Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Reports
Baseline Edition 2026
Complete edition

Strategic Systems Report 2026: Critical Infrastructure and Lifeline Systems

Choose A4 or Letter in the print dialog; running heads and page numbers are added in print. This is a review copy: the signed PDF with its DOI is issued at release.

ReportsSR-02

Strategic Systems

Critical Infrastructure and Lifeline Systems 2026

Baseline Edition 2026NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINEGCRI for the Nexus Consortium

Imprint

Editor: Saeed Valadbaygi, Chief Steward and Managing Editor, the Global Centre for Risk and Innovation (GCRI)
Publisher of record: The Global Centre for Risk and Innovation (GCRI) for the Nexus Consortium, Toronto
Report number: NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE
Evidence close: 30 September 2026, cut DC-STRATEGIC-LIFELINES-GLOBAL-2026-B0
Status: Draft under stewardship review; not yet released
DOI and UNI: Issued at deposit
Licence: CC BY 4.0 for Nexus-authored text, tables and figures; third-party material keeps its own licence
Cite as: Valadbaygi, S. (Ed.). (2026). Strategic Systems Report 2026: Critical Infrastructure and Lifeline Systems (Baseline Edition 2026, Report No. NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI). https://therisk.global/nexus-reports/editions/sr-02/

Contents

·
Executive summary
1
Chapter 1. Lifelines fail together
2
Chapter 2. Key findings
3
Chapter 3. Systems and sectors at baseline
4
Chapter 4. Risks and capability
5
Chapter 5. Power loss that overlaps a telecom or cloud failure
6
Chapter 6. Readings from the other desks
7
Chapter 7. The 2027 agenda
8
Chapter 8. Systems in depth
A
Annex A. Methodology
B
Annex B. Data appendix
C
Annex C. References and record

Critical Infrastructure and Lifeline Systems 2026
Executive summary

Executive summary

The edition on a few pages: the abstract, the key messages, the headline finding and what each steward reads in it.

5 min read1 figure0 tables12 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

S.1Abstract

Lifeline systems are the networks other systems run on: power, water, communications, transport and health services. The 2025 and 2026 evidence shows the same mechanisms at work in very different events. The Iberian blackout of 28 April 2025 came from interacting factors, including voltage control gaps, oscillations and generator disconnections¹. A single software update on 18 July 2024 affected an estimated 8.5 million Windows devices⁴. Government agencies assessed in February 2024 that state-sponsored actors had pre-positioned in the networks of communications, energy, transport and water operators, with some intrusions lasting at least five years². ENISA analysed 4,875 incidents in a single twelve-month period³. Asset condition and investment are part of the picture: the 2025 US report card grades the country’s infrastructure C with a USD 3.6 trillion ten-year gap⁶. Around 199 subsea cable faults occur each year, about two thirds from fishing and transport vessels⁷. War adds direct damage: Ukraine’s recovery needs reached USD 587.7 billion and Gulf power and desalination plants were struck from March 2026¹²¹³. This baseline reads these events as mechanisms, not as a list. It ranks no country or operator, attributes no attack and recommends no policy.

S.2Key messages

Six readings that frame the lifeline systems baseline, and the eight questions this edition answers, each with its status and source.

Yes: hazards, cyber operations, conflict and software faults recur across sectors.¹²⁴¹⁰
Do lifeline failures have common causes?Reported
Through shared dependence on power, telecoms and software.¹⁴
How do failures spread?Reported
Grades are mixed: C overall in the 2025 US report card.⁶
Is the physical base sound?Reported
About 199 faults a year; most are accidental.⁷
How exposed are subsea links?Reported
More than USD 250 billion a year to infrastructure from three hazards.¹⁰
How large are the losses?Reported
It adds direct damage to power and water systems.¹²¹³
Does war change the picture?Reported
Concentrated demand on local grids.⁸⁹
What does digital load add?Reported
Power loss that overlaps a telecom or cloud failure. SCN-SR02-PWR-01
What will 2027 test first?Expert input

S.3Headline finding

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-INF-006

Subsea cable faults averaged 199 a year from 2010 to 2023. About two thirds came from fishing and transport vessels, and intent is hard to establish.

Figure S.1Subsea cable faults a year, 2010 to 2023

Item	Bar, scaled to the largest value	Value
Average faults a year		199
of which external aggression (about two thirds)		≈133

Source: TeleGeography⁷. The second bar is a Nexus derivation, method (4), and is approximate.

Most faults are accidents, so route diversity and repair capacity matter more than detecting intent. Governments around the Baltic investigate each fault as potential sabotage, and the analyst notes that severing a few cables is noise rather than a signal⁷.

S.4At a glance

199faults a year

subsea cables⁷

8.5million

devices, July 2024⁴

4,875incidents

ENISA, to June 2025³

3.6USD trillion

US ten-year gap⁶

>250USD billion

annual hazard loss¹⁰

390USD billion

annual disruption cost, LMICs¹¹

S.5What each steward reads in it

GCRI · KEY T

Technical Truth

The evidence supports reading lifelines as one dependent network.

GRF · KEY M

Public Meaning

For most people lifeline failure arrives as a dark home, a dry tap or a card that will not work.

GRA · KEY F

Capital Meaning

Readiness implications only. Disruption is costly, resilient options are reported to return several times their cost, and the investment gap is large in places.

NEXUS

Synthesis

Lifeline risk is well described event by event and thinly measured as a system.

S.6What this edition is, and is not

What this edition is

A baseline: the 2026 state of the world’s critical infrastructure and lifeline systems and the couplings through which it carries risk into other systems. It synthesises published evidence and ranks no country, company or asset.

What it is not

Not an infrastructure-security ranking, a threat attribution, a vulnerability disclosure or an assessment of any operator, regulator or government. Operation, protection and recovery of infrastructure rest with owners, operators and competent authorities.

What comes next

National, regional and sector evidence feeds the 2027 lifeline systems edition through the federation. Each edition reports what changed against this baseline: observations, source revisions, method changes, scenario updates and corrections.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 1

Lifelines fail together

Part I describes systems and their couplings. It ranks no country or operator and assesses no authority.

6 min read2 figures2 tables11 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

1.1The questions this part answers

Key questions

Where is lifeline systems risk concentrated?
Which couplings carry lifeline systems shocks into other systems?
Which lifeline systems capabilities hold under compound stress?
What must 2027 evidence measure first?

In this part

Narrative
Headline finding
Lead figure
Five mechanism chapters
Twelve-domain reading
Sector screens
Dependency matrix
Risk objects
Capability ladder
Scenario
Three lenses
Portfolio

1.2The argument

Lifeline systems are usually reported by sector: grid operators, water utilities, telecom carriers, hospitals. The 2025 and 2026 evidence reads them as one dependent network. Power runs the water works and the exchanges, the exchanges run the control systems, and software runs all of them¹⁴².

The causes repeat. A grid event in 2025 came from interacting technical factors¹. A software update in 2024 reached millions of machines in hours⁴. State-sponsored actors were reported inside operator networks for years². Fishing and anchoring faults hit subsea links about 199 times a year⁷. War now adds direct strikes on power and desalination plants¹³.

The physical base is uneven. The 2025 US report card gives energy D+ and drinking water C−, with a USD 3.6 trillion ten-year gap⁶. In low- and middle-income countries, disruptions cost at least USD 390 billion a year, and the World Bank finds that resilient options return about USD 4 per USD 1¹¹.

The edition therefore asks the same four questions of every event: what was the common cause, how did it spread, what was shared, and what threshold was crossed. It makes no attribution and ranks no operator.

Figure 1.1How large are the published lifeline loss and need estimates? USD billion

Estimates of need and loss are large and drawn from different sources. The three bars use different periods and methods, so they show scale only and are not added¹⁰¹¹¹².

Item	Bar, scaled to the largest value	Value
Ukraine recovery needs, ten years		587.7
Disruption cost in LMICs, per year (at least)		390
Hazard loss to infrastructure, per year (more than)		250

Source: as cited in the note to this figure. Year 2025.

Figure ID FIG-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-01-003

>250USD billion

annual loss to infrastructure, three hazards¹⁰

≥390USD billion

annual disruption cost in LMICs¹¹

587.7USD billion

Ukraine needs over ten years¹²

≈4USD per USD 1

reported return on resilient options¹¹

1.3Twenty couplings between five systems

The lifeline systems-centred matrix types the twenty couplings between the five core systems, read for their lifeline systems content. Strengths are Nexus estimates (ESTIMATED) from the cited evidence and analogue events; they set the graph that 2027 evidence will test.

Figure 1.2Couplings between the five systems

Each line is one coupling from one system to another, drawn by the strength the edition assigns. Strengths are Nexus estimates from the cited evidence and analogue events.

Strong
Moderate
Weak

Source: this edition’s coupling matrix (Table 1.1); status Estimated.

Table 1.1Coupling matrix: from the row system to the column system
From, to	WAT	ENE	FOO	HLT	BIO
WAT Water	·	STRONG cooling · hydro	MODERATE irrigation · processing	STRONG safe supply · hospitals	WEAK flows
ENE Energy	STRONG pumping · treatment · desalination	·	STRONG cold chain · processing	STRONG hospitals · cooling · telecoms	WEAK land use
FOO Food	WEAK withdrawals	WEAK bioenergy	·	MODERATE nutrition · food safety	WEAK land conversion
HLT Health	WEAK workforce	WEAK workforce	WEAK labour	·	WEAK residues
BIO Biodiversity	MODERATE natural infrastructure	WEAK hydrology	WEAK pollination	WEAK zoonoses	·
Strength: strong, moderate or weak; a Nexus estimate (status Estimated) from cited evidence and analogue events. The scale is defined in Annex A.

Transmission paths

01
ENE → INF → HLT
A grid failure removes power from exchanges, pumps and hospitals together.
Reported 2025 blackout¹
02
DAT → INF
A software fault spreads through a shared vendor to many operators.
Reported 2024 outage⁴
03
CON → ENE, WAT
Strikes on co-located power and desalination plants remove two services at once.
Reported 2026 Gulf strikes¹³
04
CLI → INF → FIN
Hazards damage assets and the cost lands on budgets.
Reported GAR 2025¹⁰
05
AIC → ENE
Clustered digital load tightens local grids.
Reported US 2025⁹⁸

1.4Reinforcing loops

A shock entering either system of a loop can return amplified through the other.

Table 1.2Pairs of systems where both directions are rated strong
Loop	First direction	Second direction
WAT and ENE	Water to energy: cooling · hydro	Energy to water: pumping · treatment · desalination
A causal-loop reading of the matrix (Sterman, Business Dynamics, 2000): structural, from estimated strengths, not a measured feedback.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 2

Key findings

Twelve findings carry the lifeline systems baseline. They are grouped by coupling and never ranked. Each resolves to its source or, where Nexus analysis is involved, to its stated method.

