Glossary
The Department's framework, guidance, returns and advisories use a small number of terms in a fixed sense. This glossary defines them. Where a term is defined here, it has the same meaning wherever it appears on this site and in correspondence from the Department, and members are asked to use the same terms in their reports and returns so that the Department and its members are describing the same things in the same words.
The glossary will be extended as the Department's instruments are revised. Where a revision changes a definition, the change will be noted in the Newsroom and the earlier definition will be recorded here for reference.
| Term | Meaning |
|---|---|
| Advisory | A graded warning issued by the Department to members about a threat to shared Network infrastructure. Advisories carry a reference in the form DEF-ADV-YYYY-NNN and one of four levels: Information, Attention, Action required or Urgent. |
| Annual confirmation | The written statement a member makes by 31 March each year that every system it has registered met the standards required for its tier throughout the preceding year, or listing the systems and periods for which it did not. |
| Closing report | The short account of an incident's cause, effect and the measures taken to prevent recurrence, submitted by the reporting member within ten working days of the incident being closed. |
| Containment | The immediate steps taken to limit the effect of an incident on the system concerned and on the shared services that depend on it. Containment must not delay reporting. |
| Continuity plan | A member's documented arrangements for keeping a registered system's service running, in a reduced form if necessary, while an incident is contained and resolved. |
| Finding | A recorded instance of a required control or plan not being in place for a registered system, arising from a readiness return, an inspection, a verification visit or an exercise. Findings are closed through remediation plans. |
| Interim Network Defence Framework | The Department's principal instrument, published on 6 September 2026. It sets out the Department's responsibilities, the classification of shared Network infrastructure into three tiers and the principles members apply when protecting it. It is described as interim because it will be revised after consultation with members and the first Network-wide exercise. |
| Member | An organisation that participates in the Velocity Interoperability Network and operates, or depends on, shared Network services. |
| Nominated contact | The person named by a member in the registration record for a system as the point of contact for that system. Advisories, exercise guidance and queries about returns are sent to the nominated contact. |
| Operating member | The member responsible for a registered system. Where a system is operated jointly, one member is named as operating member and the others are recorded under dependencies. |
| Readiness category | One of five categories, R0 to R4, assigned to each registered system in a readiness return to describe whether the controls and continuity plan the framework requires are in place and tested. |
| Readiness exercise | A planned test, run by the Department, of the Network's ability to keep shared services running under a simulated disruption. Every member takes part in Network-wide exercises. |
| Readiness return | The quarterly statement in which a member assigns a readiness category to each of its registered Tier 1 and Tier 2 systems, and once a year to its Tier 3 systems, with remediation plans for any system assessed as R2 or R3. |
| Register of shared infrastructure | The record held by the Department of every system registered by members, its tier, its operating member, its nominated contact and its dependencies. The register is not published. |
| Registration record | The set of information a member submits to register a system with the Department, including the system's purpose, proposed tier, dependencies and continuity arrangements. |
| Remediation plan | A dated plan, attached to a readiness return or agreed with the Department, naming a finding, the measure that will close it, the person responsible and the completion date. |
| Reporting period | The quarter to which a readiness return relates. Returns are due on the last day of the month following the end of the period. |
| Shared Network infrastructure | Any system a member operates on behalf of the Network and any system on which a shared Network service depends. Systems used only within a single member are not shared Network infrastructure. |
| Significant incident | A security incident that affects, or is likely to affect, Tier 1 or Tier 2 infrastructure, or that involves the compromise of credentials used to access shared Network services. Significant incidents are reported to the Department within 24 hours of detection. |
| Tier | The criticality class assigned to a registered system under the framework. Tier 1 infrastructure is that without which shared services cannot operate; Tier 2 is that whose loss would degrade shared services for more than one member; Tier 3 is that whose loss would affect a single member's participation. |
| Verification | The Department's annual examination of a sample of registered systems, weighted towards Tier 1, to test the evidence behind members' annual confirmations and readiness returns. |
| Working day | Any day other than a Saturday, a Sunday or a public holiday observed by the Network. Deadlines expressed in working days run from the day after the event that starts them. |
Suggestions for terms that should be added may be sent to contact@defence.gov.vin. The instruments these terms come from are the Interim Network Defence Framework, the registration procedure, the incident reporting procedure, the advisory service and the readiness reporting scheme.