References and record
Every source the edition rests on, the publication record, the corrections log and the open record.
Contents
- ·Edition home
- ·Executive summary
- 1Digital systems fail together
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Shared provider failure that overlaps a power or network loss
- 6Readings from the other desks
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
C.143 sources
NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).
- 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 2ENISA (ed.), ENISA Threat Landscape 2024 (publication page; published 19 September 2024; seven prime threats; no counts on the page). European Union Agency for Cybersecurity, Athens. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
- 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
- 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
- 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
- 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
- 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
- 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
- 11POST-CLOSE, context only: ITU (ed.), Facts and Figures statistics page (2026 edition: 6.3 billion online, 76%; about 2 billion offline; materials dated November 2026), read as a newer estimate and not used in findings. International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03. Cited in chapter 6
- 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 3, chapter 6, chapter 8
- 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
- 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
- 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 4, chapter 6, chapter 8
- 16United Nations (ed.), Global Digital Compact (programme page; negotiated by 193 Member States; opened for endorsement in September 2024; commitment to increase investment in digital public goods and digital public infrastructure). United Nations, New York. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
- 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
- 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
- 20CISA (ed.), Critical Infrastructure Sectors (page: sixteen sectors, including Communications, Energy, Information Technology and Water and Wastewater). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in chapter 3
- 21IBM (ed.), Cost of a Data Breach Report 2026 (report page: global average cost of USD 4.99 million, up 12% on the previous year, described as a record). IBM, Armonk. Observation year 2026. Accessed 2026-11-03. Cited in chapter 6
- 22Verizon (ed.), Data Breach Investigations Report 2026 (report page: 31% of breaches begin with software vulnerabilities; coverage 1 November 2024 to 31 October 2025). Verizon, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
- 23International Monetary Fund (ed.), Global Financial Stability Report, April 2024 (publication page: risk of extreme losses from cyber incidents has increased; the financial sector is highly exposed; chapter figures not read). IMF, Washington. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 24NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0 (programme page; two-year anniversary note of 24 February 2026; intended for industry, government and organisations). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 25BleepingComputer, Costa Rica declares national emergency after Conti ransomware attacks (press report of 9 May 2022: declaration on 8 May 2022 under Decree No. 42542; Ministry of Finance and other bodies affected). Observation year 2022. Accessed 2026-11-03. Cited in chapter 6, chapter 8
- 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
- 27UNVERIFIED, not opened: G20, New Delhi Leaders’ Declaration, 9 to 10 September 2023 (welcomed the G20 Framework for Systems of Digital Public Infrastructure and a global repository of digital public infrastructure), taken from press coverage of the declaration. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
- 28UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, Change Healthcare cybersecurity incident (about 100 million notices sent by October 2024), taken from search-result summaries of HHS statements; a later figure of 192.7 million appears in one press report and is not used. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3
- 29UNVERIFIED, not opened: Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 30UNVERIFIED, not opened: Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
- 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 32UNVERIFIED, not opened: United Nations Development Programme and partners, Universal Digital Public Infrastructure Safeguards Framework, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 33UNVERIFIED, not opened: Tikk, E., Kaska, K. and Vihul, L., International Cyber Incidents: Legal Considerations. Cooperative Cyber Defence Centre of Excellence, Tallinn, 2010, cited from memory. Observation year 2007. Accessed 2026-11-03. Cited in chapter 6
- 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
- 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
- 36UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03. Cited in chapter 6