4 min read1 figure0 tables12 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

2.1Headline finding

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-INF-006

Subsea cable faults averaged 199 a year from 2010 to 2023. About two thirds came from fishing and transport vessels, and intent is hard to establish.

Figure 2.1Subsea cable faults a year, 2010 to 2023

Item	Bar, scaled to the largest value	Value
Average faults a year		199
of which external aggression (about two thirds)		≈133

Source: TeleGeography⁷. The second bar is a Nexus derivation, method (4), and is approximate.

Implication

What would move it

Repair-vessel investment, route diversity and the outcome of Baltic investigations would each move this finding.

2.2Infrastructure

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-INF-001
The Iberian blackout of 28 April 2025 came from interacting factors, including voltage control gaps, oscillations and generator disconnections, according to the ENTSO-E final report of 20 March 2026.¹
ReportedEQL 3NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-INF-005
The 2025 US report card grades national infrastructure C, with a USD 3.6 trillion ten-year investment gap and energy at D+.⁶
ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-INF-006
Subsea cable faults averaged 199 a year from 2010 to 2023; about two thirds came from fishing and transport vessels, and intent is hard to establish.⁷

2.3CYB

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-CYB-002
Agencies assessed in February 2024 that state-sponsored actors were pre-positioning on networks in communications, energy, transportation and water sectors, with some intrusions lasting at least five years.²
ReportedEQL 3NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-CYB-003
ENISA analysed 4,875 incidents between 1 July 2024 and 30 June 2025 for the EU threat landscape.³

2.4Data and digital

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-DAT-004
A single software update affected an estimated 8.5 million Windows devices on 18 July 2024.⁴

2.5Climate forcing

ReportedEQL 3NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-CLI-007
UNDRR puts the annual average loss to critical infrastructure from floods, tropical cyclones and earthquakes at more than USD 250 billion.¹⁰

2.6Development

ReportedEQL 3NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-DEV-008
Disruptions to power, transport, telecommunications and water cost households and firms in low- and middle-income countries at least USD 390 billion a year, and resilient options return about USD 4 per USD 1.¹¹

2.7CON

ReportedEQL 3NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-CON-009
Ukraine’s ten-year recovery and reconstruction needs are USD 587.7 billion, with energy at about USD 91 billion, and direct damage to energy and extractives reached USD 24.8 billion by the end of 2025.¹²
ReportedEQL 2NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-CON-010
Power and desalination plants in Kuwait, Bahrain and the United Arab Emirates were reported struck from March 2026, in a region where desalination supplies most drinking water.¹³

2.8AIC

ReportedEQL 4NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-AIC-011
Data centres made up half of US electricity demand growth in 2025, and nearly half of US data-centre capacity sits in five regional clusters.⁹⁸

2.9Systemic

Expert inputEQL 2NRF-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-SYS-012
The leading compound pathway for 2027 testing is a power loss that overlaps a telecom or cloud failure and limited repair capacity. § scenario

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 3

Systems and sectors at baseline

6 min read0 figures2 tables15 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

3.1Where each system stood at evidence close

ENE · Power

Iberian blackout, interacting causes

2025

final report published 20 March 2026.

Reported2025ENTSO-E¹

DAT · Digital

Windows devices hit by one update

8.5million

estimate, 18 July 2024.

Reported2024Microsoft⁴

INF · Subsea

Cable faults a year, average

199a year

about two thirds from external aggression.

Reported2010 to 2023TeleGeography⁷

FIN · Investment

US ten-year infrastructure gap

3.6USD trillion

overall grade C.

Reported2025ASCE⁶

CLI · Hazard

Annual loss to critical infrastructure, three hazards

>250USD billion

floods, cyclones and earthquakes.

Reported2025UNDRR¹⁰

SYS · Cross-system

Ukraine recovery needs, ten years

587.7USD billion

energy about USD 91 billion.

Reported2025RDNA5¹²

3.2Domain posture

Each of the twelve coupled domains is read through lifeline systems, in words, not scored. The coupling column names the dependency that carries lifeline systems risk into each domain.

Table 3.1Each domain read in words, not scored
Domain	Posture at baseline	Coupling	Status
WAT	Water works depend on power and telecoms; desalination in the Gulf was struck in 2026.	ENE → WAT	Reported EQL 3
ENE	Grid failure from interacting factors in 2025; data-centre load concentrating on local grids.	ENE → all	Reported EQL 4
FOO	Cold chains and logistics depend on power and telecoms; no consolidated series here.	ENE → FOO	Expert input EQL 2
HLT	Hospitals depend on power, water and communications; not consolidated here.	ENE, WAT → HLT	Inferred EQL 2
BIO	Natural infrastructure can buffer hazards; evidence not consolidated here.	BIO → WAT	Expert input EQL 2
CLI	More than USD 250 billion a year of loss to infrastructure from three hazards.	CLI → INF	Reported EQL 3
INF	The core system: US grade C and a USD 3.6 trillion gap; 199 cable faults a year.	the core system	Reported EQL 4
FIN	Resilient options return about USD 4 per USD 1; Ukraine needs USD 587.7 billion.	INF → FIN	Reported EQL 3
DAT	One software update reached 8.5 million devices; incident data are not on a common basis.	DAT ↔ INF	Reported EQL 4
AIC	Data-centre load clusters in a few regions; half of US electricity growth in 2025.	AIC → ENE	Reported EQL 4
MIN	Power equipment and cables depend on refined minerals; the top refiner’s average share rose to 72% in 2025⁴⁰.	MIN → INF	Reported EQL 3
TRD	Shipping lanes and ports carry cable ships and equipment; chokepoint data sit in sibling editions.	INF ↔ TRD	Inferred EQL 2

3.3Sector screens

All sixteen sectors are screened for their dependence on lifeline systems, on the same grammar as every national edition. The evidence column describes coverage of the baseline evidence, not the performance of the sector.

Table 3.2Sectors: baseline evidence and the exposure to watch
Code	Sector	Baseline evidence	Exposure to watch	Evidence coverage
GS-00	Cross-system	lifelines couple every sector¹⁴	power loss with telecom failure	PARTIAL
GS-01	Water	water works depend on power¹³	outage and strikes	THIN
GS-02	Energy	blackout of 28 April 2025¹	voltage and frequency events	GOOD
GS-03	Food and agrifood	cold chains depend on power	outage during heat	THIN
GS-04	Health	hospitals depend on lifelines	loss of power and water	THIN
GS-05	Finance and economy	USD 390 billion a year of disruption cost¹¹	payment and market outages	PARTIAL
GS-06	Development	losses concentrate in lower-income countries¹¹	weak maintenance	PARTIAL
GS-07	Climate	hazard losses above USD 250 billion a year¹⁰	floods, cyclones, heat	GOOD
GS-08	Disaster	cascading outages after hazards¹⁰	concurrent hazards	PARTIAL
GS-09	Infrastructure	US grade C and USD 3.6 trillion gap⁶	ageing assets	GOOD
GS-10	Cities	dense dependence on power and telecoms	multi-sector outage	THIN
GS-11	Biodiversity	natural buffers for infrastructure	loss of buffers	THIN
GS-12	Earth observation	positioning and timing signals underpin networks	signal interference	THIN
GS-13	Cyber and digital	pre-positioning in four sectors²; 4,875 incidents³	disruptive attacks	GOOD
GS-14	Policy	critical-entity and network security rules¹⁶¹⁷	implementation gaps	PARTIAL
GS-15	Science	interdependency science is mature²⁸²⁹	data at operating scale	PARTIAL

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
40IEA (ed.), Global Critical Minerals Outlook 2026 (revised version, July 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
17UNVERIFIED, not opened: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), Official Journal of the European Union, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
28UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 4

Risks and capability

Four global risk objects open the portfolio. Order carries no rank. Each is read across driver, exposure, vulnerability, capacity, cascade and consequence; loss metrics are added only where they can be modelled.

5 min read0 figures1 table19 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

4.1Risk objects

Each risk is read across the chain from hazard to consequence, with its status and evidence-quality level.

ReportedEQL 4RSK-SR02-INF-001
Grid failure with telecom and water knock-on
Driver
interacting technical factors in a synchronous grid¹
Exposure
cities, hospitals, water works, exchanges
Vulnerability
uneven stabilisation capability; shared dependence on power
Capacity
black-start plans; priority supply; operator coordination
Cascade
ENE → INF → WAT, HLT
Horizon
1 to 3 years
InferredEQL 3RSK-SR02-CYB-002
Pre-positioned access in operator networks
Driver
state-sponsored access reported in four sectors²
Exposure
communications, energy, transport and water operators
Vulnerability
internet-facing devices; long dwell time
Capacity
logging; phishing-resistant authentication; segmentation⁵
Cascade
DAT → INF → HLT
Horizon
1 to 5 years
ReportedEQL 4RSK-SR02-DAT-003
Common-vendor software failure
Driver
one faulty update on a widely deployed platform⁴
Exposure
airlines, hospitals, banks, broadcasters
Vulnerability
concentrated vendors; automatic update paths
Capacity
staged roll-out; manual fallback; recovery playbooks
Cascade
DAT → INF → FIN, HLT
Horizon
annual
InferredEQL 3RSK-SR02-INF-004
Subsea link loss with limited repair capacity
Driver
about 199 faults a year, mostly accidental⁷
Exposure
island states, landing-point regions, cloud routes
Vulnerability
few repair vessels; ageing fleet¹⁵
Capacity
route diversity; repair agreements; cable protection⁷
Cascade
INF → DAT → FIN
Horizon
1 to 5 years

4.2Capability ladder

Existence is not readiness. Each of the fifteen capability functions is placed on the ladder by the strongest public evidence at the global level, from a policy listing to performance in real events.

Table 4.1Capabilities on the ladder of evidence: listed, exists, demonstrated, tested
Function	Level	Strongest public evidence at baseline
Prevention and mitigation	EXISTS	security and continuity standards widespread; implementation uneven⁵²⁰²²
Monitoring and observation	ADEQUATE	threat reporting by agencies; operator data uneven²³
Early warning	EXISTS	advisories from agencies; no common cross-sector warning
Preparedness and planning	EXISTS	critical-entity rules in force or being applied¹⁶¹⁸
Redundancy and reserves	LISTED	black-start and spare-capacity data not consolidated
Response	DEMONSTRATED	operators restored services after the 2024 and 2025 events¹⁴
Continuity of critical services	EXISTS	priority supply to hospitals and water works in many systems; testing uneven
Recovery	DEMONSTRATED	Iberian grid restored; causes published¹
Adaptation	EXISTS	resilience standards and financing advice published¹¹²³
Social protection	LISTED	support during long outages not consolidated
Finance and insurance	EXISTS	resilience financing guidance; protection gaps in sibling editions¹⁰¹¹
Institutional coordination	EXISTS	EU and national frameworks; cross-border practice uneven¹⁶¹⁷¹⁸
Technical infrastructure	EXISTS	ageing assets in places⁶
Workforce	LISTED	skills for operations and cable repair reported thin¹⁵
Research capacity	ADEQUATE	interdependency science mature²⁸²⁹³³
A capability listed in policy is not a tested one; each rung is the strongest public evidence at baseline.

