Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk

S.1Abstract

S.2Key messages

Six readings that frame the digital public infrastructure baseline, and the eight questions this edition answers, each with its status and source.

1. Yes: software faults, configuration changes, hazards and hostile access recur across providers.³⁴⁵⁶

   Do digital failures have common causes?Reported

2. Through shared dependence on a few software, cloud and edge layers.³⁴⁵

   How do failures spread?Reported

3. No: agencies describe long-lived access as well as disruption.⁶⁷

   Is the threat only about outages?Reported

4. The UK handled 204 nationally significant incidents in one year; ENISA analysed 4,875.⁸¹

   How large is the incident load?Reported

5. UPI reached 20.7 billion transactions in a month; Pix 313.3 million in a day.¹³¹⁴

   How large are the payment rails?Reported

6. About 2.2 billion people were offline in 2025, mostly in lower-income countries.¹⁰

   Who is still outside?Reported

7. One national data-exchange layer signs and encrypts all outgoing data.¹⁵

   Does design help?Reported

8. A shared provider failure that overlaps a power or network loss. SCN-SR10-DPI-01

   What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-006

The UK handled 204 nationally significant incidents from September 2024 to August 2025, up from 89 the year before, and 18 highly significant incidents, up from 12.

Nationally significant incidents made up 48% of the 429 incidents handled. The count measures what one agency handled and classed, so it is a sign of load on that agency and of reporting practice as much as of threat⁸.

S.4At a glance

S.5What each steward reads in it

S.6What this edition is, and is not

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
5. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
6. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
7. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
8. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
9. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
10. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
11. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
12. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back

1.1The questions this part answers

Key questions

• Where is digital public infrastructure risk concentrated?
• Which couplings carry digital public infrastructure shocks into other systems?
• Which digital public infrastructure capabilities hold under compound stress?
• What must 2027 evidence measure first?

In this part

• Narrative
• Headline finding
• Lead figure
• Five mechanism chapters
• Twelve-domain reading
• Sector screens
• Dependency matrix
• Risk objects
• Capability ladder
• Scenario
• Three lenses
• Portfolio

1.2The argument

1.3Twenty couplings between five systems

The digital public infrastructure-centred matrix types the twenty couplings between the five core systems, read for their digital public infrastructure content. Strengths are Nexus estimates (ESTIMATED) from the cited evidence and analogue events; they set the graph that 2027 evidence will test.

Transmission paths

1. 01

   DAT → INF → FIN

   A software fault spreads through a shared vendor to many operators and their payments.

   Reported 2024 outage³

2. 02

   INF → DAT

   A DNS fault at one regional endpoint spreads to services that rely on it.

   Reported 2025 cloud event⁴

3. 03

   INF → DAT

   A configuration file passes a built-in limit at an edge network and many sites fail.

   Reported 2025 edge event⁵

4. 04

   CYB → ENE, WAT

   Long-lived access in operator networks sits beside the control of energy and water systems.

   Reported agency advisory⁶

5. 05

   CYB → FIN

   A cyber event at one manufacturer spreads to its supplier network.

   Reported JLR 2025⁹

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
5. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
6. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
7. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
8. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
9. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
10. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back

2.1Headline finding

ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-006

The UK handled 204 nationally significant incidents from September 2024 to August 2025, up from 89 the year before, and 18 highly significant incidents, up from 12.

Implication

Nationally significant incidents made up 48% of the 429 incidents handled. The count measures what one agency handled and classed, so it is a sign of load on that agency and of reporting practice as much as of threat⁸.

What would move it

The next NCSC review, ENISA reporting and any common definition of a significant incident would each move this finding.

