Readiness reporting
Between exercises, the Department keeps a continuous view of the Network's resilience through readiness reporting. Each quarter, every member of the Velocity Interoperability Network assigns a readiness category to each system it has registered with the Department and submits the result as a readiness return. The scheme took effect on 6 September 2026 alongside the Interim Network Defence Framework.
The categories are deliberately few and deliberately plain. They describe whether the controls and continuity plans that the framework requires are in place and tested, not how well a member believes it would perform. A return is a statement of fact about a system on a given date, and the Department verifies a sample of returns each year against the evidence behind them.
- 5
- Readiness categories, R0 to R4
- 4
- Returns each year for Tier 1 and Tier 2 systems
- 5 days
- Working days to notify the Department of an R4 assessment
- 30 Nov
- Baseline return due, 2026
Readiness categories. Every registered system is placed in one of the categories below in each return. The definitions are the same for every tier; what differs by tier is the set of controls the framework requires.
| Category | Name | Definition | Action required |
|---|---|---|---|
| R1 | Fully ready | Every control required by the Interim Network Defence Framework for the system's tier is in place and has been tested within the last twelve months. A continuity plan exists and has been exercised. No findings are open. | None. The system is included in the next return in the ordinary way. |
| R2 | Ready with observations | Every required control is in place. One or more minor findings are open, each with a dated remediation plan, or the continuity plan exists but has not been exercised within the last twelve months. | The remediation plan is attached to the return. Findings are expected to be closed by the following return. |
| R3 | Partially ready | One or more required controls is not in place, or no continuity plan exists for the system. The system would continue in a reduced form during a disruption, but recovery would depend on measures not yet tested. | A remediation plan is submitted within twenty working days of the return. The Department may arrange an inspection of the system. |
| R4 | Not ready | Required controls are substantially absent, or the system would not continue in any form during a disruption of the kind exercised by the Department. | The Department is notified within five working days of the assessment being made, without waiting for the return. A joint remediation plan is agreed and the matter may be raised with the member's governing body. |
| R0 | Not assessed | No assessment was completed for the system during the reporting period. | Treated as R4 for Tier 1 and Tier 2 systems until an assessment is completed. An explanation is given in the return. |
Reporting periods. Returns are due on the last day of the month following the end of each quarter. A baseline return, covering Tier 1 systems only, establishes the starting position before the first Network-wide exercise. The reporting periods for the first year are set out below; later periods follow the same pattern.
| Return | Period covered | Systems in scope | Due |
|---|---|---|---|
| Baseline return | Position at 31 October 2026 | Tier 1 systems registered by that date | 30 November 2026 |
| Fourth quarter 2026 | 1 October to 31 December 2026 | All Tier 1 and Tier 2 systems | 31 January 2027 |
| First quarter 2027 | 1 January to 31 March 2027 | All Tier 1 and Tier 2 systems; annual return for Tier 3 systems | 30 April 2027 |
| Second quarter 2027 | 1 April to 30 June 2027 | All Tier 1 and Tier 2 systems | 31 July 2027 |
Submitting a return. The steps below apply to every return. A member with no registered systems in scope for a period confirms that fact by the due date in place of a return.
Step 1: Confirm the systems within the return
Compare the member's registration records held by the Department with the systems it operates. Every registered Tier 1 and Tier 2 system is included in each quarterly return; Tier 3 systems are included once a year, in the return for the first quarter.
Step 2: Assess each system against the framework
For each system, confirm whether every control required for its tier is in place, when it was last tested, whether a continuity plan exists and when it was last exercised, and which findings from earlier returns, inspections or exercises remain open.
Step 3: Assign a readiness category
Assign one of the categories R1 to R4 using the definitions above. Where no assessment has been completed, record R0 and explain why. Do not assign a category more favourable than the evidence supports; the Department verifies a sample of returns each year.
Step 4: Attach remediation plans
For every system assessed as R2 or R3, attach a remediation plan naming the finding, the measure that will close it, the person responsible and the date by which it will be complete.
Step 5: Submit the return
The member's nominated contact sends the return to the Department's contact address by the due date, with the subject line "Readiness return" followed by the name of the member and the reporting period. A return is complete only when every registered system in scope has a category.
Step 6: Act on the Department's response
The Department acknowledges the return within five working days and tells the member whether any category has been queried, whether an inspection will be arranged and which findings it expects to see closed by the following return.
Questions about readiness reporting.
Returns and questions are sent to contact@defence.gov.vin. Systems are registered with the Department under the procedure at Register infrastructure; the controls required for each tier are set out in the Interim Network Defence Framework. For how the Department tests readiness in practice, see Readiness exercises. Terms used on this page are defined in the Glossary.