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
20UNVERIFIED, not opened: ISO 22301:2019, Security and resilience: business continuity management systems. International Organization for Standardization, Geneva. Observation year 2019. Accessed 2026-11-03.back
22UNVERIFIED, not opened: IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
18UNVERIFIED, not opened: The White House, National Security Memorandum on Critical Infrastructure Security and Resilience (NSM-22), 30 April 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
23UNVERIFIED, not opened: OECD (ed.), Good Governance for Critical Infrastructure Resilience. OECD Publishing, Paris, 2019. Observation year 2019. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
17UNVERIFIED, not opened: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), Official Journal of the European Union, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
28UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
33UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 5

Power loss that overlaps a telecom or cloud failure

A conditional statement under stated assumptions, never a prediction.

2 min read0 figures0 tables2 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

5.1Assumptions

Scenario SCN-SR02-PWR-01: what is assumed, and what is held constant.

Baseline: the 2026 reference state in this edition
Drivers: a regional power loss during a heat wave, coinciding with a software or cloud outage at a shared vendor
Analogues: Iberian blackout, 2025; global software outage, 2024¹⁴
Interventions: none modelled: the specification describes the unmitigated case
Run state: narrative specification; quantified run scheduled for 2027

5.2The cascade, step by step

1
ENE → INF
voltage and frequency events trip generation; the grid separates
2025
2
INF → DAT
exchanges and data centres run on batteries and generators
2025
3
DAT → INF
a vendor outage removes remote management and payment services
2024
4
INF → WAT
pumping and treatment stop or run on reserves
2026
5
INF → HLT
hospitals move to emergency power; dispatch and records degrade
2024 · 2025
6
INF → FIN
payments and markets pause; losses accumulate
2024

5.3The scenario as a table of steps

How the shock in scenario SCN-SR02-PWR-01 would travel through Critical Infrastructure and Lifeline Systems‘s coupled systems, step by step, under the assumptions the edition states.

Step	What happens	Source
01 Energy to infrastructure	Voltage and frequency events trip generation; the grid separates. Analogue or source: 2025.	Edition SR-02, scenario SCN-SR02-PWR-01, step 1
02 Infrastructure to dat	Exchanges and data centres run on batteries and generators. Analogue or source: 2025.	Edition SR-02, scenario SCN-SR02-PWR-01, step 2
03 DAT to infrastructure	A vendor outage removes remote management and payment services. Analogue or source: 2024.	Edition SR-02, scenario SCN-SR02-PWR-01, step 3
04 Infrastructure to water	Pumping and treatment stop or run on reserves. Analogue or source: 2026.	Edition SR-02, scenario SCN-SR02-PWR-01, step 4
05 Infrastructure to health	Hospitals move to emergency power; dispatch and records degrade. Analogue or source: 2024 · 2025.	Edition SR-02, scenario SCN-SR02-PWR-01, step 5
06 Infrastructure to finance	Payments and markets pause; losses accumulate. Analogue or source: 2024.	Edition SR-02, scenario SCN-SR02-PWR-01, step 6

A teaching model of a conditional scenario under the edition’s stated assumptions: not a forecast, not a prediction and not a warning. Sources: Critical Infrastructure and Lifeline Systems 2026, scenario SCN-SR02-PWR-01 (2026); Critical Infrastructure and Lifeline Systems 2026, references (NR-CIT-1) (2026).

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 6

Readings from the other desks

The global baseline is read through each steward’s lens, then once as a whole. Each lens is a projection of reviewed findings, not a separate argument. The other desks’ own editions of this subject are listed first, as cross-references, not copies.

15 min read0 figures8 tables39 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

6.1The other desks’ editions of this subject

Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.

Desk	Edition	State
GCRI Systems Evidence	No edition of this subject at this desk in the 2026 Baseline cycle	Not in this cycle
GRF Public Deliberation	Outside this desk’s remit	Not in remit
GRA Capital Readiness	No edition of this subject at this desk in the 2026 Baseline cycle	Not in this cycle
Standards Progress	Outside this desk’s remit	Not in remit
Academy Capability	Outside this desk’s remit	Not in remit
Index Measurement	Outside this desk’s remit	Not in remit

6.2Three lenses

One edition, read by each steward. The lens of this site comes first.

GCRI · KEY T

Technical Truth

The evidence supports reading lifelines as one dependent network. Common causes recur across sectors, failures spread through shared dependence on power, telecoms and software, and recovery is limited by thresholds such as black-start capability and repair capacity. Evidence is strongest for single events and weakest for cross-sector dependency data.

INF-001 · CYB-002 · DAT-004 · SYS-012

GRF · KEY M

Public Meaning

For most people lifeline failure arrives as a dark home, a dry tap or a card that will not work. The baseline asks that public debate treat infrastructure as shared and interdependent, and keep recovery, not only prevention, in view.

INF-001 · DAT-004 · DEV-008

GRA · KEY F

Capital Meaning

Readiness implications only. Disruption is costly, resilient options are reported to return several times their cost, and the investment gap is large in places¹¹⁶. These show where finance-readiness evidence will matter. Nothing here is advice, a rating or an approval.

INF-005 · DEV-008

NEXUS

Synthesis

Lifeline risk is well described event by event and thinly measured as a system. The 2027 programme should bind dependency data, test the power and telecom compound loss, and map recovery thresholds before the next large event.

SYS-012 · L-01 · L-03

6.3Standards, Academy and steward contributions

How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for lifeline systems. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.

Table 6.1The quarterly rhythm every edition follows
Quarter	Edition	Question	Boundary
Q1	State and Agenda	What matters this year, and what is the starting position?	observed baseline stays distinct from planned work
Q2	Evidence and Build	What new evidence and capability exist?	a configured capability is not a validated result
Q3	Stress Test and Readiness	What do scenarios and tests show?	simulated loss or performance is not observed impact
Q4	Annual Synthesis and Renewal	What changed in the year, and what renews?	release follows review, not event publicity deadlines

Table 6.2Who contributes what each quarter
Steward or body	Role	Contribution route
GCRI Canada	Lead Institution and Consortium Secretariat; publisher of record; technical truth (key T)	science and practice communities · GCRI gateway
The Global Risks Forum (GRF)	leadership, dialogue and the Universe programme; public meaning (key M)	policy, Universe and national adoption · GRF gateway
The Global Risks Alliance (GRA)	finance, insurance and development readiness; capital meaning (key F)	finance and insurance · GRA gateway
Nexus Standards	preparatory drafts on vocabulary, hazards, indicators and methods	Standards site · working groups HAZ, IND, MTH, FIN, AI
Risk Academy	learning pathways tied to the agenda questions	Academy gateway · learning by review
Reports strategic desks	lifeline chapter inputs: GCRI evidence and GRA readiness	strategic editorial board

Standards drafts used in this edition

Risk vocabulary NRS-C1 (424 terms) for terms in the glossary
Hazard atlas NHS-1 1.1.0 (905 hazards in 120 families) for risk objects
Seven risk classes: global, catastrophic, existential, emerging, planetary, exponential, frontier-tech

Standards calendar to watch

Founding calls from 20 October 2026; working groups meet from 5 November 2026
Inaugural Global Standards Council session, 12 January 2027
Quarterly reviews in March, June, September and December, aligned with each edition

6.4GCRI reading: the model card

GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology

6.5Global Risks Forum reading: editorial essays

Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.

Power runs the exchanges, the exchanges run the control systems, and software runs both. Treating each sector alone understates how a fault in one becomes a fault in all. This edition reads the network.

EDITORIAL ESSAY · 01

Lifelines are one network

Prevention fails sometimes. Restoration after the Iberian blackout and the 2024 software outage shows that recovery capability is a distinct and measurable asset.

EDITORIAL ESSAY · 02

Recovery is part of resilience

Agency reporting describes long-lived access to operator networks rather than visible outages. The risk is a capability held in reserve, which is hard to count and easy to underestimate.

EDITORIAL ESSAY · 03

Cyber evidence is mostly about access

The investment gap is large, and resilient options are reported to return several times their cost. Yet maintenance, coordination and data matter at least as much as capital.

EDITORIAL ESSAY · 04

Money is not the whole answer

6.6Global Risks Alliance reading: 2027 lifeline systems readiness pack

The registers that open the 2027 global cycle. At baseline each is initialised from this edition.

Table 6.32027 lifeline systems readiness pack
Item	Register	State at baseline	First 2027 entry
E1	Global risk state delta	baseline set by this edition	changes against the baseline
E2	WEFH+B state delta	five global system readings set	indicator updates and freshness
E3	Agenda and Portfolio movement	eight agenda items · 6 proposed objects	admission decisions
E4	Federation delivery register	national chapters in preparation	national chapters
E5	Consortium capability register	national consortia forming	first contributions
E6	Leadership questions and challenges	none yet	first challenge log
E7	Foundry technical state	national environments prepared	first federation cut
E8	Publication candidates	twelve findings carried forward	PUBLISH · HOLD dispositions
E9	Universe readiness	one candidate mission	admission and role spine
E10	Correction register	none	first federation-wide cycle

Publication dispositions

Publish
Hold
Needs evidence
Restricted
Superseded

6.7Nexus Standards reading: standards and regulatory watch

Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.

IN FORCE
ADOPTED
PUBLISHED · GUIDANCE
PUBLISHED · VOLUNTARY

Table 6.4Standards and regulatory watch
Instrument	Body	Scope	Status	Relevance
Critical Entities Resilience Directive¹⁶	European Union	EU	IN FORCE	critical entities
NIS2 Directive¹⁷	European Union	EU	IN FORCE	network security
National Security Memorandum 22¹⁸	United States	US	ISSUED 2024	infrastructure security
Sendai Framework 2015 to 2030¹⁹	UNDRR	global	ADOPTED 2015	infrastructure damage target
NIST Cybersecurity Framework 2.0⁵	NIST	global use	PUBLISHED · VOLUNTARY	cyber risk
ISO/IEC 27001 information security²¹	ISO	global	PUBLISHED · VOLUNTARY	security management
ISO 31000 risk management²⁷	ISO	global	PUBLISHED · VOLUNTARY	risk process
Cross-Sector Cybersecurity Performance Goals²⁶	CISA	US	PUBLISHED · GUIDANCE	baseline practices
ISO 22301 business continuity²⁰	ISO	global	PUBLISHED · VOLUNTARY	continuity
IEC 62443 control-system security²²	IEC	global	PUBLISHED · VOLUNTARY	operational technology
UN Convention on the Law of the Sea, articles 112 to 115²⁴	United Nations	global	IN FORCE	submarine cables

Changed since 2024

The ENTSO-E final report on the Iberian blackout was published on 20 March 2026¹
The NIST Cybersecurity Framework 2.0 added a Govern function in 2024⁵
The EU published an action plan on cable security in 2025³⁸

To watch in 2027

Member State identification of critical entities under the EU directive¹⁶
Implementation of national security rules for operators¹⁷¹⁸
Application of international humanitarian law to objects indispensable to civilians²⁵

6.8Risk Academy reading: literature and evidence review, science and assessments

The review behind this edition covers lifeline systems assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.