2.2Data and digital

1. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-001

   A single software update affected an estimated 8.5 million Windows devices on 18 July 2024, which Microsoft put at less than one percent of all Windows machines.³

2. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-002

   A latent race condition in the DNS management system for one database service left an empty record for its regional endpoint. The event ran from 11:48 PM PDT on 19 October to 2:20 PM PDT on 20 October 2025, and services that rely on that region’s endpoints were affected.⁴

3. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-003

   A database permissions change caused a feature file to roughly double in size and exceed a built-in limit on 18 November 2025. Core traffic resumed at about 14:30 UTC and all systems were normal at 17:06 UTC. The provider stated that no cyber attack was involved.⁵

4. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DAT-011

   The Estonian X-Road data-exchange layer handles 2.2 billion transactions a year across more than 3,800 e-services, and all outgoing data is digitally signed and encrypted.¹⁵

2.3CYB

1. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-004

   Agencies assessed in February 2024 that a state-sponsored actor was pre-positioning on networks in communications, energy, transportation and water sectors, with access maintained for at least five years in some victim environments.⁶

2. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-005

   A joint advisory of 27 August 2025 describes a state-sponsored campaign against telecommunications, government, transportation, lodging and military networks, active since at least 2021.⁷

3. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-006

   The UK handled 204 nationally significant incidents from September 2024 to August 2025, up from 89 the year before, and 18 highly significant incidents, up from 12.⁸

4. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-CYB-007

   ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025 for the EU threat landscape.¹

2.4Finance

1. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-FIN-008

   The Cyber Monitoring Centre estimated the UK financial impact of the 2025 Jaguar Land Rover cyber event at about GBP 1.9 billion, with over 5,000 UK organisations affected, and placed it at Category 3 on its five-level scale.⁹

2. ReportedEQL 3NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-FIN-010

   UPI processed 20.7 billion transactions worth Rs 27.28 lakh crore in October 2025, and Pix recorded about 313.3 million transactions worth R$ 179.9 billion in one day, on 5 December 2025.¹³¹⁴

2.5Development

1. ReportedEQL 4NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-DEV-009

   About 6 billion people used the Internet in 2025 and 2.2 billion did not. Use was 94% in high-income countries and 23% in low-income countries, and 85% in urban areas against 58% in rural areas.¹⁰

2.6Systemic

1. Expert inputEQL 2NRF-STRATEGIC-DPI-GLOBAL-2026-BASELINE-SYS-012

   The leading compound pathway for 2027 testing is a failure at a shared cloud, identity or payment provider that overlaps a power or network loss. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
2. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
3. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
4. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
5. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
6. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
7. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
8. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
9. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
10. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
11. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
12. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back

3.1Where each system stood at evidence close

3.2Domain posture

Each of the twelve coupled domains is read through digital public infrastructure, in words, not scored. The coupling column names the dependency that carries digital public infrastructure risk into each domain.

3.3Sector screens

All sixteen sectors are screened for their dependence on digital public infrastructure, on the same grammar as every national edition. The evidence column describes coverage of the baseline evidence, not the performance of the sector.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
3. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
4. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
5. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
6. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
7. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
8. 28UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, Change Healthcare cybersecurity incident (about 100 million notices sent by October 2024), taken from search-result summaries of HHS statements; a later figure of 192.7 million appears in one press report and is not used. Observation year 2024. Accessed 2026-11-03.back
9. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
10. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
11. 20CISA (ed.), Critical Infrastructure Sectors (page: sixteen sectors, including Communications, Energy, Information Technology and Water and Wastewater). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
12. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
13. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
14. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
15. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
16. 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
17. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