- 37UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 38UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
- 39UNVERIFIED, not opened: Cyber Safety Review Board, Review of the December 2021 Log4j Event, 2022, cited from memory; no figure used. Department of Homeland Security, Washington. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
- 40UNVERIFIED, not opened: Schmitt, M.N. (ed.), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Cambridge University Press, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03. Cited in chapter 6
- 41UNVERIFIED, not opened: OECD, Recommendation of the Council on Digital Security of Critical Activities, 2019, cited from memory. OECD Publishing, Paris. Observation year 2019. Accessed 2026-11-03. Cited in chapter 6
- 42UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals, cited from memory. Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2022. Accessed 2026-11-03. Cited in chapter 4, chapter 6
- 43UNVERIFIED, not opened: United Nations General Assembly, resolution adopting the United Nations Convention against Cybercrime (December 2024), cited from memory; the resolution number is not stated. United Nations, New York. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
C.2Publication record
Publication
- Title
- Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk, Baseline Edition
- Series
- Reports · Strategic Systems Series SR-10
- Edition
- Baseline Edition 2026 · inaugural annual
- Version
- v1.0.0 · draft for stewardship review
- Publication ID
- NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE-v1.0.0
- Evidence close
- 30 September 2026
- Publication date
- October 2026
- DOI
- concept and version DOI at deposit
Publisher
- Publisher of record
- The Global Centre for Risk and Innovation (GCRI), for the Nexus Consortium
- Place
- Toronto
- Editor
- Saeed Valadbaygi, Chief Steward and Managing Editor
- Stewards
- GCRI · technical truth · the Global Risks Forum (GRF) · public meaning · the Global Risks Alliance (GRA) · capital meaning
- Licence
- text CC BY 4.0; data on the terms of each source
- Copyright
- © 2026 GCRI · Nexus Consortium
- Language
- English (en-GB) source edition
- Correspondence
- Registry correction pathway · editorial office
Colophon
- Format
- A4 portrait · screen, print and archival PDF
- Typefaces
- Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)
- Design standard
- Reports Foundational Edition, Volume I, Part VII
- Accessibility
- tagged PDF and HTML targets; text alternatives for every figure
- Production
- Reports editorial team, GCRI
Release path for this version
| Step | What happens | When |
|---|---|---|
| Draft | editorial self-check complete at evidence close | October 2026 |
| Steward review | five passes on the exact draft (keys T · M · F · N) | Q4 2026 |
| Approval | publication authority approves the exact digest | before release |
| Deposit | concept and version DOI minted; registry pointer set | at release |
| Succession | the 2027 digital public infrastructure edition reports changes against this baseline | 2027 |
- Current version
- v1.0.0 draft, stewardship review
- Previous edition
- none, first edition of the series
- Next edition
- NR-STRATEGIC-DPI-GLOBAL-2027-v1.0.0
- Latest version
- resolve the concept DOI or the registry record
- Correction route
- Registry correction pathway
- Notice types
- erratum · addendum · supersession · withdrawal
C.3Corrections log
0correction notices. No edition has been released yet, so none can be corrected; the log below lists each edition’s current version.
| Edition | Version | Date | State | Change | Notice |
|---|---|---|---|---|---|
| SR-10 | NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE-v1.0.0 | October 2026 | Draft | Baseline Edition 2026, inaugural annual edition, | None |
Notice types: erratum, addendum, supersession, withdrawal. A correction is a new version with a published notice; the earlier version stays resolvable, and no edition is ever edited in silence.
C.4Open record
This edition’s open record
- Publication ID
- NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE-v1.0.0
- Desk identifier and series alias
- NR-STR-SR-10-2026-BL
- Collection
- None
- DOI
- Concept and version DOI at deposit, on Zenodo with DataCite metadata
- Versions
- Each correction is a new version (isNewVersionOf); the concept DOI resolves to the latest
- Bundle
- RO-Crate 1.2 with CITATION.cff, CodeMeta and PROV-O provenance; a signed manifest
- Licence
- CC BY 4.0 (SPDX CC-BY-4.0) for original material; metadata CC0 1.0
Credit and identity
- ORCID
- Your iD in the deposit and the contribution record; DataCite can then add the work to your ORCID record
- ROR
- Your organisation by its ROR identifier, never by a typed name alone
- CRediT
- Conceptualization, Data curation, Formal analysis, Investigation, Methodology, Software, Validation, Visualisation, Writing, review and editing
- Account
- None needed to contribute; never a password
Find and follow
Search the open indexes for Digital Public Infrastructure and Systemic Cyber Risk; software is cited by its SWHID from Software Heritage, and a quantified scenario run is preregistered on OSF before it is run. Annotation is your choice: Hypothesis opens this page in its own viewer.