Review protocol

Question: What does the published evidence establish about the world’s critical infrastructure and lifeline systems and its couplings?
Sources searched: agency advisories; operator and regulator reports; peer-reviewed interdependency literature; loss statistics
Window: releases available at evidence close, 30 September 2026
Selection: sources that bind or contextualise a finding in this edition
Next step: systematic reviews for agenda items 01 to 05 in 2027

Table 6.5Peer-reviewed science and assessments
Reference	Type	Year	Role	Used for
Rinaldi, Peerenboom and Kelly²⁸	journal article	2001	framework	interdependencies
Buldyrev et al.²⁹	journal article	2010	supports	cascading failure
Koks et al.³⁰	journal article	2019	supports	transport hazard risk
Helbing³³	journal article	2013	framework	networked risk
Perrow, Normal Accidents³⁴	book	1984	framework	tight coupling
Zscheischler et al.³²	journal article	2018	framework	compound events

Table 6.6Institutional flagships
Reference	Issuer	Year	Role	Used for
Iberian blackout final report¹	ENTSO-E	2026	supports	grid failure
Joint cybersecurity advisory AA24-038A²	CISA and partners	2024	supports	pre-positioning
ENISA Threat Landscape 2025³	ENISA	2025	supports	incident counts
GAR 2025¹⁰	UNDRR	2025	supports	hazard losses
GAR 2022³⁷	UNDRR	2022	context	systemic risk
Lifelines¹¹	World Bank and GFDRR	2019	supports	disruption cost

Table 6.7Statistics, losses and reconstruction
Reference	Issuer	Year	Role	Used for
2025 Report Card⁶	ASCE	2025	supports	asset condition
RDNA5¹²	World Bank, UN, EU	2026	supports	reconstruction needs
Building Back Better³¹	World Bank	2018	context	recovery
Energy and AI⁸	IEA	2025	supports	load clusters
Electricity Grids and Secure Energy Transitions³⁵	IEA	2023	context	grid needs
Climate Resilience for Energy Security³⁹	IEA	2022	context	resilience
Global Critical Minerals Outlook 2026⁴⁰	IEA	2026	supports	mineral concentration
Global Energy Review 2026⁹	IEA	2026	supports	electricity growth

Table 6.8Standards, directives and operators
Reference	Issuer	Year	Role	Used for
Microsoft statement on the 2024 outage⁴	Microsoft	2024	supports	software failure
Root cause analysis³⁶	CrowdStrike	2024	context	software failure
Cable fault analysis⁷	TeleGeography	2024	supports	subsea faults
Cable maintenance data¹⁵	TeleGeography	2025	context	repair ships
Annual Outage Analysis 2026¹⁴	Uptime Institute	2026	context	outage cost
EU Action Plan on Cable Security³⁸	European Commission	2025	context	cable policy
Gulf desalination reporting¹³	press and think tanks	2026	context	strikes on plants

Where the evidence agrees

Failures cross sectors through shared power, telecoms and software¹⁴
Most subsea cable faults are accidental⁷
Infrastructure asset condition is uneven⁶

Where it is unsettled

Whether any given cable fault is deliberate⁷
How much pre-positioned access could be used to disrupt services²
How large cross-sector cascades are at operating scale²⁸²⁹

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
17UNVERIFIED, not opened: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), Official Journal of the European Union, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
18UNVERIFIED, not opened: The White House, National Security Memorandum on Critical Infrastructure Security and Resilience (NSM-22), 30 April 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
19UNVERIFIED, not opened: UNDRR (ed.), Sendai Framework for Disaster Risk Reduction 2015 to 2030 (target on damage to critical infrastructure), cited from memory. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2015. Accessed 2026-11-03.back
5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
21UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
27UNVERIFIED, not opened: ISO 31000:2018, Risk management: guidelines. International Organization for Standardization, Geneva. Observation year 2018. Accessed 2026-11-03.back
26UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals. Cybersecurity and Infrastructure Security Agency, Arlington, cited from memory. Observation year 2022. Accessed 2026-11-03.back
20UNVERIFIED, not opened: ISO 22301:2019, Security and resilience: business continuity management systems. International Organization for Standardization, Geneva. Observation year 2019. Accessed 2026-11-03.back
22UNVERIFIED, not opened: IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
24UNVERIFIED, not opened: United Nations Convention on the Law of the Sea (1982), articles 112 to 115 on submarine cables and pipelines, cited from memory. United Nations, New York. Observation year 1982. Accessed 2026-11-03.back
1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
38UNVERIFIED, not opened: European Commission and High Representative, Joint Communication on an EU Action Plan on Cable Security, February 2025, cited from memory. Observation year 2025. Accessed 2026-11-03.back
25UNVERIFIED, not opened: Protocol Additional to the Geneva Conventions of 12 August 1949 relating to the Protection of Victims of International Armed Conflicts (Protocol I), articles 54 and 56 on objects indispensable to survival and works containing dangerous forces, cited from memory. International Committee of the Red Cross, Geneva. Observation year 1977. Accessed 2026-11-03.back
28UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
30UNVERIFIED, not opened: Koks, E.E. et al., A global multi-hazard risk analysis of road and railway infrastructure assets, Nature Communications 10, 2677, 2019, cited from memory. Springer Nature. Observation year 2019. Accessed 2026-11-03.back
33UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back
34UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03.back
32UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
37UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2022: Our World at Risk. United Nations Office for Disaster Risk Reduction, Geneva, cited from memory. Observation year 2022. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
31UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Walsh, B., Building Back Better: Achieving Resilience through Stronger, Faster, and More Inclusive Post-Disaster Reconstruction. World Bank, Washington, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back
8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back
35UNVERIFIED, not opened: IEA (ed.), Electricity Grids and Secure Energy Transitions. International Energy Agency, Paris, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
39UNVERIFIED, not opened: IEA (ed.), Climate Resilience for Energy Security. International Energy Agency, Paris, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
40IEA (ed.), Global Critical Minerals Outlook 2026 (revised version, July 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
36UNVERIFIED, not opened: CrowdStrike (ed.), External technical root cause analysis for the Channel File 291 incident, August 2024, cited from memory; no figure used. CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
14UNVERIFIED, not opened: Uptime Institute (ed.), Annual Outage Analysis 2026 (57% of respondents in the 2025 survey reported a latest major outage above USD 100,000), taken from a press release summary; the report is limited to members. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 7

The 2027 agenda

Eight bounded questions open the 2027 lifeline systems agenda. Each comes from a baseline finding, names the initiative that will carry it and the first output due in the 2027 lifeline systems edition.

5 min read0 figures6 tables3 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

7.1Questions for the operational series

L-01
How would a regional power loss that overlaps a telecom or cloud failure spread through water, health and transport at the same time?
INI-SR02-PWR-01 · power and telecom compound loss; first output: dependency analysis for six regions.
L-02
Which shared dependencies (power, telecoms, software, positioning) sit behind the most services?
INI-SR02-DEP-02 · shared dependencies; first output: dependency register.
L-03
How long do lifeline services take to return after major outages, and what limits recovery?
INI-SR02-RST-03 · restoration times; first output: restoration table.
L-04
Where are subsea links and repair capacity thinnest?
INI-SR02-CBL-04 · subsea links; first output: link and repair map.
L-05
How do ageing assets and investment gaps coincide with hazard exposure?
INI-SR02-AST-05 · asset condition and exposure; first output: exposure overlay.
L-06
Which operators and states publish incident data on a comparable basis?
To be admitted in 2027; first output: coverage note.
L-07
How do conflict and sabotage threats change protection priorities for water and power?
To be admitted in 2027; first output: scoping note.
L-08
Which lifeline capabilities have been tested in real outages, and which are only planned?
Lifeline capability register; first output: rung evidence for 15 functions.

7.2Portfolio proposed for the Q1 2027 alignment

Five initiatives and one Universe mission candidate are proposed for the 2027 lifeline portfolio. They are programme objects: no partner, funder or member is attached to them in this edition.

Table 7.1Objects proposed for the first operational quarter
ID	Object	Kind	Question	State
INI-SR02-PWR-01	Power and telecom compound loss	Initiative	L-01	PROPOSED
INI-SR02-DEP-02	Shared dependencies	Initiative	L-02	PROPOSED
INI-SR02-RST-03	Restoration times	Initiative	L-03	PROPOSED
INI-SR02-CBL-04	Subsea links and repair capacity	Initiative	L-04	PROPOSED
INI-SR02-AST-05	Asset condition and exposure	Initiative	L-05	PROPOSED
MSN-SR02-2027-01	Power and telecom loss Universe mission	Mission	L-01	Candidate

7.3The pathway

The lifeline systems edition reads national infrastructure chapters, sector editions and the global edition through one governed evidence graph. At baseline the federation is designed and its first editions are drafted. This page states what exists today and what comes next.

01
National infrastructure chapters
lifeline reading in each national edition
IN PREPARATION · national baselines
02
Sector editions
power, water, cyber, transport
PLANNED · sector Baseline Editions
03
Lifeline systems model
the global lifeline system of systems
v0 SPECIFIED · v1 with federation evidence
04
Strategic links
SR-01 · SR-03 supply chains · SR-10 digital public infrastructure
PLANNED · strategic baselines
05
Universe
annual proving environment
CANDIDATE MISSION · mandate in 2027
06
Lifeline Systems Report
this series
BASELINE DRAFT · 2027 annual edition
07
Evidence and correction
one graph, many projections
OPEN · first correction cycle in 2027

7.4Universe 2027: evidence pack for the lifeline systems candidate mission

01
Mandate
02
Core Build · 1 month
03
Action · 1 week
04
Evidence seal
05
Portfolio correction
06
Next mandate

Table 7.2Universe 2027: evidence pack for the lifeline systems candidate mission
Item	Record	State	Timing
F1	Annual mandate record	PLANNED	after the Q2 2027 alignment
F2	Core Build record	PLANNED	one month before the exercise
F3	Exercise evidence	PLANNED	during the Action week
F4	Decision packets	PLANNED	exercise state only
F5	Proof receipts	PLANNED	scoped to each recorded check
F6	After-action report	PLANNED	within one quarter
F7	Upgrade docket	PLANNED	routed to the Portfolio
F8	Portfolio renewal	PLANNED	2027 lifeline systems annual edition
F9	Public synthesis	PLANNED	public-safe extracts only

Mission

ID: MSN-SR02-2027-01 · Power and telecom loss Universe mission
Role spine: Leadership sponsor · Institutional anchor · Mission lead: drawn from national pathways
Receiving actors: to be identified with the mandate

7.5Handoffs and routing

Where the baseline’s findings go next. A handoff routes a finding for awareness, review or work; it transfers no authority.