1. ReportedEQL 4RSK-SR10-DAT-001

   Common-vendor software failure

   Driver

   one faulty update on a widely deployed platform³

   Exposure

   airlines, hospitals, banks, broadcasters

   Vulnerability

   concentrated vendors; automatic update paths

   Capacity

   staged roll-out; manual fallback; recovery playbooks

   Cascade

   DAT → INF → FIN, HLT

   Horizon

   annual

2. ReportedEQL 4RSK-SR10-INF-002

   Regional cloud or edge fault

   Driver

   a DNS fault or a configuration file limit at a shared provider⁴⁵

   Exposure

   services that rely on one region or one edge network

   Vulnerability

   single-region dependence; hidden dependencies between provider services

   Capacity

   multi-region design; fallback paths; incident reporting

   Cascade

   INF → DAT → FIN

   Horizon

   1 to 3 years

3. InferredEQL 3RSK-SR10-CYB-003

   Pre-positioned access in operator networks

   Driver

   state-sponsored access reported in several sectors⁶⁷

   Exposure

   communications, energy, transport and water operators

   Vulnerability

   internet-facing devices; long dwell time

   Capacity

   logging; phishing-resistant authentication; segmentation²⁴

   Cascade

   CYB → DAT → INF

   Horizon

   1 to 5 years

4. InferredEQL 3RSK-SR10-DEV-004

   Exclusion as services go digital-only

   Driver

   services move online while 2.2 billion people are offline¹⁰

   Exposure

   low-income, rural and unidentified populations²⁶

   Vulnerability

   no identity, device or connection

   Capacity

   inclusive design; assisted channels; safeguards³²

   Cascade

   DAT → DEV

   Horizon

   1 to 10 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence at the global level, from a policy listing to performance in real events.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
5. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
6. 24NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0 (programme page; two-year anniversary note of 24 February 2026; intended for industry, government and organisations). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
7. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
8. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
9. 32UNVERIFIED, not opened: United Nations Development Programme and partners, Universal Digital Public Infrastructure Safeguards Framework, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
10. 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
11. 42UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals, cited from memory. Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2022. Accessed 2026-11-03.back
12. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
13. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
14. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
15. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
16. 16United Nations (ed.), Global Digital Compact (programme page; negotiated by 193 Member States; opened for endorsement in September 2024; commitment to increase investment in digital public goods and digital public infrastructure). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
17. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
18. 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
19. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
20. 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
21. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
22. 37UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back

5.1Assumptions

Scenario SCN-SR10-DPI-01: what is assumed, and what is held constant.

Baseline

the 2026 reference state in this edition

Drivers

a configuration or DNS fault at a shared cloud or edge provider, coinciding with a regional power or network loss

Analogues

cloud event, October 2025; edge event, November 2025; software outage, 2024³⁴⁵

Interventions

none modelled: the specification describes the unmitigated case

Run state

narrative specification; quantified run scheduled for 2027

5.2The cascade, step by step

1. 1

   INF → DAT

   a shared provider fault removes a regional endpoint or an edge network

   2025

2. 2

   DAT → FIN

   payment and identity checks fail or time out at dependent services

   2025

3. 3

   ENE → INF

   a regional power loss cuts exchanges and data centres to batteries and generators

   2026

4. 4

   DAT → HLT

   records, claims and dispatch services degrade

   2024

5. 5

   DAT → DEV

   services with no offline path exclude users with no fallback

   2025

6. 6

   INF → FIN

   payments pause; losses accumulate

   2024

5.3The scenario as a table of steps

How the shock in scenario SCN-SR10-DPI-01 would travel through Digital Public Infrastructure and Systemic Cyber Risk’s coupled systems, step by step, under the assumptions the edition states.

A teaching model of a conditional scenario under the edition’s stated assumptions: not a forecast, not a prediction and not a warning. Sources: Digital Public Infrastructure and Systemic Cyber Risk 2026, scenario SCN-SR10-DPI-01 (2026); Digital Public Infrastructure and Systemic Cyber Risk 2026, references (NR-CIT-1) (2026).

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back

6.1The other desks’ editions of this subject

Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.

6.2Three lenses

One edition, read by each steward. The lens of this site comes first.

6.3Standards, Academy and steward contributions

How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for digital public infrastructure. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.

6.4GCRI reading: the model card

GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology

6.5Global Risks Forum reading: editorial essays

Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.

6.6Global Risks Alliance reading: 2027 digital public infrastructure readiness pack

The registers that open the 2027 global cycle. At baseline each is initialised from this edition.

Publication dispositions

• Publish
• Hold
• Needs evidence
• Restricted
• Superseded

6.7Nexus Standards reading: standards and regulatory watch

Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.

• IN FORCE
• ADOPTED
• PUBLISHED · GUIDANCE
• PUBLISHED · VOLUNTARY

6.8Risk Academy reading: literature and evidence review, science and assessments

The review behind this edition covers digital public infrastructure assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.

