The Global Centre for Risk and Innovation (GCRI)
When identity, payment or benefit systems fail, people cannot prove who they are, get paid or receive help. Public digital services must withstand outages, cyber attacks and surges in demand, and degrade gracefully when they cannot. This page sets out how digital public services fail and recover, how resilience is measured, and what evidence serves the agencies and regulators responsible.
GCRI · In development · service level R0
Resilience of public digital services is their ability to keep working through outages, attacks and demand surges, and to degrade gracefully when they cannot. Shared components fail together, crises overload systems, attacks target public data, and offline and manual fallbacks protect people's access to essentials.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India; each layer is a dated NASA product.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 2
Connected activity
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Night-time lights and population density, the footprint of electrified, connected activity, framed on India.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Digital service resilience · Payment switch · Today
| Identity verify | 358 | 0.2 | Normal |
| Instant payment | 751 | 0.4 | Normal |
| Data exchange | 990 | 0.5 | Degraded |
| Offline fallback | n/a | n/a | Standby |
Outage, cyber and operational controls. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Services that share an identity layer, payment switch or hosting platform fail together when that component fails.
Benefit applications in a crisis, tax deadlines and enrolment periods can overload systems designed for normal demand.
Ransomware and denial-of-service attacks on public systems disrupt services and can expose the personal data of many people.
Offline modes, manual processes and alternative channels let people still receive essential services during outages.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Single point of failure | A component whose failure stops a whole service because no alternative exists. |
| Load testing | Simulating high demand to check a system's capacity and behaviour. |
| Offline fallback | A way of delivering a service when digital systems are unavailable. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Availability of critical public digital services | percent of time | monthly | Service monitoring | OBSERVED |
| Major outages | count and duration | annual | Incident records | OBSERVED |
| Cyber incidents affecting public services | count | annual | National CSIRT reports | OFFICIAL |
| Services with tested offline fallback | percent of critical services | per assessment | Continuity test records | REPORTED |
| Peak load capacity relative to normal | ratio | per test | Load testing | OBSERVED |
| Recovery time after major outages | hours | per incident | Incident records | OBSERVED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| National CSIRT and cyber agency reports | Incidents affecting public services | Public, terms per agency |
| Published post-incident reviews of government digital services | Causes and recovery of outages | Public records, terms per publisher |
| NIS2 Directive requirements for public administration | Resilience obligations for public entities in the EU | Public, EU terms |
| Government service performance dashboards | Availability and usage of digital services | Open data where published |
| ENISA reports on public sector cybersecurity | Threats and good practice | Public, ENISA terms |
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Digital government agencies | Where to add redundancy, capacity and fallbacks | Dependency maps; continuity reviews |
| Social protection and tax agencies | How to keep services available at peak and in crises | Load testing evidence |
| Regulators and auditors | What resilience to require and check | Incident and availability evidence |
A digital public service is only as dependable as its weakest dependency. Identity, payment and data exchange components are shared across many services, so an outage in one can halt several at once. Demand surges, for example during an emergency benefit programme, can overwhelm systems that perform well in normal times. Resilience requires engineering, operations and governance that plan for failure.
Resilience depends on design, operations and fallback arrangements.
Redundancy, graceful degradation and isolation of components so that one failure does not take down everything.
Capacity planning, change control, monitoring and incident response. Many outages follow changes or updates.
Offline procedures, assisted service and deferred processing that keep essential functions running.
Resilience is often traded away quietly. Paper processes are retired to save money, the staff who knew manual procedures move on, and redundancy is cut because it was never used. Evidence from outages suggests that maintaining and exercising fallback arrangements for the most essential functions is one of the most cost-effective resilience measures available.
Availability and performance records. Public reporting by government services is uneven.
Post-incident reports show causes and lessons. Blame-free review encourages candour.
Simulated outages and cyber incidents test plans. Digital service continuity is the platform's Nexus Universe theme.
Maps of shared components and their failure impact, applying cybersecurity and cryptography and high-performance, cloud and edge computing.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.