Data appendix
The indicator set with its sources, the source registers, the licences of every kind of material and the formats of the edition.
Contents
- ·Edition home
- ·Executive summary
- 1Digital systems fail together
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Shared provider failure that overlaps a power or network loss
- 6Readings from the other desks
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
B.1The indicator set
| Indicator | Value | Unit | Year | State | Source |
|---|---|---|---|---|---|
| Windows devices affected | 8.5 | million | 2024 | Reported | 3 |
| AWS event, first impact to end | ≈ 14.5 | hours | 2025 | Reported | 4 |
| Cloudflare event, to full resolution | ≈ 5.8 | hours | 2025 | Reported | 5 |
| Longest reported intrusion persistence | ≥ 5 | years | 2024 | Reported | 6 |
| ENISA incidents analysed | 4,875 | incidents | Jul 2024 to Jun 2025 | Reported | 1 |
| UK incidents handled | 429 | incidents | Sep 2024 to Aug 2025 | Reported | 8 |
| UK nationally significant incidents | 204 | incidents | Sep 2024 to Aug 2025 | Reported | 8 |
| UK highly significant incidents | 18 | incidents | Sep 2024 to Aug 2025 | Reported | 8 |
| Jaguar Land Rover event, UK financial impact | ≈ 1.9 | GBP billion | 2025 | Estimated | 9 |
| People online | ≈ 6.0 | billion | 2025 | Reported | 10 |
| People offline | 2.2 | billion | 2025 | Reported | 10 |
| Adults with an account | 79 | % | 2025 | Reported | 12 |
| UPI volume, October 2025 | 20.7 | billion transactions | 2025 | Reported | 13 |
| Pix peak day, 5 December 2025 | ≈ 313.3 | million transactions | 2025 | Reported | 14 |
| X-Road transactions | 2.2 | billion a year | 2025 | Reported | 15 |
B.2Global source register
The governed source set behind this edition. Each source keeps its authority, coverage, cadence and role; categories describe origin, not truth.
Domains bound by the register
- DAT
- INF
- CYB
- FIN
- DEV
- ENE
- HLT
- AIC
- MIN
- TRD
| Source | Category | Coverage | Period | Cadence | Role |
|---|---|---|---|---|---|
| Microsoft statement3 | vendor | global | 2024 | one-off | software failure |
| AWS post-event summary4 | cloud provider | US-EAST-1 and dependents | 2025 | per event | cloud failure |
| Cloudflare outage report5 | edge provider | global | 2025 | per event | edge failure |
| CISA advisory AA24-038A6 | national agencies | US and partners | 2024 | per event | cyber access |
| CISA advisory AA25-239A7 | national agencies | global | 2025 | per event | telecom campaign |
| ENISA Threat Landscape1 | EU agency | EU | 2024 to 2025 | annual | incidents |
| NCSC Annual Review8 | national agency | UK | 2024 to 2025 | annual | incident load |
| ITU Facts and Figures10 | UN agency | global | 2025 | annual | connectivity |
| World Bank Global Findex12 | multilateral bank | global | 2025 | triennial | account ownership |
| X-Road page15 | national programme | Estonia | 2025 | continuous | data exchange |
B.3Regional reading, ten regional clusters
Map plates follow with the regional Baseline Editions, when boundary sources and public-safe resolutions are bound. This page gives the regional reading in table form and ranks no region.
| Region | Principal hazards | Systems most exposed | Baseline evidence |
|---|---|---|---|
| North America | cloud region concentration; operator access reports | power, water, telecoms | CISA advisory6; AWS4 |
| South America | instant payment rail at national scale | payments, identity | Pix record14 |
| Europe | network security and financial resilience rules; threat landscape | networks, finance | ENISA1; NIS218; DORA19 |
| Eurasia | regional data not bound | not bound | not bound |
| Middle East and North Africa | regional data not bound | not bound | not bound |
| Africa | regional data not bound; low Internet use in low-income countries | identity, access | ITU10 |
| South Asia | instant payment rail at national scale | payments, identity | UPI volume13 |
| East Asia | regional data not bound | not bound | not bound |
| ASEAN | regional data not bound | not bound | not bound |
| Oceania-Pacific | regional data not bound; telecom campaign reported in allied states | telecoms | CISA advisory7 |
B.4Regional card: United Kingdom incident load
- country
- national agency
- incident handling
- annual review
- Systems in view
- essential services, critical infrastructure, government functions
- Defining reading
- 204 nationally significant incidents in the year to August 20258
- Couplings
- CYB → INF · INF → DAT
- Capability evidence
- annual public review of incident handling8
- Gaps
- sector split; comparison with other national bodies
- Agenda items
- D-02 · D-05
The agency handled 429 incidents in the year, 204 of them nationally significant and 18 highly significant [8].
