Draft, not yet released. In stewardship review. Not indexed until the first approved release.

The 2027 agenda

Eight bounded questions open the 2027 digital public infrastructure agenda. Each comes from a baseline finding, names the initiative that will carry it and the first output due in the 2027 digital public infrastructure edition.

5 min read0 figures6 tables5 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
    1. 7.1 Questions for the operational series
    2. 7.2 Portfolio proposed for the Q1 2027 alignment
    3. 7.3 The pathway
    4. 7.4 Universe 2027: evidence pack for the digital public infrastructure candidate mission
    5. 7.5 Handoffs and routing
    6. 7.6 Feeds and signal register
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

7.1Questions for the operational series

  1. D-01

    How would a failure at a shared cloud, identity or payment provider that overlaps a power or network loss spread through health, payments and public services at once?

    INI-SR10-CMP-01 · shared provider and power compound loss; first output: dependency analysis for six regions.

  2. D-02

    Which shared layers (software, cloud regions, DNS, identity) sit behind the most public services?

    INI-SR10-DEP-02 · shared layers; first output: dependency register.

  3. D-03

    How long do identity and payment services take to return after major outages, and what limits recovery?

    INI-SR10-RST-03 · restoration times; first output: restoration table.

  4. D-04

    Which countries run national identity, payment and data-exchange systems, and on what design?

    INI-SR10-INV-04 · national system inventory; first output: inventory note.

  5. D-05

    How do long-lived access reports translate into disruption risk for operators?

    INI-SR10-ACC-05 · access and disruption; first output: scoping note.

  6. D-06

    Which bodies publish incident data on a comparable basis?

    To be admitted in 2027; first output: coverage note.

  7. D-07

    How do offline populations interact with services that move to digital-only?

    To be admitted in 2027; first output: scoping note.

  8. D-08

    Which digital capabilities have been tested in real outages, and which are only planned?

    Digital capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 digital portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

Table 7.1Objects proposed for the first operational quarter
IDObjectKindQuestionState
INI-SR10-CMP-01Shared provider and power compound lossInitiativeD-01PROPOSED
INI-SR10-DEP-02Shared layersInitiativeD-02PROPOSED
INI-SR10-RST-03Restoration timesInitiativeD-03PROPOSED
INI-SR10-INV-04National system inventoryInitiativeD-04PROPOSED
INI-SR10-ACC-05Access and disruptionInitiativeD-05PROPOSED
MSN-SR10-2027-01Shared provider and power loss Universe missionMissionD-01Candidate

7.3The pathway

The digital public infrastructure edition reads national digital chapters, sector editions and the global edition through one governed evidence graph. At baseline the federation is designed and its first editions are drafted. This page states what exists today and what comes next.

  1. 01

    National digital chapters

    identity, payment and data-exchange reading in each national edition

    IN PREPARATION · national baselines

  2. 02

    Sector editions

    cyber and digital, finance, health, infrastructure

    PLANNED · sector Baseline Editions

  3. 03

    Digital public infrastructure model

    the global digital system of systems

    v0 SPECIFIED · v1 with federation evidence

  4. 04

    Strategic links

    SR-02 lifeline systems · SR-03 supply chains · SR-13 strategic technology infrastructure

    PLANNED · strategic baselines

  5. 05

    Universe

    annual proving environment

    CANDIDATE MISSION · mandate in 2027

  6. 06

    Digital Public Infrastructure Report

    this series

    BASELINE DRAFT · 2027 annual edition

  7. 07

    Evidence and correction

    one graph, many projections

    OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the digital public infrastructure candidate mission

  1. 01

    Mandate

  2. 02

    Core Build · 1 month

  3. 03

    Action · 1 week

  4. 04

    Evidence seal

  5. 05

    Portfolio correction

  6. 06

    Next mandate

Table 7.2Universe 2027: evidence pack for the digital public infrastructure candidate mission
ItemRecordStateTiming
F1Annual mandate recordPLANNEDafter the Q2 2027 alignment
F2Core Build recordPLANNEDone month before the exercise
F3Exercise evidencePLANNEDduring the Action week
F4Decision packetsPLANNEDexercise state only
F5Proof receiptsPLANNEDscoped to each recorded check
F6After-action reportPLANNEDwithin one quarter
F7Upgrade docketPLANNEDrouted to the Portfolio
F8Portfolio renewalPLANNED2027 digital public infrastructure annual edition
F9Public synthesisPLANNEDpublic-safe extracts only

Mission

ID
MSN-SR10-2027-01 · Shared provider and power loss Universe mission
Role spine
Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways
Receiving actors
to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

Table 7.3Handoffs and routing
FindingRouted toPurposeClass
DAT-001 · software failureINI-SR10-DEP-02shared layersPUBLIC
DAT-002 · cloud failureINI-SR10-DEP-02shared layersPUBLIC
DAT-003 · edge failureINI-SR10-RST-03restoration timesPUBLIC
CYB-004 · pre-positioningINI-SR10-ACC-05access and disruptionPUBLIC
CYB-006 · incident loadsector editionscommon incident basisPUBLIC
FIN-010 · payment railsINI-SR10-INV-04national system inventoryPUBLIC
DEV-009 · offline populationINI-SR10-INV-04national system inventoryPUBLIC
SYS-012 · compound pathwayMSN-SR10-2027-01Universe candidateCONSORTIUM
Table 7.4Routing rules by publication class
ClassWhere it goesWho can see it
PUBLICthe published edition and its evidence bundleanyone
CONSORTIUMgoverned rooms of the federationconsortium members under agreement
CONTROLLEDneed-to-know channelsnamed competent actors only

7.6Feeds and signal register

Table 7.5Feeds watched from 2027
FeedProducerLatencyFeeds into
Incident and advisory feedsCISA and partner agenciesper eventCYB-004
EU threat landscapeENISAannualCYB-007
National incident reviewUK NCSCannualCYB-006
Provider incident reportscloud, edge and software providersper eventDAT-002
Payment rail statisticsnational payment bodiesmonthlyFIN-010
Connectivity statisticsITUannualDEV-009
Event classificationCyber Monitoring Centreper eventFIN-008

Escalation routes

  • none · keep monitoring
  • research question
  • project
  • risk object
  • annual publication
  • signal report
Table 7.6Signals at baseline
IDSignalCorroborationSystemsRoute
SIG-SR10-001Single-vendor software outage in 20243CORROBORATEDDAT · INFrisk object RSK-SR10-DAT-001
SIG-SR10-002Multi-year access reported in several sectors67CORROBORATEDCYB · INFresearch question D-05
SIG-SR10-003Regional cloud fault and edge fault in 202545CORROBORATEDINF · DATresearch question D-01

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  2. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  3. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  4. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  5. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 7: The 2027 agenda. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices