Draft, not yet released. In stewardship review. Not indexed until the first approved release.

The 2027 agenda

Eight bounded questions open the 2027 cyber and digital systems agenda. Each comes from a baseline finding, names the initiative that will carry it and the first output due in the 2027 cyber and digital systems edition.

5 min read0 figures6 tables4 notesNR-SECTOR-CYBER-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1The digital layer is where the systems meet
  4. 2Key findings
  5. 3Systems and sectors at baseline
  6. 4Risks and capability
  7. 5Provider failure under a ransomware wave
  8. 6Readings from the other desks
  9. 7The 2027 agenda
    1. 7.1 Questions for the operational series
    2. 7.2 Portfolio proposed for the Q1 2027 alignment
    3. 7.3 The pathway
    4. 7.4 Universe 2027: evidence pack for the cyber and digital systems candidate mission
    5. 7.5 Handoffs and routing
    6. 7.6 Feeds and signal register
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

7.1Questions for the operational series

  1. C-01

    How would a failure at a concentrated digital provider that coincides with a ransomware wave travel through health, power and public services at once?

    INI-GS13-CPF-01 · provider failure under ransomware; first output: concurrency analysis for six regions.

  2. C-02

    Which operational technology and control systems in utilities have incident data on a common basis?

    INI-GS13-OTI-02 · utility incident data; first output: reporting-channel register.

  3. C-03

    How do ransomware attacks on health services change care outcomes beyond the 2016 to 2021 study period?

    INI-GS13-HRW-03 · health ransomware and care; first output: data scoping note.

  4. C-04

    Which submarine routes and landing points are single points of failure, and where is repair capacity short?

    INI-GS13-CBL-04 · cable routes and repair; first output: route dependence map.

  5. C-05

    Where do connectivity gaps coincide with weak cyber capacity, and what would closing them take?

    INI-GS13-GAP-05 · connectivity and capacity; first output: tier-and-access table.

  6. C-06

    How are EU reporting duties for incidents and exploited vulnerabilities being used in practice?

    To be admitted in 2027; first output: duty-to-data overlay.

  7. C-07

    What is the measured, not surveyed, effect of AI on intrusion speed and volume?

    To be admitted in 2027; first output: scoping note.

  8. C-08

    Which cyber capabilities have been tested in real incidents, and which are only planned?

    Cyber capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 cyber and digital portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

Table 7.1Objects proposed for the first operational quarter
IDObjectKindQuestionState
INI-GS13-CPF-01Provider failure under ransomwareInitiativeC-01PROPOSED
INI-GS13-OTI-02Utility incident dataInitiativeC-02PROPOSED
INI-GS13-HRW-03Health ransomware and careInitiativeC-03PROPOSED
INI-GS13-CBL-04Cable routes and repairInitiativeC-04PROPOSED
INI-GS13-GAP-05Connectivity and capacityInitiativeC-05PROPOSED
MSN-GS13-2027-01Provider failure under ransomware Universe missionMissionC-01Candidate

7.3The pathway

The cyber and digital edition reads national cyber and digital chapters, regional connectivity and incident evidence and the global edition through one governed evidence graph. At baseline the federation is designed; the Canada and global chapters are drafted. This page states what exists today and what comes next.

  1. 01

    National cyber and digital chapters

    digital and cyber content of each national edition

    DRAFTED · further national baselines

  2. 02

    Route and incident evidence

    shared cables, exchange points and reporting channels

    PLANNED · regional Baseline Editions

  3. 03

    Cyber and digital sector model

    the digital layer under the system of systems

    v0 SPECIFIED · v1 with federation evidence

  4. 04

    Global and strategic links

    GLB · SR-02 Critical Infrastructure and Lifeline Systems · SR-10 Digital Public Infrastructure and Systemic Cyber Risk

    PLANNED · strategic baselines

  5. 05

    Universe

    annual proving environment

    CANDIDATE MISSION · mandate in 2027

  6. 06

    Global Cyber and Digital Systems Report

    this series

    BASELINE DRAFT · 2027 annual edition

  7. 07

    Evidence and correction

    one graph, many projections

    OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the cyber and digital systems candidate mission