THREAT
Incident load
Nationally significant incidents rose from 89 to 204 and highly significant ones from 12 to 18 [8].
TREND
A rising count
The review reports what one agency handled. It is not an attribution of any incident to an actor [8].
LEARNING
A public review
B.5How countries appear in the global edition
Countries enter the digital public infrastructure edition through the digital chapters of their own national editions, on one card grammar. They are read against peer distributions and thresholds, never placed in a league table.
| Card field | What it shows | Source |
|---|---|---|
| WEFH+B state | each core system against peer distribution bands | national edition |
| Couplings | the national dependency matrix | national edition |
| Risk objects | the national risk portfolio | national edition |
| Capability rungs | the national capability ladder | national edition |
| Evidence age | oldest and newest source dates | national source register |
Editions in the 2026 Baseline programme
26national
countries and unions
10regional
clusters
16global
flagship and sector
20frontier
technology reports
How to read a country card
- Each system is shown against the distribution of its peers, with thresholds where they exist
- Couplings and risk objects come from the country’s own national edition
- Capability rungs record evidence, not a judgement of institutions
- Evidence age is printed, so older national data are visible as such
| Wave | Countries and unions | State |
|---|---|---|
| W0 | Canada | ISSUED |
| W1 | United States, United Kingdom, France, Germany, Italy, Japan, European Union, Switzerland | PLANNED |
| W2 | Mexico, Brazil, Argentina, Türkiye, Russian Federation, Saudi Arabia, United Arab Emirates, South Africa, Senegal, Kenya, African Union, India, China, Republic of Korea, Indonesia, Singapore, Australia | PLANNED |
B.6Licences
| Material | Licence |
|---|---|
| Text | CC BY 4.0 |
| Data | on the licence of each source; Nexus tables CC BY 4.0 |
| Figures | Nexus figures CC BY 4.0; third-party as credited |
| Maps | boundary source and licence printed on each plate |
| Metadata | CC0 1.0, as Zenodo publishes it |
| Third-party data, figures and text | The source’s own licence, credited where it is used; never relicensed |
| Nexus-authored text, tables and figures: CC BY 4.0 (SPDX CC-BY-4.0). Map plates print their boundary source and licence. | |
B.7Formats and provenance
| Format | Kind | State | What it is | Identifier |
|---|---|---|---|---|
| Web edition | HTML | On this site | Draft in stewardship review; every value resolves to its source. | NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE-v1.0.0 |
| Print edition | At release | A4 portrait · screen, print and archival PDF, signed with the web edition at release. | NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE-v1.0.0 | |
| Indicator data | CSV · JSON | On this site | 15 indicators with unit, year, status and source; the machine-readable copy ships with the evidence bundle at release. | NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE data release v1 |
| Figures | SVG · PNG | On this site | 4 on the web edition: headline figure, figure 1.3, coupling instrument, capability ladder. | FIG-STRATEGIC-DPI-GLOBAL-2026-BASELINE-* |
| Slides | Not recorded | No slide deck is recorded for this edition. | ||
| Evidence brief | HTML · PDF | Not recorded | No evidence brief is recorded for this edition. | |
| Dataset with DOI | DataCite | At release | Concept and version DOI are minted at deposit; none is recorded yet. |
Provenance
- Edition pack
- The edition’s content pack (JSON), from which the print and web editions are built
- Evidence cut
- DC-STRATEGIC-DPI-GLOBAL-2026-B0, closed 30 September 2026
- Reproducibility
- sourced values cited; analytical values reproducible from stated parameters
- Self-check
- 14 of 23 at evidence close; a fail on any item blocks release
- Review
- five passes scheduled before release (in Annex C)
- Publisher of record
- The Global Centre for Risk and Innovation (GCRI) for the Nexus Consortium
- Corrections
- Registry correction pathway; upheld corrections are published as notices with a new version
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
- 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
- 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
- 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
- 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
- 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
- 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
- 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
- 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
- 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
- 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
- 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
- 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
- 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
- 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back