Readiness exercises

The Department tests the Network's ability to keep shared services running under disruption through regular readiness exercises. Every member of the Velocity Interoperability Network is expected to take part in Network-wide exercises, and members operating systems that together provide a shared service take part in sector exercises as well.

An exercise is not an inspection. Its purpose is to find out what would happen, so that what would happen can be improved before it does. Members are asked to respond to the scenario as they would to a real incident, and the Department records what it observes without attributing blame. Findings recorded against a system after an exercise are closed in the same way as any other finding, through a remediation plan submitted with the member's next readiness return.

1

Network-wide exercise each year

8 weeks

Minimum notice of a Network-wide exercise

4

Kinds of exercise the Department runs

Q4 2026

First Network-wide exercise

What an exercise tests.

Continuity of shared services

Whether interoperable services continue to operate, in a reduced form if necessary, while a simulated disruption is contained.

Speed of reporting and containment

How quickly members detect, report and contain the simulated incident, measured against the 24-hour reporting deadline and the reporting intervals for the incident's severity.

Coordination between members

Whether the arrangements set out in the Interim Network Defence Framework allow affected members and the Department to act together, and whether advisories issued during the exercise reach the people who need them.

Accuracy of readiness returns

Whether the readiness category a member assigned to a system in its most recent return is borne out by how the system performed under the exercise.

Kinds of exercise. The Department runs four kinds of exercise, differing in who takes part and how much notice is given.

How an exercise is run.

1. 1

   Step 1: Planning guidance issued

   The Department sends each member guidance on the scope of the exercise, the systems within it, and the preparations expected.

2. 2

   Step 2: Members confirm participation

   Each member names a point of contact for the exercise and confirms the systems it will exercise, drawn from its registration records.

3. 3

   Step 3: Exercise conducted

   A simulated disruption is introduced. Members respond as they would to a real incident, including reporting to the Department, and the Department responds as it would, including issuing advisories marked as exercise material.

4. 4

   Step 4: Findings collected

   Members submit a short account of what occurred and what they observed. The Department reviews the reports received during the exercise and compares them with the timings its own record shows.

5. 5

   Step 5: Summary published

   A summary of the findings is published in the Newsroom. Members receive their own results separately, together with any findings to be recorded against their systems.

Schedule.

1. 6 September 2026

   First Network-wide exercise announced

2. September 2026

   Planning guidance sent to members

3. 30 November 2026

   Baseline readiness returns due for Tier 1 systems

4. Fourth quarter 2026

   First Network-wide readiness exercise held

5. After the exercise

   Summary of findings published; framework revised

6. 2027

   Sector exercises begin; unannounced tests introduced after consultation

Between exercises. Exercises show how the Network performs on one day against one scenario. Between them, members report each quarter on whether the controls and continuity plans the framework requires are in place for every registered system, under the readiness reporting scheme. The two together give the Department a continuous view of resilience.

Members that detect a real incident during an exercise report it in the usual way, marked as not part of the exercise, following the incident reporting procedure. The systems within an exercise are those registered with the Department.