Readings from the other desks
The global baseline is read through each steward’s lens, then once as a whole. Each lens is a projection of reviewed findings, not a separate argument. The other desks’ own editions of this subject are listed first, as cross-references, not copies.
Contents
- ·Edition home
- ·Executive summary
- 1Lifelines fail together
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Power loss that overlaps a telecom or cloud failure
- 6Readings from the other desks
- 6.1 The other desks’ editions of this subject
- 6.2 Three lenses
- 6.3 Standards, Academy and steward contributions
- 6.4 GCRI reading: the model card
- 6.5 Global Risks Forum reading: editorial essays
- 6.6 Global Risks Alliance reading: 2027 lifeline systems readiness pack
- 6.7 Nexus Standards reading: standards and regulatory watch
- 6.8 Risk Academy reading: literature and evidence review, science and assessments
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
6.1The other desks’ editions of this subject
Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.
| Desk | Edition | State | Identifier |
|---|---|---|---|
| GCRI Systems Evidence | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| GRF Public Deliberation | Outside this desk’s remit | Not in remit | |
| GRA Capital Readiness | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Standards Progress | Outside this desk’s remit | Not in remit | |
| Academy Capability | Outside this desk’s remit | Not in remit | |
| Index Measurement | Outside this desk’s remit | Not in remit |
6.2Three lenses
One edition, read by each steward. The lens of this site comes first.
GCRI · KEY T
Technical Truth
The evidence supports reading lifelines as one dependent network. Common causes recur across sectors, failures spread through shared dependence on power, telecoms and software, and recovery is limited by thresholds such as black-start capability and repair capacity. Evidence is strongest for single events and weakest for cross-sector dependency data.
INF-001 · CYB-002 · DAT-004 · SYS-012
GRF · KEY M
Public Meaning
For most people lifeline failure arrives as a dark home, a dry tap or a card that will not work. The baseline asks that public debate treat infrastructure as shared and interdependent, and keep recovery, not only prevention, in view.
INF-001 · DAT-004 · DEV-008
GRA · KEY F
Capital Meaning
Readiness implications only. Disruption is costly, resilient options are reported to return several times their cost, and the investment gap is large in places116. These show where finance-readiness evidence will matter. Nothing here is advice, a rating or an approval.
INF-005 · DEV-008
NEXUS
Synthesis
Lifeline risk is well described event by event and thinly measured as a system. The 2027 programme should bind dependency data, test the power and telecom compound loss, and map recovery thresholds before the next large event.
SYS-012 · L-01 · L-03
6.3Standards, Academy and steward contributions
How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for lifeline systems. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.
| Quarter | Edition | Question | Boundary |
|---|---|---|---|
| Q1 | State and Agenda | What matters this year, and what is the starting position? | observed baseline stays distinct from planned work |
| Q2 | Evidence and Build | What new evidence and capability exist? | a configured capability is not a validated result |
| Q3 | Stress Test and Readiness | What do scenarios and tests show? | simulated loss or performance is not observed impact |
| Q4 | Annual Synthesis and Renewal | What changed in the year, and what renews? | release follows review, not event publicity deadlines |
| Steward or body | Role | Contribution route |
|---|---|---|
| The Global Centre for Risk and Innovation (GCRI Canada) | Lead Institution and Consortium Secretariat; publisher of record; technical truth (key T) | science and practice communities · GCRI gateway |
| The Global Risks Forum (GRF) | leadership, dialogue and the Universe programme; public meaning (key M) | policy, Universe and national adoption · GRF gateway |
| The Global Risks Alliance (GRA) | finance, insurance and development readiness; capital meaning (key F) | finance and insurance · GRA gateway |
| Nexus Standards | preparatory drafts on vocabulary, hazards, indicators and methods | Standards site · working groups HAZ, IND, MTH, FIN, AI |
| Risk Academy | learning pathways tied to the agenda questions | Academy gateway · learning by review |
| Reports strategic desks | lifeline chapter inputs: GCRI evidence and GRA readiness | strategic editorial board |
Standards drafts used in this edition
- Risk vocabulary NRS-C1 (424 terms) for terms in the glossary
- Hazard atlas NHS-1 1.1.0 (905 hazards in 120 families) for risk objects
- Seven risk classes: global, catastrophic, existential, emerging, planetary, exponential, frontier-tech
Standards calendar to watch
- Founding calls from 20 October 2026; working groups meet from 5 November 2026
- Inaugural Global Standards Council session, 12 January 2027
- Quarterly reviews in March, June, September and December, aligned with each edition
6.4GCRI reading: the model card
GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology
6.5Global Risks Forum reading: editorial essays
Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.
Power runs the exchanges, the exchanges run the control systems, and software runs both. Treating each sector alone understates how a fault in one becomes a fault in all. This edition reads the network.
EDITORIAL ESSAY · 01
Lifelines are one network
Prevention fails sometimes. Restoration after the Iberian blackout and the 2024 software outage shows that recovery capability is a distinct and measurable asset.
EDITORIAL ESSAY · 02
Recovery is part of resilience
Agency reporting describes long-lived access to operator networks rather than visible outages. The risk is a capability held in reserve, which is hard to count and easy to underestimate.
EDITORIAL ESSAY · 03
Cyber evidence is mostly about access
The investment gap is large, and resilient options are reported to return several times their cost. Yet maintenance, coordination and data matter at least as much as capital.
EDITORIAL ESSAY · 04
Money is not the whole answer
6.6Global Risks Alliance reading: 2027 lifeline systems readiness pack
The registers that open the 2027 global cycle. At baseline each is initialised from this edition.
| Item | Register | State at baseline | First 2027 entry |
|---|---|---|---|
| E1 | Global risk state delta | baseline set by this edition | changes against the baseline |
| E2 | WEFH+B state delta | five global system readings set | indicator updates and freshness |
| E3 | Agenda and Portfolio movement | eight agenda items · 6 proposed objects | admission decisions |
| E4 | Federation delivery register | national chapters in preparation | national chapters |
| E5 | Consortium capability register | national consortia forming | first contributions |
| E6 | Leadership questions and challenges | none yet | first challenge log |
| E7 | Foundry technical state | national environments prepared | first federation cut |
| E8 | Publication candidates | twelve findings carried forward | PUBLISH · HOLD dispositions |
| E9 | Universe readiness | one candidate mission | admission and role spine |
| E10 | Correction register | none | first federation-wide cycle |
Publication dispositions
- Publish
- Hold
- Needs evidence
- Restricted
- Superseded
6.7Nexus Standards reading: standards and regulatory watch
Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.
- IN FORCE
- ADOPTED
- PUBLISHED · GUIDANCE
- PUBLISHED · VOLUNTARY
| Instrument | Body | Scope | Status | Relevance |
|---|---|---|---|---|
| Critical Entities Resilience Directive16 | European Union | EU | IN FORCE | critical entities |
| NIS2 Directive17 | European Union | EU | IN FORCE | network security |
| National Security Memorandum 2218 | United States | US | ISSUED 2024 | infrastructure security |
| Sendai Framework 2015 to 203019 | UNDRR | global | ADOPTED 2015 | infrastructure damage target |
| NIST Cybersecurity Framework 2.05 | NIST | global use | PUBLISHED · VOLUNTARY | cyber risk |
| ISO/IEC 27001 information security21 | ISO | global | PUBLISHED · VOLUNTARY | security management |
| ISO 31000 risk management27 | ISO | global | PUBLISHED · VOLUNTARY | risk process |
| Cross-Sector Cybersecurity Performance Goals26 | CISA | US | PUBLISHED · GUIDANCE | baseline practices |
| ISO 22301 business continuity20 | ISO | global | PUBLISHED · VOLUNTARY | continuity |
| IEC 62443 control-system security22 | IEC | global | PUBLISHED · VOLUNTARY | operational technology |
| UN Convention on the Law of the Sea, articles 112 to 11524 | United Nations | global | IN FORCE | submarine cables |
Changed since 2024
6.8Risk Academy reading: literature and evidence review, science and assessments
The review behind this edition covers lifeline systems assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.
Review protocol
- Question
- What does the published evidence establish about the world’s critical infrastructure and lifeline systems and its couplings?
