Security advisories
When the Department learns of a threat to shared Network infrastructure that is likely to recur, whether from an incident report, an exercise, a verification visit or another source, it warns the members that need to know through a security advisory. The advisory service was established on 6 September 2026 and the first advisories were issued the same day.
Advisories are graded by level so that members can tell at once how urgently they must act. The level reflects the Department's assessment of the threat to shared services, not the volume of work an advisory may involve. A short Urgent advisory requiring one immediate change is graded above a long Attention advisory describing a weakness that has not been exploited.
Advisory levels.
| Level | Meaning | Expected action | Distribution |
|---|---|---|---|
| Information | Describes a development members should know about. No threat to shared infrastructure has been identified. | Read and file. No acknowledgement required. | All nominated contacts; published in the register |
| Attention | Describes a threat or weakness that could affect shared infrastructure if not addressed, without evidence that it has been exploited within the Network. | Assess relevance to registered systems within five working days; act where relevant; record the outcome for the next readiness return. | All nominated contacts; published in the register |
| Action required | Describes a threat that has affected, or is known to be capable of affecting, registered Tier 1 or Tier 2 infrastructure. Specific measures are set out. | Acknowledge within one working day; complete the measures by the date stated; confirm completion to the Department. | Nominated contacts of members with systems in the affected tiers; published in the register once measures have been completed |
| Urgent | Describes an incident in progress affecting shared Network services, or a threat expected to affect them within hours. | Acknowledge within four hours at any time of day; take the immediate measures stated; report status to the Department at the interval specified. | Nominated contacts and their deputies of all affected members; summary published in the register after closure |
Register of advisories. The register lists every advisory issued since the Department was established. Action required and Urgent advisories are entered once the measures they require have been completed across the Network; until then they are distributed to affected members only.
| Reference | Issued | Level | Subject | Status |
|---|---|---|---|---|
| DEF-ADV-2026-001 | 6 September 2026 | Information | Establishment of the advisory service and distribution arrangements for members | Current |
| DEF-ADV-2026-002 | 6 September 2026 | Attention | Interim guidance on the protection of credentials used to access shared Network services | Current |
| DEF-ADV-2026-003 | 6 September 2026 | Attention | Preparations expected of members ahead of the first Network-wide readiness exercise | Current |
On receipt of an advisory. Members follow the steps below for every advisory of Attention level or above.
Step 1: Confirm the advisory is genuine
Advisories are sent only from the Department's contact address and carry a reference in the form DEF-ADV-YYYY-NNN. Check the reference against the register on this page. Report any message claiming to be an advisory that does not match.
Step 2: Acknowledge where required
For Action required and Urgent advisories, the nominated contact acknowledges receipt to the Department within the time stated for the level, naming the person who will lead the member's response.
Step 3: Assess the advisory against registered systems
Determine which of the member's registered systems the advisory affects, using the dependencies recorded at registration to identify systems affected indirectly.
Step 4: Take the measures set out
Carry out the measures the advisory specifies, in the order given and by the dates stated. Where a measure cannot be completed in time, tell the Department before the deadline rather than after it.
Step 5: Confirm completion
For Action required and Urgent advisories, confirm to the Department when the measures have been completed for every affected system. The Department closes the advisory for the member on receipt of the confirmation.
Step 6: Record the outcome
Note the advisory and the measures taken in the record of each affected system so that the outcome is reflected in the member's next readiness return.
How advisories are distributed.
- Nominated contacts
- Advisories are sent by email to the nominated contact recorded at registration for each affected system. Members are responsible for keeping their contacts current and for ensuring that Urgent advisories reach a person at any hour.
- Anonymity of the reporting member
- An advisory that arises from an incident report describes the threat, the infrastructure affected and the measures required. It does not identify the member that reported the incident, and members must not attempt to infer it.
- The register
- Every advisory is entered in the register on this page. Information and Attention advisories are published in full when issued. Action required and Urgent advisories are published in summary once the measures they require have been completed across the Network.
- Withdrawal and supersession
- An advisory that is found to be wrong is withdrawn and the register says so. An advisory that is replaced by a later one is marked as superseded and the reference of the later advisory is given.
Questions about advisories.
Acknowledgements, confirmations and requests are sent to contact@defence.gov.vin. Advisories reach members through the nominated contacts recorded when systems are registered with the Department. Incidents that may give rise to an advisory are reported under the incident reporting procedure; the measures advisories require are drawn from the Interim Network Defence Framework.