  1. 01

    Mandate

  2. 02

    Core Build · 1 month

  3. 03

    Action · 1 week

  4. 04

    Evidence seal

  5. 05

    Portfolio correction

  6. 06

    Next mandate

Table 7.2Universe 2027: evidence pack for the cyber and digital systems candidate mission
ItemRecordStateTiming
F1Annual mandate recordPLANNEDafter the Q2 2027 alignment
F2Core Build recordPLANNEDone month before the exercise
F3Exercise evidencePLANNEDduring the Action week
F4Decision packetsPLANNEDexercise state only
F5Proof receiptsPLANNEDscoped to each recorded check
F6After-action reportPLANNEDwithin one quarter
F7Upgrade docketPLANNEDrouted to the Portfolio
F8Portfolio renewalPLANNED2027 global annual edition
F9Public synthesisPLANNEDpublic-safe extracts only

Mission

ID
MSN-GS13-2027-01 · Provider failure under ransomware Universe mission
Role spine
Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways
Receiving actors
to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

Table 7.3Handoffs and routing
FindingRouted toPurposeClass
INF-001 · connectivitypublic recordreference for the 2027 seriesPUBLIC
DAT-002 · crime reportsINI-GS13-GAP-05connectivity and capacityPUBLIC
INF-005 · exploited flawsINI-GS13-OTI-02utility incident dataPUBLIC
HLT-009 · health ransomwareINI-GS13-HRW-03health ransomware and carePUBLIC
GOV-006 · capacity indexpublic recordcountry tier overlayPUBLIC
INF-008 · cable faultsINI-GS13-CBL-04cable routes and repairPUBLIC
INF-011 · update failureINI-GS13-CPF-01 · key F reviewprovider failure under ransomwarePUBLIC
SYS-012 · compound pathwayMSN-GS13-2027-01Universe candidateCONSORTIUM
Table 7.4Routing rules by publication class
ClassWhere it goesWho can see it
PUBLICthe published edition and its evidence bundleanyone
CONSORTIUMgoverned rooms of the federationconsortium members under agreement
CONTROLLEDneed-to-know channelsnamed competent actors only

7.6Feeds and signal register

Table 7.5Feeds watched from 2027
FeedProducerLatencyFeeds into
Catalogue of known exploited vulnerabilitiesCISAcontinuousINF-005
National Vulnerability DatabaseNISTcontinuousINF-005
Measuring digital development dataITUannualINF-001
Internet Crime Complaint Center reportsFBIannualDAT-002
Threat LandscapeENISAannualDAT-004
Treaty status pageUNODCcontinuousGOV-007
Internet shutdowns dataAccess NowannualINF-001

Escalation routes

  • none · keep monitoring
  • research question
  • project
  • risk object
  • annual publication
  • signal report
Table 7.6Signals at baseline
IDSignalCorroborationSystemsRoute
SIG-GS13-001Entries added to the exploited vulnerabilities catalogue in 2026 exceed those added in 20257CORROBORATEDINF · DATresearch question C-02
SIG-GS13-002Claimed ransomware attacks rose while on-chain payments fell29PARTIALFIN · DATinitiative C-03
SIG-GS13-003Submarine cable faults persist at about 200 a year1213CORROBORATEDINF · TRDinitiative C-04

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 7CISA (ed.), Known Exploited Vulnerabilities Catalog, machine-readable file, catalogue version 2026.11.03 (1,767 entries; read on 2026-11-03; entries counted by the editors from the date added and the ransomware-use flag). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  2. 29Chainalysis (ed.), Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate (analysis dated 26 February 2026; on-chain data). Chainalysis, New York. Observation year 2025. Accessed 2026-11-03.back
  3. 12Lamanauskas, T. and Veverka, D., The world is coming together to strengthen submarine cable resilience (ITU news article, 2 February 2026). International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
  4. 13Internet Society (ed.), Enhancing the Resilience of Submarine Internet Infrastructure (public policy brief, November 2025). Internet Society, Reston. Observation year 2025. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 7: The 2027 agenda. In Nexus Global Cyber and digital systems Risk and Resilience Report 2026: Baseline Edition, The State of the World’s Cyber and Digital Systems. (Baseline Edition 2026, Report No. NR-SECTOR-CYBER-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Global Cyber and Digital Systems.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskGlobal Sector Risk and Resilience

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices