionnaires and contract security clauses.
What you get
- A security posture review ranked by risk and written for a Defence context.
- Remediation delivered as code, with the configuration in version control.
- An evidence pack that maps each control to the policy that requires it and to the screenshot, log or configuration that proves it.
- Plain-language briefings for directors and for the Chief Security Officer.
- Ongoing support on a monthly hours basis once the uplift is done.
How it runs
- Work begins with a short review of the current environment and of the contract or program requirements. Remediation follows in the order that reduces the most risk first.
- Everything is done with read-only access until a change is agreed, and the configuration is delivered through your own repositories. Hamer Technical does not resell licences or hardware.
Who does the work
Thomas Hamer does the work. He is a Royal Australian Navy veteran who has built and operated production identity, PKI and cloud systems for government and defence, and who has led platform teams inside financial services. Hamer Technical holds DISP membership and runs its own Entra ID, Microsoft 365 and AWS baseline under the same controls it recommends. More at hamer.cloud.
Common questions
What is DISP?
The Defence Industry Security Program is the Department of Defence program through which Australian businesses that work on Defence contracts show that they meet Defence security requirements across governance, personnel, physical and information security. Membership is required for many contracts and is assessed by Defence.
Can you help with a DISP application?
Yes, with the information and cyber security stream in particular. The policies, plans and technical controls that DISP asks for are the same ones Hamer Technical has put in place for itself, and the work focuses on making the systems match the documents rather than on writing documents alone.
Do you work with the primes' supplier security requirements?
Yes. Security questionnaires and contract security clauses from the primes usually map to the Essential Eight, the ASD Essentials or the Information Security Manual, and the review and evidence pack are written so that the answers can be lifted straight into them.