Table 7.3Handoffs and routing
Finding	Routed to	Purpose	Class
INF-001 · grid failure	regional consortia	grid constraint overlay	PUBLIC
CYB-002 · pre-positioning	INI-SR02-DEP-02	shared dependencies	PUBLIC
DAT-004 · software failure	INI-SR02-DEP-02	shared dependencies	PUBLIC
INF-005 · asset condition	INI-SR02-AST-05	asset condition and exposure	PUBLIC
INF-006 · subsea links	INI-SR02-CBL-04	subsea links and repair capacity	PUBLIC
DEV-008 · disruption cost	INI-SR02-RST-03 · key F review	restoration times	PUBLIC
CON-009 · war damage	sector editions	recovery needs	PUBLIC
SYS-012 · compound pathway	MSN-SR02-2027-01	Universe candidate	CONSORTIUM

Table 7.4Routing rules by publication class
Class	Where it goes	Who can see it
PUBLIC	the published edition and its evidence bundle	anyone
CONSORTIUM	governed rooms of the federation	consortium members under agreement
CONTROLLED	need-to-know channels	named competent actors only

7.6Feeds and signal register

Table 7.5Feeds watched from 2027
Feed	Producer	Latency	Feeds into
Incident and advisory feeds	CISA and partner agencies	per event	CYB-002
EU threat landscape	ENISA	annual	CYB-003
Transparency platform for the continental grid	ENTSO-E	hourly	INF-001
Cable fault and repair data	TeleGeography and industry	per event	INF-006
Disaster loss data	UNDRR and reinsurers	annual	CLI-007
Outage analysis	Uptime Institute	annual	DAT-004
Damage assessments	World Bank, UN and EU	annual	CON-009

Escalation routes

none · keep monitoring
research question
project
risk object
annual publication
signal report

Table 7.6Signals at baseline
ID	Signal	Corroboration	Systems	Route
SIG-SR02-001	Single-vendor software outage in 2024⁴	CORROBORATED	DAT · INF	risk object RSK-SR02-DAT-003
SIG-SR02-002	Multi-year pre-positioning reported in four sectors²	CORROBORATED	INF · DAT	research question L-02
SIG-SR02-003	Strikes on co-located power and water plants in 2026¹³	PARTIAL	ENE · WAT	research question L-01

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back

Critical Infrastructure and Lifeline Systems 2026
Chapter 8

Systems in depth

One section per system: its state at evidence close, its exposures and what the operational series will watch.

7 min read0 figures5 tables16 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

8.1Common causes

One cause can strike many lifelines at once: a hazard, a cyber campaign, a war or a faulty update. The shared cause matters more than the sector.

4,875incidents

analysed by ENISA, Jul 2024 to Jun 2025³

≥5years

longest reported intrusion persistence²

>250USD billion

annual loss to infrastructure, three hazards¹⁰

Table 8.1Evidence at baseline
Instance	Mechanism in action	Evidence	Status
Natural hazards	floods, cyclones and earthquakes drive large annual losses to infrastructure	¹⁰	Reported
Cyber operations	pre-positioning reported in four sectors	²³	Reported
Conflict	direct strikes on power and water plants	¹²¹³	Reported
Software faults	one update reached millions of devices	⁴	Reported

Pathways in this mechanism

CLI → INF hazards
DAT → INF software and cyber
CON → INF strikes

Evidence to bind in 2027

common cause tagging of incidents
frequency of concurrent causes

Related editions

GLB Global Systems
SR-01 Global Polycrisis and Cascading Systems Risk
SR-03 Global Supply Chains, Trade and Chokepoints
SR-10 Digital Public Infrastructure and Systemic Cyber Risk
GS-02 Energy
GS-13 Cyber and Digital Systems

8.2Domino effects

A failure in one lifeline removes an input from the next. Power outages reach water works, exchanges and hospitals in sequence.

28April 2025

Iberian blackout¹

8.5million

Windows devices affected, 18 July 2024⁴

≈90%

of Kuwait’s drinking water from desalination¹³

Table 8.2Evidence at baseline
Instance	Mechanism in action	Evidence	Status
Power to telecoms	exchanges run on batteries and generators after grid loss	¹	Inferred
Software to services	one vendor update disabled many operators’ machines	⁴	Reported
Power to water	co-located plants lose both services when struck	¹³	Reported
Water to health	hospital supply depends on water works	¹¹	Inferred

Pathways in this mechanism

ENE → INF → WAT, HLT
DAT → INF → FIN
CON → ENE, WAT

Evidence to bind in 2027

sequence timing of service loss
hospital-level dependence data

Related editions

GLB Global Systems
SR-01 Global Polycrisis and Cascading Systems Risk
SR-03 Global Supply Chains, Trade and Chokepoints
SR-10 Digital Public Infrastructure and Systemic Cyber Risk
GS-02 Energy
GS-13 Cyber and Digital Systems

8.3Inter-systemic feedbacks

Lifelines also depend on what they power. Control networks need telecoms, telecoms need power, and digital loads press back on grids.

≈50%

of US electricity demand growth from data centres, 2025⁹

≈45%

of US data-centre capacity in five clusters (nearly half)⁸

57%

of operators reported a latest outage above USD 100,000¹⁴

Table 8.3Evidence at baseline
Instance	Mechanism in action	Evidence	Status
Digital load to grid	clustered demand tightens local grids	⁸⁹	Reported
Grid to digital	data centres need continuous power	¹⁴	Inferred
Remote control	control networks need telecoms and power	⁵	Inferred
Financial feedback	losses feed budgets and delay maintenance	¹¹	Inferred

Pathways in this mechanism

AIC → ENE
ENE → AIC → INF
DAT ↔ INF

Evidence to bind in 2027

control-network dependence data
cluster-level reliability

Related editions

GLB Global Systems
SR-01 Global Polycrisis and Cascading Systems Risk
SR-03 Global Supply Chains, Trade and Chokepoints
SR-10 Digital Public Infrastructure and Systemic Cyber Risk
GS-02 Energy
GS-13 Cyber and Digital Systems

8.4Shared vulnerabilities

Different lifelines share the same weak points: subsea cables, widely deployed software, ageing assets and a few repair resources.

199faults a year

subsea cable average, 2010 to 2023⁷

≈2/3

of faults from fishing and transport vessels⁷

3.6USD trillion

US ten-year investment gap⁶

Table 8.4Evidence at baseline
Instance	Mechanism in action	Evidence	Status
Subsea cables	frequent, mostly accidental faults; few repair ships	⁷¹⁵	Reported
Common software	a shared platform spreads one fault widely	⁴	Reported
Ageing assets	energy D+, wastewater D+, dams D+ in the US	⁶	Reported
Positioning and timing	signals underpin networks; no consolidated series here	⁸	Expert input

Pathways in this mechanism

INF → DAT cable loss
DAT → INF software
INF → FIN deferred maintenance

Evidence to bind in 2027

repair-vessel capacity by region
dependence on positioning and timing

Related editions

GLB Global Systems
SR-01 Global Polycrisis and Cascading Systems Risk
SR-03 Global Supply Chains, Trade and Chokepoints
SR-10 Digital Public Infrastructure and Systemic Cyber Risk
GS-02 Energy
GS-13 Cyber and Digital Systems

8.5Thresholds and tipping

A system can absorb stress until a threshold is crossed. Black-start capability, repair capacity and recovery finance are such thresholds for lifelines.

587.7USD billion

Ukraine recovery needs over ten years¹²

24.8USD billion

direct damage, energy and extractives, to end 2025¹²

≈4USD per USD 1

reported return on resilient options in LMICs¹¹

Table 8.5Evidence at baseline
Instance	Mechanism in action	Evidence	Status
Restoration capacity	service returned after 2024 and 2025 events; times not consolidated	¹⁴	Reported
Repair capacity	ageing repair fleet	¹⁵	Reported
Recovery finance	needs far exceed damage recorded to date	¹²	Reported
Tipping in networks	cascades can become abrupt in interdependent networks	²⁹	Inferred

Pathways in this mechanism

INF → INF cascade thresholds
FIN → INF recovery finance
CON → INF repeated damage

Evidence to bind in 2027

black-start capability data
cascade thresholds at operating scale

Related editions

GLB Global Systems
SR-01 Global Polycrisis and Cascading Systems Risk
SR-03 Global Supply Chains, Trade and Chokepoints
SR-10 Digital Public Infrastructure and Systemic Cyber Risk
GS-02 Energy
GS-13 Cyber and Digital Systems

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back
14UNVERIFIED, not opened: Uptime Institute (ed.), Annual Outage Analysis 2026 (57% of respondents in the 2025 survey reported a latest major outage above USD 100,000), taken from a press release summary; the report is limited to members. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03.back
5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

Methodology

How the edition was made: methods, the model card, the evidence cut and its age, the acceptance record and the glossary.

12 min read0 figures13 tables11 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

A.1Methods

The global baseline uses published values and four simple derivations. Each is shown in full so that any reader can reproduce it.

Table A.1Methods
No.	Derivation	Calculation	Result
(1)	Factors named in the Iberian blackout page summary	count of listed factors	5, unweighted
(2)	ENISA incidents per month in the period	4,875 ÷ 12	≈ 406
(3)	Subsea faults per week at the average	199 ÷ 52	≈ 3.8
(4)	Faults a year from external aggression (about)	199 × 2 ÷ 3	≈ 133

Table A.2Coupling strength scale (matrix and model card)
Strength	Definition
STRONG	a disruption in the source system has historically changed the target system’s service or output within one season, in more than one region
MODERATE	an effect is documented but buffered or slower
WEAK	an effect is plausible but not documented at global scale

Table A.3Status grammar
Label	Rule
Reported	value as issued by its source, with year
Inferred	reasoned from cited evidence; never a measurement
Estimated	Nexus analytical value with stated method
Scenario	conditional on stated assumptions
Expert input	structured editorial judgement awaiting evidence

A.2Model card, Lifeline Systems Model v0

Model ID: MDL-SR02-LIFELINES · v0.1
Purpose: represent lifeline systems as a dependent network and the mechanisms by which failures spread between power, water, communications, transport and health
Family: graph-based system of systems
Inputs: the cited sources of this edition; no proprietary data
Method: expert-specified coupling strengths (STRONG · MODERATE · WEAK) from assessments and analogue events
Validation: none yet, first validation against federation evidence in 2027
Uncertainty: qualitative; strengths are hypotheses, not measurements
Domain of validity: global scale; not for asset-, site- or country-level use
Reproducibility: strength table and sources published in this edition

20couplings

typed in v0

5strong

documented within one season

3moderate

documented, buffered

12weak

plausible, undocumented

A.3The baseline evidence cut

Every Nexus edition is published from a frozen evidence cut. The global baseline cut is documentary: it pins the exact edition of every source cited. Federation cuts begin with the first national Foundry cuts in 2027.