Mirrors and harvest
The DOI is canonical. At release each signed bundle is also given an IPFS content identifier and a bloxberg anchor as mirrors; both are listed in the record once they exist. Zenodo exposes every record over OAI-PMH, and reviews and endorsements can arrive through COAR Notify where the repository supports it.
{
"metadata": {
"resource_type": {
"id": "dataset"
},
"title": "Evidence on Digital Public Infrastructure and Systemic Cyber Risk for Nexus Reports",
"publication_date": "YYYY-MM-DD",
"creators": [
{
"person_or_org": {
"type": "personal",
"family_name": "Your family name",
"given_name": "Your given name",
"identifiers": [
{
"scheme": "orcid",
"identifier": "0000-0000-0000-0000"
}
]
},
"affiliations": [
{
"id": "ROR identifier of your organisation"
}
]
}
],
"description": "What it is, where its record is kept and how it bears on Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk.",
"rights": [
{
"id": "cc-by-4.0"
}
],
"subjects": [
{
"subject": "Nexus Reports"
},
{
"subject": "Digital Public Infrastructure and Systemic Cyber Risk"
},
{
"subject": "Strategic Systems Report · SR-10"
}
],
"related_identifiers": [
{
"identifier": "https://therisk.global/nexus-reports/editions/sr-10/",
"scheme": "url",
"relation_type": {
"id": "issupplementto"
},
"resource_type": {
"id": "publication-report"
}
}
],
"version": "1.0.0"
},
"custom_fields": {},
"access": {
"record": "public",
"files": "public"
},
"files": {
"enabled": true
},
"parent": {
"communities": {
"default": "nexusreports"
}
}
}C.5Where this edition sits among the six pillars
Foundry seals the evidence and Universe tests it; Reports publishes it; Standards takes its corrections and Academy teaches from it.
- F03 Sealed observations and indicator series Foundry Sealed observations and indicator series behind a profile (closeout).
- F04 After-action and scenario findings for Universe After-action and scenario findings for chapters 10 and 13 (after action review).
- F05 National Portfolio movement for chapter Foundry National Portfolio movement for chapter 11 (after action review).
- Applied in editions Standards Nexus Standards: applied in editions.
- SR-10 edition Reports Digital Public Infrastructure and Systemic Cyber Risk 2026, published in every format with its sources, citation and corrections.
- F06 Method and correction findings as change Standards Method and correction findings as change proposals (correction).
- F12 Q4 synthesis informs the next-year Universe Q4 synthesis informs the next-year mandate (renewal).
- Taught in the open Academy Risk Academy: taught in the open.
What Foundry and Universe hand to this edition, and what it hands to Standards, Universe and Academy. From the programme spine; SR-10 is a drafted Baseline Edition, so these handoffs run from its first operational quarter.
| Handoff | Between | What crosses, and when |
|---|---|---|
| F03 | Foundry to Reports | Sealed observations and indicator series behind a profile (closeout). |
| F04 | Universe to Reports | After-action and scenario findings for chapters 10 and 13 (after action review). |
| F05 | Foundry to Reports | National Portfolio movement for chapter 11 (after action review). |
| Ring | Nexus Standards to Reports | Nexus Standards: applied in editions. |
| F06 | Reports to Nexus Standards | Method and correction findings as change proposals (correction). |
| F12 | Reports to Universe | Q4 synthesis informs the next-year mandate (renewal). |
| Ring | Reports to Risk Academy | Risk Academy: taught in the open. |