Review protocol

Question

What does the published evidence establish about the world’s digital public infrastructure and systemic cyber risk and its couplings?

Sources searched

agency advisories; provider post-incident reports; peer-reviewed interdependency literature; access and payment statistics

Window

releases available at evidence close, 30 September 2026

Selection

sources that bind or contextualise a finding in this edition

Next step

systematic reviews for agenda items 01 to 05 in 2027

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
2. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
3. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
4. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
5. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
6. 29UNVERIFIED, not opened: Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
7. 30UNVERIFIED, not opened: Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
8. 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
9. 43UNVERIFIED, not opened: United Nations General Assembly, resolution adopting the United Nations Convention against Cybercrime (December 2024), cited from memory; the resolution number is not stated. United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
10. 16United Nations (ed.), Global Digital Compact (programme page; negotiated by 193 Member States; opened for endorsement in September 2024; commitment to increase investment in digital public goods and digital public infrastructure). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
11. 32UNVERIFIED, not opened: United Nations Development Programme and partners, Universal Digital Public Infrastructure Safeguards Framework, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
12. 24NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0 (programme page; two-year anniversary note of 24 February 2026; intended for industry, government and organisations). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
13. 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
14. 42UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals, cited from memory. Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2022. Accessed 2026-11-03.back
15. 41UNVERIFIED, not opened: OECD, Recommendation of the Council on Digital Security of Critical Activities, 2019, cited from memory. OECD Publishing, Paris. Observation year 2019. Accessed 2026-11-03.back
16. 27UNVERIFIED, not opened: G20, New Delhi Leaders’ Declaration, 9 to 10 September 2023 (welcomed the G20 Framework for Systems of Digital Public Infrastructure and a global repository of digital public infrastructure), taken from press coverage of the declaration. Observation year 2023. Accessed 2026-11-03.back
17. 40UNVERIFIED, not opened: Schmitt, M.N. (ed.), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Cambridge University Press, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03.back
18. 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
19. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
20. 37UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back
21. 36UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03.back
22. 38UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03.back
23. 33UNVERIFIED, not opened: Tikk, E., Kaska, K. and Vihul, L., International Cyber Incidents: Legal Considerations. Cooperative Cyber Defence Centre of Excellence, Tallinn, 2010, cited from memory. Observation year 2007. Accessed 2026-11-03.back
24. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
25. 2ENISA (ed.), ENISA Threat Landscape 2024 (publication page; published 19 September 2024; seven prime threats; no counts on the page). European Union Agency for Cybersecurity, Athens. Observation year 2024. Accessed 2026-11-03.back
26. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
27. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
28. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
29. 23International Monetary Fund (ed.), Global Financial Stability Report, April 2024 (publication page: risk of extreme losses from cyber incidents has increased; the financial sector is highly exposed; chapter figures not read). IMF, Washington. Observation year 2024. Accessed 2026-11-03.back
30. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
31. 11POST-CLOSE, context only: ITU (ed.), Facts and Figures statistics page (2026 edition: 6.3 billion online, 76%; about 2 billion offline; materials dated November 2026), read as a newer estimate and not used in findings. International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
32. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
33. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
34. 21IBM (ed.), Cost of a Data Breach Report 2026 (report page: global average cost of USD 4.99 million, up 12% on the previous year, described as a record). IBM, Armonk. Observation year 2026. Accessed 2026-11-03.back
35. 22Verizon (ed.), Data Breach Investigations Report 2026 (report page: 31% of breaches begin with software vulnerabilities; coverage 1 November 2024 to 31 October 2025). Verizon, New York. Observation year 2025. Accessed 2026-11-03.back
36. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
37. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
38. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
39. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
40. 39UNVERIFIED, not opened: Cyber Safety Review Board, Review of the December 2021 Log4j Event, 2022, cited from memory; no figure used. Department of Homeland Security, Washington. Observation year 2022. Accessed 2026-11-03.back
41. 25BleepingComputer, Costa Rica declares national emergency after Conti ransomware attacks (press report of 9 May 2022: declaration on 8 May 2022 under Decree No. 42542; Ministry of Finance and other bodies affected). Observation year 2022. Accessed 2026-11-03.back

7.1Questions for the operational series

1. D-01

   How would a failure at a shared cloud, identity or payment provider that overlaps a power or network loss spread through health, payments and public services at once?