Cut ID: DC-STRATEGIC-LIFELINES-GLOBAL-2026-B0
Type: baseline documentary cut
Resolution policy: pinned · as of 30 September 2026
Sources pinned: 40 cited sources, each at the edition and access date in the references
Model runs: none at baseline, analytical values are stated with their method
Digest: computed at freeze and recorded in the publication record
Supersedes: nothing, first cut of the series
Superseded by: the 2027 lifeline systems annual cut

Lineage

01
source edition
02
pinned citation
03
finding
04
page
05
publication record

Table A.4From the baseline cut to the federation cut
Element	Baseline 2026	2027 global annual
Sources	cited global publications, pinned by edition	national, regional and sector cuts through one graph
Analysis	stated methods and editorial estimates	typed analysis specifications
Models	Lifeline Systems Model v0 specification	model runs with receipts
Findings	twelve baseline findings	findings re-bound to federation evidence
Review	five passes scheduled	five passes on the exact digest

A.4Evidence age and coverage

A 2026 global edition rests on evidence observed in many different years. This page shows each time base, so that no single year label hides older evidence.

Table A.5Evidence age and coverage
Indicator	Observed	Released	Cadence	Next release
Grid failure analysis	2025	Mar 2026	one-off	follow-up reports
Cyber advisories	2024	Feb 2024	per event	next joint advisory
EU incident counts	Jul 2024 to Jun 2025	Oct 2025 · v1.3 Sep 2026	annual	next ENISA report
Software outage	2024	Jul 2024	one-off	none scheduled
US asset condition	2025	Mar 2025	four-yearly	2029
Cable fault average	2010 to 2023	2024	ad hoc	next analysis
Hazard losses to infrastructure	2025	May 2025	biennial	2027
Disruption cost in LMICs	2019	2019	one-off	no update found
Reconstruction needs	to Dec 2025	Feb 2026	annual	RDNA6
Gulf strikes	2026	Mar to Jul 2026	per event	not verified

Table A.6Coverage by system at baseline
System	Coverage	Thinnest dimension
Power	GOOD	restoration times
Communications	PARTIAL	cross-operator dependency
Water	THIN	interdependence with power
Transport	THIN	cross-modal dependence
Health	THIN	facility-level resilience
Cyber	PARTIAL	operator-level data
Finance of resilience	PARTIAL	recent estimates
Conflict damage	THIN	verified 2026 damage

Table A.7Designed empty states: what is not bound, what would fill it and why
Field	Source that would fill it	Blocker
Cross-sector dependency data at city and national scale	operators, regulators and national statistics offices	security-sensitive and not published on a common basis
Restoration times for lifeline services after major outages	operator and regulator reports	not retrieved; no consolidated series
Full text of the ENTSO-E final report and its recommendation count	ENTSO-E final report¹	only the publication page was opened; sources disagree on the number of recommendations
ENISA sector breakdown and top threats	ENISA Threat Landscape 2025 full report³	the publication page was read; the PDF was not opened and the page notes corrected figures in version 1.3
Subsea cable repair capacity by region	TeleGeography and ICPC¹⁵	ship counts not retrieved; the 2040 end-of-life figure rests on a search summary
Verified damage to Gulf power and desalination plants	national authorities and independent assessments¹³	press and think-tank reports only; no official damage assessment found
Share of outages caused by power failure at digital facilities	Uptime Institute Annual Outage Analysis¹⁴	report limited to members and subscribers
UNDRR GAR 2025 infrastructure loss figures from the report itself	UNDRR GAR 2025¹⁰	the report page returned an access error; figures come from search summaries
World Bank Lifelines figures from the report itself	World Bank and GFDRR¹¹	the repository returned an access error; figures come from search summaries
Condition of infrastructure outside the United States on one scale	national report cards and statistics	no comparable global series found
Status of EU critical entity identification by Member States	European Commission, national authorities¹⁶	not retrieved
Capability rungs beyond restoration	operators, regulators, ministries	not reviewed

A.5Evidence cards, two anchor sources

Issued by the association of European transmission system operators. One-off. Role: binds INF-001. Coverage: Continental Europe. The publication page was read; the full report was not opened.

EVD-SR02-001

ENTSO-E publication page on the Iberian blackout¹

Issued by the EU Agency for Cybersecurity. Annual. Role: binds CYB-003. Reporting period 1 July 2024 to 30 June 2025; the page notes corrections in version 1.3.

EVD-SR02-002

ENISA Threat Landscape 2025³

Table A.8Quality dimensions at baseline
Dimension	EVD-SR02-001	EVD-SR02-002
Completeness	event-specific; some generation data missing	incidents analysed; sector split not read
Timeliness	about 11 months after the event	about 3 months after the period
Revision	final after interim reports	version 1.3 corrected figures
Method transparency	expert panel method published	threat-centric method stated
External validation	independent expert panel	agency review

Evidence cards to follow in 2027

ENTSO-E¹: recommendation tables in the final report
ENISA³: sector breakdown of incidents
CISA²: follow-up advisories
ASCE⁶: sector pages for energy and water

A.6Publication acceptance record

Editorial self-check at evidence close. Every applicable item carries a disposition; the remaining items are review, approval and deposit.

Table A.9Publication acceptance record
Group	Area	Items	Pass	N/A	Pending
D1	Identity and scope	8	8	0	0
D2	Source and data	12	9	1	2
D3	Analysis and models	12	3	8	1
D4	Findings and claims	9	8	0	1
D5	Figures, tables, maps	10	6	2	2
D6	Editorial and citations	10	8	0	2
D7	Review and approval	13	0	0	13
D8	Artefact and design	12	7	0	5
D9	Registry and release	9	0	0	9

Publication gate

Conditions met: 14 of 23 at evidence close
Blocking problems: none recorded
Open conditions: reviews, approval of the exact digest, deposit, registry pointer

Not applicable at baseline

Model runs: first runs in Q1 2027
Maps: plates in Q2 2027
Waivers: none

A.7Status words

Table A.10The status every value carries
Status	What it means
Observed	Measured directly and published by the source.
Reported	Published statistics of an official or institutional source.
Declared	Stated by the body concerned; not independently measured.
Estimated	A Nexus estimate from cited evidence, with its method in Annex A.
Modelled	Produced by a stated model from cited inputs.
Inferred	Reasoned from cited evidence; not measured.
Forecast	A projection by the cited source.
Simulated	A simulation result under stated assumptions.
Scenario	A conditional statement under stated assumptions; never a prediction.
Expert input	Expert judgement, recorded with its basis.
Candidate	Proposed for a later edition; not yet evidence.
Evidence-quality levels (EQL 1 to 5) grade the source behind a value; they are not a score of the subject.

A.8How the edition is made, released and corrected

Every edition is built from a sealed evidence cut, reviewed under three keys, signed and deposited before any site shows it as published; corrections go to Nexus Standards as change proposals and feed the next cut.

Step	What happens	Source
01 Evidence arrives from the pillars	Foundry seals observations and indicator series, Universe hands over after-action and scenario findings, and contributions are screened at every gateway, including this site’s.
02 The cut is sealed	On the cut date the evidence is pinned under one identifier, so anyone can rebuild the edition from exactly what it was built on.
03 The edition is assembled	The edition is drafted from its template and content pack. Agents may draft; they never publish and never decide.
04 The keys turn	At the publisher of record the truth key comes first: every value is checked against its source or stated method before the meaning and capital keys turn. No edition moves on until every key has been turned by a named steward.
05 The gate opens	A named approver releases one exact digest of the edition; any change after this point is a new version, never a silent edit.
06 Signed and deposited	The PDF, the web edition and the data bundle are signed together with a manifest and an RO-Crate description, and deposited on Zenodo with a concept and a version DOI.
07 Published on its desk’s site	Only then does the edition show as published on its desk’s Reports site, and the Collection lists it as a part.
08 Corrections go to Standards	Method and correction findings go to Nexus Standards as change proposals; citations, corrections and new contributions feed the next evidence cut.

A teaching model of the process, not a forecast and not a record of any run; dates and counts on this page come from the programme record. Sources: Reports governance at GCRI Canada (2026); Zenodo, repository of record for Reports deposits (2026).

Lifecycle, one state at a time: Draft, Computed, Evidence bound, Reviewed, Approved for release, Published, Corrected, Superseded. This edition is a draft.

A.9Glossary and abbreviations

Table A.11Series terms
Term	Meaning
Baseline Edition	the inaugural annual edition that fixes the reference state for the series
WEFH+B	water, energy, food, health and biodiversity, the national nexus core
Coupling	a typed dependency through which one system transmits to another
Protection gap	the share of losses not covered by insurance
Capability ladder	LISTED → EXISTS → ADEQUATE → TESTED → DEMONSTRATED
EQL	evidence-quality level, 1–5
Evidence cut	a frozen resolution of exact sources and versions
NNC · NLC · NWG	National Nexus Consortium · National Leadership Council · National Working Groups

Table A.12Abbreviations used in this edition
Abbreviation	Expansion
ASCE	American Society of Civil Engineers
CISA	US Cybersecurity and Infrastructure Security Agency
CSF	Cybersecurity Framework
ENISA	European Union Agency for Cybersecurity
ENTSO-E	European Network of Transmission System Operators for Electricity
GAR	Global Assessment Report on Disaster Risk Reduction
ICPC	International Cable Protection Committee
LMIC	low- and middle-income countries
NIS2	second Network and Information Security Directive
OT	operational technology
RDNA	Rapid Damage and Needs Assessment
UNDRR	United Nations Office for Disaster Risk Reduction

A.10Technical annex

Table A.13Technical annex
Item	Annex	Contents	Status
A.1	Indicator definitions	the global indicator set, with units and sources	IN THIS EDITION
A.2	Coupling strengths	the twenty-cell matrix and its rationale	IN THIS EDITION
A.3	Scenario specification	SCN-SR02-PWR-01 assumptions and signposts	IN THIS EDITION
A.4	Capability placements	rung evidence for fifteen functions	IN THIS EDITION
A.5	Model diagnostics	first runs and validation	2027
A.6	Sensitivity analyses	influence of coupling strengths	2027
A.7	Regional notes	regional lifeline cards	WITH REGIONAL EDITIONS
A.8	Review statements	pass-by-pass review record	AT RELEASE

A.1 · indicator definition: subsea cable fault

Construct: a reported break or damage event on a telecommunications submarine cable
Unit: faults per year
Method: industry fault databases and operator reports
Source: TeleGeography analysis⁷
Uncertainty: counts depend on the database; public and private series differ
Known limits: does not record intent or repair time

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back
14UNVERIFIED, not opened: Uptime Institute (ed.), Annual Outage Analysis 2026 (57% of respondents in the 2025 survey reported a latest major outage above USD 100,000), taken from a press release summary; the report is limited to members. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back

Data appendix

The indicator set with its sources, the source registers, the licences of every kind of material and the formats of the edition.