- Sources searched
- agency advisories; operator and regulator reports; peer-reviewed interdependency literature; loss statistics
- Window
- releases available at evidence close, 30 September 2026
- Selection
- sources that bind or contextualise a finding in this edition
- Next step
- systematic reviews for agenda items 01 to 05 in 2027
| Reference | Type | Year | Role | Used for |
|---|---|---|---|---|
| Rinaldi, Peerenboom and Kelly28 | journal article | 2001 | framework | interdependencies |
| Buldyrev et al.29 | journal article | 2010 | supports | cascading failure |
| Koks et al.30 | journal article | 2019 | supports | transport hazard risk |
| Helbing33 | journal article | 2013 | framework | networked risk |
| Perrow, Normal Accidents34 | book | 1984 | framework | tight coupling |
| Zscheischler et al.32 | journal article | 2018 | framework | compound events |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Iberian blackout final report1 | ENTSO-E | 2026 | supports | grid failure |
| Joint cybersecurity advisory AA24-038A2 | CISA and partners | 2024 | supports | pre-positioning |
| ENISA Threat Landscape 20253 | ENISA | 2025 | supports | incident counts |
| GAR 202510 | UNDRR | 2025 | supports | hazard losses |
| GAR 202237 | UNDRR | 2022 | context | systemic risk |
| Lifelines11 | World Bank and GFDRR | 2019 | supports | disruption cost |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| 2025 Report Card6 | ASCE | 2025 | supports | asset condition |
| RDNA512 | World Bank, UN, EU | 2026 | supports | reconstruction needs |
| Building Back Better31 | World Bank | 2018 | context | recovery |
| Energy and AI8 | IEA | 2025 | supports | load clusters |
| Electricity Grids and Secure Energy Transitions35 | IEA | 2023 | context | grid needs |
| Climate Resilience for Energy Security39 | IEA | 2022 | context | resilience |
| Global Critical Minerals Outlook 202640 | IEA | 2026 | supports | mineral concentration |
| Global Energy Review 20269 | IEA | 2026 | supports | electricity growth |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Microsoft statement on the 2024 outage4 | Microsoft | 2024 | supports | software failure |
| Root cause analysis36 | CrowdStrike | 2024 | context | software failure |
| Cable fault analysis7 | TeleGeography | 2024 | supports | subsea faults |
| Cable maintenance data15 | TeleGeography | 2025 | context | repair ships |
| Annual Outage Analysis 202614 | Uptime Institute | 2026 | context | outage cost |
| EU Action Plan on Cable Security38 | European Commission | 2025 | context | cable policy |
| Gulf desalination reporting13 | press and think tanks | 2026 | context | strikes on plants |
Where the evidence agrees
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 11UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Rozenberg, J., Lifelines: The Resilient Infrastructure Opportunity (disruptions cost at least USD 390 billion a year in low- and middle-income countries; USD 4.2 trillion net benefit; about USD 4 per USD 1), taken from search-result summaries; the repository returned an access error. World Bank and GFDRR, Washington, 2019. Observation year 2019. Accessed 2026-11-03.back
- 6ASCE (ed.), 2025 Report Card for America’s Infrastructure (overall grade C; ten-year investment gap USD 3.6 trillion; sector grades). American Society of Civil Engineers, Reston. Observation year 2025. Accessed 2026-11-03.back
- 16UNVERIFIED, not opened: Directive (EU) 2022/2557 on the resilience of critical entities, Official Journal of the European Union, 2022, cited from memory; the EUR-Lex request returned no text. Observation year 2022. Accessed 2026-11-03.back
- 17UNVERIFIED, not opened: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2), Official Journal of the European Union, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
- 18UNVERIFIED, not opened: The White House, National Security Memorandum on Critical Infrastructure Security and Resilience (NSM-22), 30 April 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
- 19UNVERIFIED, not opened: UNDRR (ed.), Sendai Framework for Disaster Risk Reduction 2015 to 2030 (target on damage to critical infrastructure), cited from memory. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2015. Accessed 2026-11-03.back
- 5NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024. National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
- 21UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
- 27UNVERIFIED, not opened: ISO 31000:2018, Risk management: guidelines. International Organization for Standardization, Geneva. Observation year 2018. Accessed 2026-11-03.back
- 26UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals. Cybersecurity and Infrastructure Security Agency, Arlington, cited from memory. Observation year 2022. Accessed 2026-11-03.back
- 20UNVERIFIED, not opened: ISO 22301:2019, Security and resilience: business continuity management systems. International Organization for Standardization, Geneva. Observation year 2019. Accessed 2026-11-03.back
- 22UNVERIFIED, not opened: IEC 62443 series, Security for industrial automation and control systems. International Electrotechnical Commission, Geneva. Observation year 2018. Accessed 2026-11-03.back
- 24UNVERIFIED, not opened: United Nations Convention on the Law of the Sea (1982), articles 112 to 115 on submarine cables and pipelines, cited from memory. United Nations, New York. Observation year 1982. Accessed 2026-11-03.back