   INI-SR10-CMP-01 · shared provider and power compound loss; first output: dependency analysis for six regions.

2. D-02

   Which shared layers (software, cloud regions, DNS, identity) sit behind the most public services?

   INI-SR10-DEP-02 · shared layers; first output: dependency register.

3. D-03

   How long do identity and payment services take to return after major outages, and what limits recovery?

   INI-SR10-RST-03 · restoration times; first output: restoration table.

4. D-04

   Which countries run national identity, payment and data-exchange systems, and on what design?

   INI-SR10-INV-04 · national system inventory; first output: inventory note.

5. D-05

   How do long-lived access reports translate into disruption risk for operators?

   INI-SR10-ACC-05 · access and disruption; first output: scoping note.

6. D-06

   Which bodies publish incident data on a comparable basis?

   To be admitted in 2027; first output: coverage note.

7. D-07

   How do offline populations interact with services that move to digital-only?

   To be admitted in 2027; first output: scoping note.

8. D-08

   Which digital capabilities have been tested in real outages, and which are only planned?

   Digital capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 digital portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

7.3The pathway

The digital public infrastructure edition reads national digital chapters, sector editions and the global edition through one governed evidence graph. At baseline the federation is designed and its first editions are drafted. This page states what exists today and what comes next.

1. 01

   National digital chapters

   identity, payment and data-exchange reading in each national edition

   IN PREPARATION · national baselines

2. 02

   Sector editions

   cyber and digital, finance, health, infrastructure

   PLANNED · sector Baseline Editions

3. 03

   Digital public infrastructure model

   the global digital system of systems

   v0 SPECIFIED · v1 with federation evidence

4. 04

   Strategic links

   SR-02 lifeline systems · SR-03 supply chains · SR-13 strategic technology infrastructure

   PLANNED · strategic baselines

5. 05

   Universe

   annual proving environment

   CANDIDATE MISSION · mandate in 2027

6. 06

   Digital Public Infrastructure Report

   this series

   BASELINE DRAFT · 2027 annual edition

7. 07

   Evidence and correction

   one graph, many projections

   OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the digital public infrastructure candidate mission

1. 01

   Mandate

2. 02

   Core Build · 1 month

3. 03

   Action · 1 week

4. 04

   Evidence seal

5. 05

   Portfolio correction

6. 06

   Next mandate

Mission

ID

MSN-SR10-2027-01 · Shared provider and power loss Universe mission

Role spine

Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways

Receiving actors

to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

7.6Feeds and signal register

Escalation routes

• none · keep monitoring
• research question
• project
• risk object
• annual publication
• signal report

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
3. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
4. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
5. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back

8.1Common causes

One cause can strike many services at once: a faulty update, a configuration change, a hostile campaign or a hazard. The shared cause matters more than the sector.

Related editions

• GLB Global Systems
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-03 Global Supply Chains, Trade and Chokepoints
• SR-13 Strategic Technology Infrastructure and Sovereign Readiness
• GS-05 Finance and Economy
• GS-13 Cyber and Digital Systems

8.2Domino effects

A failure in one layer removes an input from the next. A provider fault reaches the services that rely on it, and then the people who rely on those services.

Related editions

• GLB Global Systems
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-03 Global Supply Chains, Trade and Chokepoints
• SR-13 Strategic Technology Infrastructure and Sovereign Readiness
• GS-05 Finance and Economy
• GS-13 Cyber and Digital Systems

8.3Inter-systemic feedbacks

Digital services depend on what they power and what powers them. Payments need networks, networks need power, and recovery needs the same services that failed.

Related editions

• GLB Global Systems
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-03 Global Supply Chains, Trade and Chokepoints
• SR-13 Strategic Technology Infrastructure and Sovereign Readiness
• GS-05 Finance and Economy
• GS-13 Cyber and Digital Systems

8.4Shared vulnerabilities

Different services share the same weak points: widely deployed software, single cloud regions, shared edge networks and long-lived access to operator networks.

Related editions

• GLB Global Systems
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-03 Global Supply Chains, Trade and Chokepoints
• SR-13 Strategic Technology Infrastructure and Sovereign Readiness
• GS-05 Finance and Economy
• GS-13 Cyber and Digital Systems

8.5Thresholds and tipping

A system can absorb stress until a threshold is crossed. Fallback paths, restoration practice and legal cooperation are such thresholds for digital infrastructure.

Related editions

• GLB Global Systems
• SR-02 Critical Infrastructure and Lifeline Systems
• SR-03 Global Supply Chains, Trade and Chokepoints
• SR-13 Strategic Technology Infrastructure and Sovereign Readiness
• GS-05 Finance and Economy
• GS-13 Cyber and Digital Systems

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
2. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
3. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
4. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
5. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
6. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
7. 25BleepingComputer, Costa Rica declares national emergency after Conti ransomware attacks (press report of 9 May 2022: declaration on 8 May 2022 under Decree No. 42542; Ministry of Finance and other bodies affected). Observation year 2022. Accessed 2026-11-03.back
8. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
9. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
10. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
11. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
12. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
13. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
14. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
15. 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
16. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
17. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
18. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

A.1Methods

The global baseline uses published values and four simple derivations. Each is shown in full so that any reader can reproduce it.

A.2Model card, Digital Public Infrastructure Model v0

Model ID

MDL-SR10-DPI · v0.1

Purpose

represent digital public infrastructure as a dependent stack and the mechanisms by which failures spread between identity, payments, data exchange, cloud, networks and the services that rely on them

Family

graph-based system of systems

Inputs

the cited sources of this edition; no proprietary data

Method

expert-specified coupling strengths (STRONG · MODERATE · WEAK) from assessments and analogue events

Validation

none yet, first validation against federation evidence in 2027

Uncertainty

qualitative; strengths are hypotheses, not measurements

Domain of validity

global scale; not for asset-, site- or country-level use

Reproducibility

strength table and sources published in this edition

A.3The baseline evidence cut

Every Nexus edition is published from a frozen evidence cut. The global baseline cut is documentary: it pins the exact edition of every source cited. Federation cuts begin with the first national Foundry cuts in 2027.

Cut ID

DC-STRATEGIC-DPI-GLOBAL-2026-B0

Type

baseline documentary cut

Resolution policy

pinned · as of 30 September 2026

Sources pinned

43 cited sources, each at the edition and access date in the references

Model runs

none at baseline, analytical values are stated with their method

Digest

computed at freeze and recorded in the publication record

Supersedes

nothing, first cut of the series

Superseded by

the 2027 digital public infrastructure annual cut

Lineage

1. 01

   source edition

2. 02

   pinned citation

3. 03

   finding

4. 04

   page

5. 05

   publication record

A.4Evidence age and coverage

A 2026 global edition rests on evidence observed in many different years. This page shows each time base, so that no single year label hides older evidence.

A.5Evidence cards, two anchor sources

Evidence cards to follow in 2027

• AWS⁴: service-level detail by customer region
• ENISA¹: sector breakdown of incidents
• CISA⁶⁷: follow-up advisories
• NCSC⁸: sector pages of the annual review

A.6Publication acceptance record

Editorial self-check at evidence close. Every applicable item carries a disposition; the remaining items are review, approval and deposit.

A.7Status words

A.8How the edition is made, released and corrected

Every edition is built from a sealed evidence cut, reviewed under three keys, signed and deposited before any site shows it as published; corrections go to Nexus Standards as change proposals and feed the next cut.

A teaching model of the process, not a forecast and not a record of any run; dates and counts on this page come from the programme record. Sources: Reports governance at GCRI Canada (2026); Zenodo, repository of record for Reports deposits (2026).