8 min read0 figures8 tables13 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

B.1The indicator set

Table B.1Global baseline indicator set
Indicator	Value	Unit	Year	State	Source
Subsea cable faults, average	199	a year	2010 to 2023	Reported	⁷
Faults from external aggression	≈ two thirds	share	2010 to 2023	Reported	⁷
ENISA incidents analysed	4,875	incidents	Jul 2024 to Jun 2025	Reported	³
Windows devices affected	8.5	million	2024	Reported	⁴
Longest reported intrusion persistence	≥ 5	years	2024	Reported	²
US overall infrastructure grade	C	letter grade	2025	Reported	⁶
US ten-year investment gap	3.6	USD trillion	2025	Reported	⁶
Annual loss to infrastructure, three hazards	>250	USD billion	2025	Reported	¹⁰
Annual disruption cost, LMICs	≥ 390	USD billion	2019	Reported	¹¹
Return on resilient options	≈ 4	USD per USD 1	2019	Estimated	¹¹
Ukraine recovery needs, ten years	587.7	USD billion	to Dec 2025	Reported	¹²
Ukraine energy needs, ten years	≈ 91	USD billion	to Dec 2025	Reported	¹²
Direct damage, energy and extractives	24.8	USD billion	to Dec 2025	Reported	¹²
Share of US electricity growth from data centres	≈ 50	%	2025	Reported	⁹
Operators reporting outage cost above USD 100,000	57	%	2025	Reported	¹⁴

Indicators, CSV Indicators, JSON

B.2Global source register

The governed source set behind this edition. Each source keeps its authority, coverage, cadence and role; categories describe origin, not truth.

Domains bound by the register

Table B.3Global source register
Source	Category	Coverage	Period	Cadence	Role
ENTSO-E final report¹	operators’ association	Continental Europe	2025	one-off	grid failure
CISA advisory AA24-038A²	national agencies	US and partners	2024	per event	cyber access
ENISA Threat Landscape³	EU agency	EU	2024 to 2025	annual	incidents
Microsoft statement⁴	vendor	global	2024	one-off	software failure
NIST CSF 2.0⁵	national standards body	global use	2024	periodic	cyber framework
ASCE Report Card⁶	professional body	US	2025	four-yearly	asset condition
TeleGeography⁷	market analyst	global	2010 to 2023	ad hoc	cable faults
UNDRR GAR 2025¹⁰	UN agency	global	2025	biennial	hazard losses
World Bank Lifelines¹¹	multilateral bank	LMICs	2019	one-off	disruption cost
RDNA5¹²	multilateral	Ukraine	2025	annual	damage and needs

B.3Regional reading, ten regional clusters

Map plates follow with the regional Baseline Editions, when boundary sources and public-safe resolutions are bound. This page gives the regional reading in table form and ranks no region.

Table B.4Regional reading, ten regional clusters
Region	Principal hazards	Systems most exposed	Baseline evidence
North America	ageing assets; hurricanes; data-centre load	power, water, telecoms	ASCE report card⁶; IEA⁹
South America	hydropower dependence; floods	power, transport	regional statistics (not bound)
Europe	grid stability; cable incidents; cyber	power, telecoms	ENTSO-E¹; ENISA³
Eurasia	conflict damage; grid attacks	power, heat	RDNA5¹²
Middle East and North Africa	strikes on co-located plants; desalination reliance	water, power	press reports¹³
Africa	maintenance and financing gaps	power, transport	Lifelines¹¹
South Asia	cyclones and floods	power, ports	GAR 2025¹⁰
East Asia	earthquake and typhoon exposure; cables	power, telecoms	GAR 2025¹⁰; cable analysis⁷
ASEAN	cyclones; subsea links	telecoms, ports	cable analysis⁷
Oceania-Pacific	island links; cyclones	telecoms, power	cable analysis⁷

B.4Regional card: Continental Europe grid

region
grid
synchronous area
cross-border

Systems in view: power, telecoms, water, hospitals
Defining events: blackout in Spain and Portugal on 28 April 2025¹
Couplings: ENE → INF → HLT; ENE → WAT
Capability evidence: restoration and a published expert report¹
Gaps: cross-border flows; data on pre-event generation tripping
Agenda items: L-01 · L-03

The final report names oscillations, voltage and reactive power control gaps and generator disconnections as interacting factors [1].

POWER

Interacting factors

Service returned after the event; the time to restore each lifeline is not consolidated here.

RECOVERY

Restoration

The expert panel report is an analysis of causes and recommendations, not an attribution of liability [1].

LEARNING

A public report

B.5How countries appear in the global edition

Countries enter the lifeline systems edition through the infrastructure chapters of their own national editions, on one card grammar. They are read against peer distributions and thresholds, never placed in a league table.

Table B.5How countries appear in the global edition
Card field	What it shows	Source
WEFH+B state	each core system against peer distribution bands	national edition
Couplings	the national dependency matrix	national edition
Risk objects	the national risk portfolio	national edition
Capability rungs	the national capability ladder	national edition
Evidence age	oldest and newest source dates	national source register

Editions in the 2026 Baseline programme

26national

countries and unions

10regional

clusters

16global

flagship and sector

14strategic

systems reports

20frontier

technology reports

How to read a country card

Each system is shown against the distribution of its peers, with thresholds where they exist
Couplings and risk objects come from the country’s own national edition
Capability rungs record evidence, not a judgement of institutions
Evidence age is printed, so older national data are visible as such

Table B.6National Baseline Editions in the 2026 programme
Wave	Countries and unions	State
W0	Canada	ISSUED
W1	United States, United Kingdom, France, Germany, Italy, Japan, European Union, Switzerland	PLANNED
W2	Mexico, Brazil, Argentina, Türkiye, Russian Federation, Saudi Arabia, United Arab Emirates, South Africa, Senegal, Kenya, African Union, India, China, Republic of Korea, Indonesia, Singapore, Australia	PLANNED

B.6Licences

Table B.7Licences of each kind of material
Material	Licence
Text	CC BY 4.0
Data	on the licence of each source; Nexus tables CC BY 4.0
Figures	Nexus figures CC BY 4.0; third-party as credited
Maps	boundary source and licence printed on each plate
Metadata	CC0 1.0, as Zenodo publishes it
Third-party data, figures and text	The source’s own licence, credited where it is used; never relicensed
Nexus-authored text, tables and figures: CC BY 4.0 (SPDX CC-BY-4.0). Map plates print their boundary source and licence.

B.7Formats and provenance

Table B.8This edition in every format
Format	Kind	State	What it is	Identifier
Web edition	HTML	On this site	Draft in stewardship review; every value resolves to its source.	NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-v1.0.0
Print edition	PDF	At release	A4 portrait · screen, print and archival PDF, signed with the web edition at release.	NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-v1.0.0
Indicator data	CSV · JSON	On this site	15 indicators with unit, year, status and source; the machine-readable copy ships with the evidence bundle at release.	NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE data release v1
Figures	SVG · PNG	On this site	4 on the web edition: headline figure, figure 1.3, coupling instrument, capability ladder.	FIG-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-*
Slides	PDF	Not recorded	No slide deck is recorded for this edition.
Evidence brief	HTML · PDF	Not recorded	No evidence brief is recorded for this edition.
Dataset with DOI	DataCite	At release	Concept and version DOI are minted at deposit; none is recorded yet.

Provenance

Edition pack: The edition’s content pack (JSON), from which the print and web editions are built
Evidence cut: DC-STRATEGIC-LIFELINES-GLOBAL-2026-B0, closed 30 September 2026
Reproducibility: sourced values cited; analytical values reproducible from stated parameters
Self-check: 14 of 23 at evidence close; a fail on any item blocks release
Review: five passes scheduled before release (in Annex C)
Publisher of record: GCRI for the Nexus Consortium
Corrections: Registry correction pathway; upheld corrections are published as notices with a new version

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
14UNVERIFIED, not opened: Uptime Institute (ed.), Annual Outage Analysis 2026 (57% of respondents in the 2025 survey reported a latest major outage above USD 100,000), taken from a press release summary; the report is limited to members. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03.back
1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back

References and record

Every source the edition rests on, the publication record, the corrections log and the open record.

13 min read0 figures1 table0 notesNR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE

C.140 sources

NR-CIT-1, editor first. A DOI is linked where the source has one; Nexus records carry a UNI once the catalogue allocates it (NS-1).

1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 8
2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 7, chapter 8
3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6, chapter 7, chapter 8
5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 6, chapter 8
9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 6, chapter 8
10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 4, chapter 6, chapter 8
12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 8
13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03. Cited in the summary, chapter 1, chapter 2, chapter 3, chapter 6, chapter 7, chapter 8
14UNVERIFIED, not opened: Uptime Institute (ed.), Annual Outage Analysis 2026 (57% of respondents in the 2025 survey reported a latest major outage above USD 100,000), taken from a press release summary; the report is limited to members. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6, chapter 8
15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03. Cited in chapter 4, chapter 6, chapter 8
16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
17UNVERIFIED, not opened: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), Official Journal of the European Union, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
18UNVERIFIED, not opened: The White House, National Security Memorandum on Critical Infrastructure Security and Resilience (NSM-22), 30 April 2024, cited from memory. Observation year 2024. Accessed 2026-11-03. Cited in chapter 4, chapter 6
19UNVERIFIED, not opened: UNDRR (ed.), Sendai Framework for Disaster Risk Reduction 2015 to 2030 (target on damage to critical infrastructure), cited from memory. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2015. Accessed 2026-11-03. Cited in chapter 6
20UNVERIFIED, not opened: ISO 22301:2019, Security and resilience: business continuity management systems. International Organization for Standardization, Geneva. Observation year 2019. Accessed 2026-11-03. Cited in chapter 4, chapter 6
21UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
22UNVERIFIED, not opened: IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03. Cited in chapter 4, chapter 6
23UNVERIFIED, not opened: OECD (ed.), Good Governance for Critical Infrastructure Resilience. OECD Publishing, Paris, 2019. Observation year 2019. Accessed 2026-11-03. Cited in chapter 4
24UNVERIFIED, not opened: United Nations Convention on the Law of the Sea (1982), articles 112 to 115 on submarine cables and pipelines, cited from memory. United Nations, New York. Observation year 1982. Accessed 2026-11-03. Cited in chapter 6
25UNVERIFIED, not opened: Protocol Additional to the Geneva Conventions of 12 August 1949 relating to the Protection of Victims of International Armed Conflicts (Protocol I), articles 54 and 56 on objects indispensable to survival and works containing dangerous forces, cited from memory. International Committee of the Red Cross, Geneva. Observation year 1977. Accessed 2026-11-03. Cited in chapter 6
26UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals. Cybersecurity and Infrastructure Security Agency, Arlington, cited from memory. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
27UNVERIFIED, not opened: ISO 31000:2018, Risk management: guidelines. International Organization for Standardization, Geneva. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
28UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6
29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03. Cited in chapter 3, chapter 4, chapter 6, chapter 8
30UNVERIFIED, not opened: Koks, E.E. et al., A global multi-hazard risk analysis of road and railway infrastructure assets, Nature Communications 10, 2677, 2019, cited from memory. Springer Nature. Observation year 2019. Accessed 2026-11-03. Cited in chapter 6
31UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Walsh, B., Building Back Better: Achieving Resilience through Stronger, Faster, and More Inclusive Post-Disaster Reconstruction. World Bank, Washington, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
32UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03. Cited in chapter 6
33UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03. Cited in chapter 4, chapter 6
34UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03. Cited in chapter 6
35UNVERIFIED, not opened: IEA (ed.), Electricity Grids and Secure Energy Transitions. International Energy Agency, Paris, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03. Cited in chapter 6
36UNVERIFIED, not opened: CrowdStrike (ed.), External technical root cause analysis for the Channel File 291 incident, August 2024, cited from memory; no figure used. CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03. Cited in chapter 6
37UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2022: Our World at Risk. United Nations Office for Disaster Risk Reduction, Geneva, cited from memory. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
38UNVERIFIED, not opened: European Commission and High Representative, Joint Communication on an EU Action Plan on Cable Security, February 2025, cited from memory. Observation year 2025. Accessed 2026-11-03. Cited in chapter 6
39UNVERIFIED, not opened: IEA (ed.), Climate Resilience for Energy Security. International Energy Agency, Paris, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03. Cited in chapter 6
40IEA (ed.), Global Critical Minerals Outlook 2026 (revised version, July 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03. Cited in chapter 3, chapter 6

