Report an incident
Under the incident reporting arrangements in force since 6 September 2026, a member that detects a significant security incident affecting shared Network infrastructure must notify the Department within 24 hours. This page sets out what must be reported, how, what a report contains, and what the Department does once a report is received.
Reports are sent to contact@defence.gov.vin.
The purpose of reporting is to protect the other members of the Velocity Interoperability Network. Shared infrastructure is, by definition, infrastructure on which more than one member depends, and a member that detects an incident is rarely in a position to know who else is exposed. The Department is. Prompt reporting lets the Department warn the members that need warning while there is still time for the warning to be useful.
| Tier | Deadline | Updates |
|---|---|---|
| Tier 1 | 24 hours from detection | Daily until closure, or more often by severity |
| Tier 2 | 24 hours from detection | Daily until closure, or more often by severity |
| Tier 3 | Next reporting period | On closure |
Severity. Within the deadlines above, the severity of an incident determines how quickly the first report should follow detection and how often the Department expects to be updated. The member proposes a severity in its first report and the Department confirms it.
| Severity | Definition | First report | Updates |
|---|---|---|---|
| Severity 1 | A shared Network service is unavailable to more than one member, or credentials for a shared service are confirmed compromised. | Within 24 hours of detection, and as soon as the severity is determined | Every four hours while the service is unavailable, then daily |
| Severity 2 | A shared Network service is degraded for more than one member, or Tier 1 or Tier 2 infrastructure has been accessed without authority. | Within 24 hours of detection | Daily until closure |
| Severity 3 | Tier 1 or Tier 2 infrastructure has been attacked without loss of service or evidence of access, or a control required by the framework has failed. | Within 24 hours of detection | Daily until closure, or as agreed with the Department |
| Severity 4 | Only the member's own connection to the Network, or other Tier 3 infrastructure, is affected. | Next reporting period | On closure |
Procedure for members. Members follow the steps below for every significant incident.
Step 1: Contain the incident
Take the immediate steps needed to limit the effect on the system concerned. Reporting must not be delayed in order to complete containment.
Step 2: Determine whether the incident is significant
An incident is significant if it affects, or is likely to affect, infrastructure in Tier 1 or Tier 2 of the Interim Network Defence Framework, or if it involves the compromise of credentials used to access shared Network services.
Step 3: Notify the Department
Send a report to the Department's contact address within 24 hours of detection. Use the subject line "Incident report" followed by the name of the member. A report may be brief; it is better to send an incomplete report on time than a complete one late.
Step 4: Provide the required information
State the member, the systems affected and their tier, the time of detection, what is known about the cause, the steps already taken, the proposed severity and a point of contact for the duration of the incident. Supply anything missing from the first report as soon as it is known.
Step 5: Keep the Department informed
Send an update at the interval set for the incident's severity, whenever the assessment changes materially and, in any case, at the end of each working day until the incident is closed.
Step 6: Close the incident
Tell the Department when the affected systems have returned to normal operation and no further effect on shared services is expected. The Department confirms closure once it is satisfied that other members are no longer exposed.
Step 7: Submit a closing report
Within ten working days of closure, send a short account of the cause, the effect, and the measures taken to prevent recurrence. The closing report is reflected in the member's next readiness return.
Contents of a report. A first report contains as much of the following as is known at the time. Nothing on this list justifies delaying the report beyond the deadline.
- The reporting member and point of contact
- The name of the member, the name and email address of the person who will act as point of contact for the duration of the incident, and a deputy for Severity 1 and 2 incidents.
- The systems affected and their tier
- Each affected system by its registered name and tier. Where an unregistered system is affected, say so; the Department will ask for a registration record once the incident is closed.
- The time of detection and the time of onset, if known
- Both times matter. The 24-hour deadline runs from detection; the exposure of other members is measured from onset.
- What is known about the cause
- The member's current understanding of how the incident arose, marked clearly as confirmed or suspected. A report that says the cause is unknown is preferred to one that guesses.
- The effect on shared services
- Which shared Network services are unavailable or degraded, for which members, and whether the system is operating in the reduced form set out in its continuity plan.
- The steps already taken
- Containment measures taken so far and any measures the member intends to take next, so that the Department can advise other members consistently.
- The member's proposed severity
- The severity the member proposes under the table above. The Department confirms the severity in its acknowledgement or assigns a different one, giving reasons.
What the Department does. The steps below describe how the Department handles a report from acknowledgement to closure, so that members know what to expect.
Step 1: Acknowledge the report
The Department acknowledges every report within two hours during working hours and within four hours at other times, confirms or revises the proposed severity and names the officer who will handle the incident.
Step 2: Identify the members exposed
Using the register of shared infrastructure, the Department identifies every member whose registered systems depend on the affected system, directly or through another system.
Step 3: Warn and coordinate
Where more than one member is affected, the Department convenes the affected members' points of contact, agrees the order in which measures will be taken and keeps a single record of the incident's status for all of them.
Step 4: Issue an advisory where the threat may recur
Where the incident reveals a threat likely to affect other members, the Department issues a security advisory at the appropriate level, describing the threat and the measures required without identifying the reporting member.
Step 5: Confirm closure
When the reporting member and any other affected members report normal operation, the Department confirms that the incident is closed and records the date.
Step 6: Record the lessons
The Department reviews the closing report, records any finding against the systems concerned and considers whether the framework, the reporting procedure or the exercise programme should change as a result. Aggregate lessons are published once a year.
Questions about reporting.
The classification of infrastructure by tier is explained in the Interim Network Defence Framework. The systems a report refers to are those registered with the Department. Warnings that arise from reports are issued as security advisories, and closing reports are reflected in members' readiness returns. Terms used on this page are defined in the Glossary.