- 1ENTSO-E (ed.), 28 April 2025 Iberian blackout: final report of the expert panel (publication page; report dated 20 March 2026). ENTSO-E, Brussels. Observation year 2025. Accessed 2026-11-03.back
- 38UNVERIFIED, not opened: European Commission and High Representative, Joint Communication on an EU Action Plan on Cable Security, February 2025, cited from memory. Observation year 2025. Accessed 2026-11-03.back
- 25UNVERIFIED, not opened: Protocol Additional to the Geneva Conventions of 12 August 1949 relating to the Protection of Victims of International Armed Conflicts (Protocol I), articles 54 and 56 on objects indispensable to survival and works containing dangerous forces, cited from memory. International Committee of the Red Cross, Geneva. Observation year 1977. Accessed 2026-11-03.back
- 28UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
- 29UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
- 30UNVERIFIED, not opened: Koks, E.E. et al., A global multi-hazard risk analysis of road and railway infrastructure assets, Nature Communications 10, 2677, 2019, cited from memory. Springer Nature. Observation year 2019. Accessed 2026-11-03.back
- 33UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back
- 34UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03.back
- 32UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03.back
- 2CISA, NSA, FBI and partner agencies (eds.), PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (Volt Typhoon), joint cybersecurity advisory AA24-038A, 7 February 2024. CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
- 3ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
- 10UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2025: Resilience Pays (annual average loss to critical infrastructure above USD 250 billion for floods, tropical cyclones and earthquakes; about USD 2.3 trillion total annual disaster cost), taken from search-result summaries; the report page returned an access error. United Nations Office for Disaster Risk Reduction, Geneva. Observation year 2025. Accessed 2026-11-03.back
- 37UNVERIFIED, not opened: UNDRR (ed.), Global Assessment Report on Disaster Risk Reduction 2022: Our World at Risk. United Nations Office for Disaster Risk Reduction, Geneva, cited from memory. Observation year 2022. Accessed 2026-11-03.back
- 12UNVERIFIED, not opened: World Bank, United Nations and European Commission (eds.), Ukraine Fifth Rapid Damage and Needs Assessment (RDNA5), released 23 February 2026 (needs USD 587.7 billion over ten years; energy about USD 91 billion; direct damage to energy and extractives USD 24.8 billion to end 2025), taken from search-result summaries. Observation year 2025. Accessed 2026-11-03.back
- 31UNVERIFIED, not opened: Hallegatte, S., Rentschler, J. and Walsh, B., Building Back Better: Achieving Resilience through Stronger, Faster, and More Inclusive Post-Disaster Reconstruction. World Bank, Washington, 2018, cited from memory. Observation year 2018. Accessed 2026-11-03.back
- 8IEA (ed.), Energy and AI (World Energy Outlook Special Report). International Energy Agency, Paris, April 2025. Observation year 2024. Accessed 2026-11-03.back
- 35UNVERIFIED, not opened: IEA (ed.), Electricity Grids and Secure Energy Transitions. International Energy Agency, Paris, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
- 39UNVERIFIED, not opened: IEA (ed.), Climate Resilience for Energy Security. International Energy Agency, Paris, 2022, cited from memory. Observation year 2022. Accessed 2026-11-03.back
- 40IEA (ed.), Global Critical Minerals Outlook 2026 (revised version, July 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
- 9IEA (ed.), Global Energy Review 2026 (revised version, May 2026). International Energy Agency, Paris. Observation year 2025. Accessed 2026-11-03.back
- 4Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
- 36UNVERIFIED, not opened: CrowdStrike (ed.), External technical root cause analysis for the Channel File 291 incident, August 2024, cited from memory; no figure used. CrowdStrike, Austin. Observation year 2024. Accessed 2026-11-03.back
- 7TeleGeography (ed.), Is it sabotage? Unraveling the mystery of undersea cable breaks (analysis of 199 faults a year, 2010 to 2023). TeleGeography, Washington. Observation year 2024. Accessed 2026-11-03.back
- 15UNVERIFIED, not opened: TeleGeography (ed.), submarine cable maintenance data (June 2025; about two thirds of repair ships reach end of service life by 2040), taken from search-result summaries. TeleGeography, Washington. Observation year 2025. Accessed 2026-11-03.back
- 14UNVERIFIED, not opened: Uptime Institute (ed.), Annual Outage Analysis 2026 (57% of respondents in the 2025 survey reported a latest major outage above USD 100,000), taken from a press release summary; the report is limited to members. Uptime Institute, New York. Observation year 2025. Accessed 2026-11-03.back
- 13UNVERIFIED, not opened: press and think-tank reports on strikes on power and desalination plants in Kuwait, Bahrain and the United Arab Emirates, March to July 2026 (including The National, Arab News and the Arab Center Washington DC), taken from search-result summaries; no official damage assessment was found. Observation year 2026. Accessed 2026-11-03.back