Interim Network Defence Framework
The Interim Network Defence Framework sets out the responsibilities of the Defence Department of the Velocity Interoperability Network, the classification of shared Network infrastructure, and the principles that members apply when protecting the systems they operate on behalf of the Velocity Interoperability Network.
The framework was published by the Policy and Standards Division on 6 September 2026. It is arranged in six parts and a schedule of definitions, summarised in the table below. This page sets out the classification and the principles in full; the remaining parts are given effect through the guidance pages linked from the table, and members may obtain the full text from the Division through the Department's contact address.
| Part | Subject | Contents | Applied through |
|---|---|---|---|
| Part 1 | Responsibilities of the Department | The four responsibilities the Department carries out on behalf of the Network and the offices answerable for them. | Responsibilities |
| Part 2 | Classification of shared infrastructure | The three tiers, the criteria for each and the procedure by which the tier of a system is proposed by the member and confirmed by the Department. | Register infrastructure |
| Part 3 | Principles of protection | The five principles set out below and the controls each tier requires, from access control and logging for every tier to tested continuity plans and protected credentials for Tier 1 and Tier 2. | This page |
| Part 4 | Reporting and advisories | The definition of a significant incident, the 24-hour deadline, the four severities and their reporting intervals, and the four advisory levels. | Report an incident; Security advisories |
| Part 5 | Readiness | The kinds of readiness exercise, the duty of every member to take part in Network-wide exercises, and the five readiness categories reported each quarter. | Readiness exercises; Readiness reporting |
| Part 6 | Verification | The annual confirmation each member gives by 31 March, the Department's sample verification and the recording and closure of findings. | Register infrastructure |
| Schedule | Definitions | The terms used throughout the framework, each in a fixed sense. | Glossary |
| Tier | Description | Examples | Reporting deadline |
|---|---|---|---|
| Tier 1 | Infrastructure without which shared Network services cannot operate. | Identity services, the Network registry, core interconnection | 24 hours |
| Tier 2 | Infrastructure whose loss would degrade shared services for more than one member. | Member gateways, shared messaging, status reporting | 24 hours |
| Tier 3 | Infrastructure whose loss would affect a single member's participation in the Network. | A member's own connection to the Network | Next reporting period |
The tier of a system is fixed when the member registers it with the Department. The member proposes a tier; the Policy and Standards Division confirms it or assigns a different one. Registration is phased by tier, with Tier 1 systems to be registered by 31 October 2026, so that the systems the Network depends on most are known first.
Principles. Members apply the following principles to every system within the framework's scope.
- Shared responsibility
- A member is responsible for the security of every system it operates on behalf of the Network. The Department sets the standard; the member meets it.
- Protection in proportion to criticality
- Controls are matched to the tier of the infrastructure they protect. Tier 1 infrastructure is subject to the most demanding requirements.
- Prompt reporting
- Significant incidents affecting shared infrastructure are reported to the Department within 24 hours so that other members can be warned.
- Continuity of service
- Members plan for shared services to continue, in a reduced form if necessary, while an incident is contained and resolved.
- Verification
- Members confirm each year that the standards have been met, and the Department verifies a sample of those confirmations.
Questions about the framework.
The framework in practice. Each principle is given effect through one of the Department's instruments. Shared responsibility and protection in proportion to criticality are applied through registration, which fixes the tier of every system. Prompt reporting is the subject of the incident reporting procedure, and the warnings that follow reports are issued as security advisories. Continuity of service is tested through readiness exercises and tracked between them through readiness reporting. Verification is carried out each year on a sample of registered systems.
Members that detect an incident affecting infrastructure in any tier should follow the incident reporting procedure. Terms used in the framework are defined in the Glossary.