Lifecycle, one state at a time: Draft, Computed, Evidence bound, Reviewed, Approved for release, Published, Corrected, Superseded. This edition is a draft.

A.9Glossary and abbreviations

A.10Technical annex

A.1 · indicator definition: nationally significant incident

Construct

a cyber incident that the national agency classes in the top three categories of its classification model

Unit

incidents per year

Method

incident management data of one national agency

Source

NCSC Annual Review⁸

Uncertainty

classification and reporting practice change over time

Known limits

one country; not comparable with counts from other agencies

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
2. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
3. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
4. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
5. 28UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, Change Healthcare cybersecurity incident (about 100 million notices sent by October 2024), taken from search-result summaries of HHS statements; a later figure of 192.7 million appears in one press report and is not used. Observation year 2024. Accessed 2026-11-03.back
6. 27UNVERIFIED, not opened: G20, New Delhi Leaders’ Declaration, 9 to 10 September 2023 (welcomed the G20 Framework for Systems of Digital Public Infrastructure and a global repository of digital public infrastructure), taken from press coverage of the declaration. Observation year 2023. Accessed 2026-11-03.back
7. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
8. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
9. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
10. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back

B.1The indicator set

B.2Global source register

The governed source set behind this edition. Each source keeps its authority, coverage, cadence and role; categories describe origin, not truth.

Domains bound by the register

• DAT
• INF
• CYB
• FIN
• DEV
• ENE
• HLT
• AIC
• MIN
• TRD

B.3Regional reading, ten regional clusters

Map plates follow with the regional Baseline Editions, when boundary sources and public-safe resolutions are bound. This page gives the regional reading in table form and ranks no region.

B.4Regional card: United Kingdom incident load

• country
• national agency
• incident handling
• annual review

Systems in view

essential services, critical infrastructure, government functions

Defining reading

204 nationally significant incidents in the year to August 2025⁸

Couplings

CYB → INF · INF → DAT

Capability evidence

annual public review of incident handling⁸

Gaps

sector split; comparison with other national bodies

Agenda items

D-02 · D-05

B.5How countries appear in the global edition

Countries enter the digital public infrastructure edition through the digital chapters of their own national editions, on one card grammar. They are read against peer distributions and thresholds, never placed in a league table.

Editions in the 2026 Baseline programme

How to read a country card

• Each system is shown against the distribution of its peers, with thresholds where they exist
• Couplings and risk objects come from the country’s own national edition
• Capability rungs record evidence, not a judgement of institutions
• Evidence age is printed, so older national data are visible as such

B.6Licences

B.7Formats and provenance

Provenance

Edition pack

The edition’s content pack (JSON), from which the print and web editions are built

Evidence cut

DC-STRATEGIC-DPI-GLOBAL-2026-B0, closed 30 September 2026

Reproducibility

sourced values cited; analytical values reproducible from stated parameters

Self-check

14 of 23 at evidence close; a fail on any item blocks release

Review

five passes scheduled before release (in Annex C)

Publisher of record

GCRI for the Nexus Consortium

Corrections

Registry correction pathway; upheld corrections are published as notices with a new version

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
3. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
4. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
5. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
6. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
7. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
8. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
9. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
10. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
11. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
12. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
13. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
14. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
15. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back

C.143 sources

NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).

1. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
2. 2ENISA (ed.), ENISA Threat Landscape 2024 (publication page; published 19 September 2024; seven prime threats; no counts on the page). European Union Agency for Cybersecurity, Athens. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
3. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
4. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
5. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
6. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
7. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
8. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
9. 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03. Cited in chapter 1, chapter 2, chapter 4, chapter 6, chapter 8
10. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
11. 11POST-CLOSE, context only: ITU (ed.), Facts and Figures statistics page (2026 edition: 6.3 billion online, 76%; about 2 billion offline; materials dated November 2026), read as a newer estimate and not used in findings. International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03. Cited in chapter 6
12. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 3, chapter 6, chapter 8
13. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
14. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
15. 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 4, chapter 6, chapter 8
16. 16United Nations (ed.), Global Digital Compact (programme page; negotiated by 193 Member States; opened for endorsement in September 2024; commitment to increase investment in digital public goods and digital public infrastructure). United Nations, New York. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
17. 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
18. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
19. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
20. 20CISA (ed.), Critical Infrastructure Sectors (page: sixteen sectors, including Communications, Energy, Information Technology and Water and Wastewater). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03. Cited in chapter 3
21. 21IBM (ed.), Cost of a Data Breach Report 2026 (report page: global average cost of USD 4.99 million, up 12% on the previous year, described as a record). IBM, Armonk. Observation year 2026. Accessed 2026-11-03. Cited in chapter 6
22. 22Verizon (ed.), Data Breach Investigations Report 2026 (report page: 31% of breaches begin with software vulnerabilities; coverage 1 November 2024 to 31 October 2025). Verizon, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
23. 23International Monetary Fund (ed.), Global Financial Stability Report, April 2024 (publication page: risk of extreme losses from cyber incidents has increased; the financial sector is highly exposed; chapter figures not read). IMF, Washington. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
24. 24NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0 (programme page; two-year anniversary note of 24 February 2026; intended for industry, government and organisations). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
25. 25BleepingComputer, Costa Rica declares national emergency after Conti ransomware attacks (press report of 9 May 2022: declaration on 8 May 2022 under Decree No. 42542; Ministry of Finance and other bodies affected). Observation year 2022. Accessed 2026-11-03. Cited in chapter 6, chapter 8
26. 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
27. 27UNVERIFIED, not opened: G20, New Delhi Leaders’ Declaration, 9 to 10 September 2023 (welcomed the G20 Framework for Systems of Digital Public Infrastructure and a global repository of digital public infrastructure), taken from press coverage of the declaration. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
28. 28UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, Change Healthcare cybersecurity incident (about 100 million notices sent by October 2024), taken from search-result summaries of HHS statements; a later figure of 192.7 million appears in one press report and is not used. Observation year 2024. Accessed 2026-11-03. Cited in chapter 3
29. 29UNVERIFIED, not opened: Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
30. 30UNVERIFIED, not opened: Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
31. 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03. Cited in chapter 4, chapter 6
32. 32UNVERIFIED, not opened: United Nations Development Programme and partners, Universal Digital Public Infrastructure Safeguards Framework, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03. Cited in chapter 4, chapter 6
33. 33UNVERIFIED, not opened: Tikk, E., Kaska, K. and Vihul, L., International Cyber Incidents: Legal Considerations. Cooperative Cyber Defence Centre of Excellence, Tallinn, 2010, cited from memory. Observation year 2007. Accessed 2026-11-03. Cited in chapter 6
34. 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
35. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
36. 36UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03. Cited in chapter 6
37. 37UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03. Cited in chapter 4, chapter 6
38. 38UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
39. 39UNVERIFIED, not opened: Cyber Safety Review Board, Review of the December 2021 Log4j Event, 2022, cited from memory; no figure used. Department of Homeland Security, Washington. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
40. 40UNVERIFIED, not opened: Schmitt, M.N. (ed.), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Cambridge University Press, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03. Cited in chapter 6
41. 41UNVERIFIED, not opened: OECD, Recommendation of the Council on Digital Security of Critical Activities, 2019, cited from memory. OECD Publishing, Paris. Observation year 2019. Accessed 2026-11-03. Cited in chapter 6
42. 42UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals, cited from memory. Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2022. Accessed 2026-11-03. Cited in chapter 4, chapter 6
43. 43UNVERIFIED, not opened: United Nations General Assembly, resolution adopting the United Nations Convention against Cybercrime (December 2024), cited from memory; the resolution number is not stated. United Nations, New York. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6

C.2Publication record

Colophon

Format

A4 portrait · screen, print and archival PDF

Typefaces

Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)

Design standard

Reports Foundational Edition, Volume I, Part VII

Accessibility

tagged PDF and HTML targets; text alternatives for every figure

Production

Reports editorial team, GCRI

Release path for this version