C.2Publication record

Publication

Title: Strategic Systems Report 2026: Critical Infrastructure and Lifeline Systems, Baseline Edition
Series: Reports · Strategic Systems Series SR-02
Edition: Baseline Edition 2026 · inaugural annual
Version: v1.0.0 · draft for stewardship review
Publication ID: NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-v1.0.0
Evidence close: 30 September 2026
Publication date: October 2026
DOI: concept and version DOI at deposit

Publisher

Publisher of record: The Global Centre for Risk and Innovation (GCRI), for the Nexus Consortium
Place: Toronto
Editor: Saeed Valadbaygi, Chief Steward and Managing Editor
Stewards: GCRI · technical truth · GRF · public meaning · GRA · capital meaning
Licence: text CC BY 4.0; data on the terms of each source
Language: English (en-GB) source edition
Correspondence: Registry correction pathway · editorial office

Colophon

Format: A4 portrait · screen, print and archival PDF
Typefaces: Space Grotesk (display) · Geist (text) · IBM Plex Sans Italic (standfirsts) · IBM Plex Mono (data)
Design standard: Reports Foundational Edition, Volume I, Part VII
Accessibility: tagged PDF and HTML targets; text alternatives for every figure
Production: Reports editorial team, GCRI

Release path for this version

Table C.1Release path for this version
Step	What happens	When
Draft	editorial self-check complete at evidence close	October 2026
Steward review	five passes on the exact draft (keys T · M · F · N)	Q4 2026
Approval	publication authority approves the exact digest	before release
Deposit	concept and version DOI minted; registry pointer set	at release
Succession	the 2027 lifeline systems edition reports changes against this baseline	2027

Current version: v1.0.0 draft, stewardship review
Previous edition: none, first edition of the series
Next edition: NR-STRATEGIC-LIFELINES-GLOBAL-2027-v1.0.0

Latest version: resolve the concept DOI or the registry record
Correction route: Registry correction pathway
Notice types: erratum · addendum · supersession · withdrawal

C.3Corrections log

0correction notices. No edition has been released yet, so none can be corrected; the log below lists each edition’s current version.

Edition	Version	Date	State	Change	Notice
SR-02	NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-v1.0.0	October 2026	Draft	Baseline Edition 2026, inaugural annual edition,	None

Notice types: erratum, addendum, supersession, withdrawal. A correction is a new version with a published notice; the earlier version stays resolvable, and no edition is ever edited in silence.

C.4Open record

This edition’s open record

Publication ID: NR-STRATEGIC-LIFELINES-GLOBAL-2026-BASELINE-v1.0.0
Desk identifier and series alias: NR-STR-SR-02-2026-BL
Collection: None
DOI: Concept and version DOI at deposit, on Zenodo with DataCite metadata
Versions: Each correction is a new version (isNewVersionOf); the concept DOI resolves to the latest
Bundle: RO-Crate 1.2 with CITATION.cff, CodeMeta and PROV-O provenance; a signed manifest
Licence: CC BY 4.0 (SPDX CC-BY-4.0) for original material; metadata CC0 1.0

Credit and identity

ORCID: Your iD in the deposit and the contribution record; DataCite can then add the work to your ORCID record
ROR: Your organisation by its ROR identifier, never by a typed name alone
CRediT: Conceptualization, Data curation, Formal analysis, Investigation, Methodology, Software, Validation, Visualisation, Writing, review and editing
Account: None needed to contribute; never a password

Find and follow

Search the open indexes for Critical Infrastructure and Lifeline Systems; software is cited by its SWHID from Software Heritage, and a quantified scenario run is preregistered on OSF before it is run. Annotation is your choice: Hypothesis opens this page in its own viewer.

Mirrors and harvest

The DOI is canonical. At release each signed bundle is also given an IPFS content identifier and a bloxberg anchor as mirrors; both are listed in the record once they exist. Zenodo exposes every record over OAI-PMH, and reviews and endorsements can arrive through COAR Notify where the repository supports it.

InvenioRDM metadata for a contribution on Critical Infrastructure and Lifeline Systems, prefilled from this page

{
  "metadata": {
    "resource_type": {
      "id": "dataset"
    },
    "title": "Evidence on Critical Infrastructure and Lifeline Systems for Nexus Reports",
    "publication_date": "YYYY-MM-DD",
    "creators": [
      {
        "person_or_org": {
          "type": "personal",
          "family_name": "Your family name",
          "given_name": "Your given name",
          "identifiers": [
            {
              "scheme": "orcid",
              "identifier": "0000-0000-0000-0000"
            }
          ]
        },
        "affiliations": [
          {
            "id": "ROR identifier of your organisation"
          }
        ]
      }
    ],
    "description": "What it is, where its record is kept and how it bears on Strategic Systems Report 2026: Critical Infrastructure and Lifeline Systems.",
    "rights": [
      {
        "id": "cc-by-4.0"
      }
    ],
    "subjects": [
      {
        "subject": "Nexus Reports"
      },
      {
        "subject": "Critical Infrastructure and Lifeline Systems"
      },
      {
        "subject": "Strategic Systems Report · SR-02"
      }
    ],
    "related_identifiers": [
      {
        "identifier": "https://therisk.global/nexus-reports/editions/sr-02/",
        "scheme": "url",
        "relation_type": {
          "id": "issupplementto"
        },
        "resource_type": {
          "id": "publication-report"
        }
      }
    ],
    "version": "1.0.0"
  },
  "custom_fields": {},
  "access": {
    "record": "public",
    "files": "public"
  },
  "files": {
    "enabled": true
  },
  "parent": {
    "communities": {
      "default": "nexusreports"
    }
  }
}

C.5Where this edition sits among the six pillars

Foundry seals the evidence and Universe tests it; Reports publishes it; Standards takes its corrections and Academy teaches from it.

F03 Sealed observations and indicator series Foundry Sealed observations and indicator series behind a profile (closeout).
F04 After-action and scenario findings for Universe After-action and scenario findings for chapters 10 and 13 (after action review).
F05 National Portfolio movement for chapter Foundry National Portfolio movement for chapter 11 (after action review).
Applied in editions Standards Nexus Standards: applied in editions.
SR-02 edition Reports Critical Infrastructure and Lifeline Systems 2026, published in every format with its sources, citation and corrections.
F06 Method and correction findings as change Standards Method and correction findings as change proposals (correction).
F12 Q4 synthesis informs the next-year Universe Q4 synthesis informs the next-year mandate (renewal).
Taught in the open Academy Risk Academy: taught in the open.

What Foundry and Universe hand to this edition, and what it hands to Standards, Universe and Academy. From the programme spine; SR-02 is a drafted Baseline Edition, so these handoffs run from its first operational quarter.

Handoff	Between	What crosses, and when
F03	Foundry to Reports	Sealed observations and indicator series behind a profile (closeout).
F04	Universe to Reports	After-action and scenario findings for chapters 10 and 13 (after action review).
F05	Foundry to Reports	National Portfolio movement for chapter 11 (after action review).
Ring	Nexus Standards to Reports	Nexus Standards: applied in editions.
F06	Reports to Nexus Standards	Method and correction findings as change proposals (correction).
F12	Reports to Universe	Q4 synthesis informs the next-year mandate (renewal).
Ring	Reports to Risk Academy	Risk Academy: taught in the open.

S.1Abstract

S.2Key messages

S.3Headline finding

S.4At a glance

S.5What each steward reads in it

Technical Truth

Public Meaning

Capital Meaning

Synthesis

S.6What this edition is, and is not

What this edition is

What it is not

What comes next

Notes

1.1The questions this part answers

Key questions

In this part

1.2The argument

1.3Twenty couplings between five systems

Transmission paths

1.4Reinforcing loops

Notes

2.1Headline finding

Implication

What would move it

2.2Infrastructure

2.3CYB

2.4Data and digital

2.5Climate forcing

2.6Development

2.7CON

2.8AIC

2.9Systemic

Notes

3.1Where each system stood at evidence close

Iberian blackout, interacting causes

Windows devices hit by one update

Cable faults a year, average

US ten-year infrastructure gap

Annual loss to critical infrastructure, three hazards

Ukraine recovery needs, ten years

3.2Domain posture

3.3Sector screens

Notes

4.1Risk objects

Grid failure with telecom and water knock-on

Pre-positioned access in operator networks

Common-vendor software failure

Subsea link loss with limited repair capacity

4.2Capability ladder

Notes

5.1Assumptions

5.2The cascade, step by step

5.3The scenario as a table of steps

Notes

6.1The other desks’ editions of this subject

6.2Three lenses

Technical Truth

Public Meaning

Capital Meaning

Synthesis

6.3Standards, Academy and steward contributions

Standards drafts used in this edition

Standards calendar to watch

6.4GCRI reading: the model card

6.5Global Risks Forum reading: editorial essays

EDITORIAL ESSAY · 01

EDITORIAL ESSAY · 02

EDITORIAL ESSAY · 03

EDITORIAL ESSAY · 04

6.6Global Risks Alliance reading: 2027 lifeline systems readiness pack

Publication dispositions

6.7Nexus Standards reading: standards and regulatory watch

Changed since 2024

To watch in 2027

6.8Risk Academy reading: literature and evidence review, science and assessments

Review protocol

Where the evidence agrees

Where it is unsettled

Notes