Readings from the other desks
The global baseline is read through each steward’s lens, then once as a whole. Each lens is a projection of reviewed findings, not a separate argument. The other desks’ own editions of this subject are listed first, as cross-references, not copies.
Contents
- ·Edition home
- ·Executive summary
- 1Digital systems fail together
- 2Key findings
- 3Systems and sectors at baseline
- 4Risks and capability
- 5Shared provider failure that overlaps a power or network loss
- 6Readings from the other desks
- 6.1 The other desks’ editions of this subject
- 6.2 Three lenses
- 6.3 Standards, Academy and steward contributions
- 6.4 GCRI reading: the model card
- 6.5 Global Risks Forum reading: editorial essays
- 6.6 Global Risks Alliance reading: 2027 digital public infrastructure readiness pack
- 6.7 Nexus Standards reading: standards and regulatory watch
- 6.8 Risk Academy reading: literature and evidence review, science and assessments
- 7The 2027 agenda
- 8Systems in depth
- AMethodology
- BData appendix
- CReferences and record
- ·Complete edition, for print
6.1The other desks’ editions of this subject
Federation: each desk writes its own edition for the subjects in its remit. Until a desk releases, its edition shows its frame and the reading this edition printed for it.
| Desk | Edition | State | Identifier |
|---|---|---|---|
| GCRI Systems Evidence | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| GRF Public Deliberation | Outside this desk’s remit | Not in remit | |
| GRA Capital Readiness | No edition of this subject at this desk in the 2026 Baseline cycle | Not in this cycle | |
| Standards Progress | Outside this desk’s remit | Not in remit | |
| Academy Capability | Outside this desk’s remit | Not in remit | |
| Index Measurement | Outside this desk’s remit | Not in remit |
6.2Three lenses
One edition, read by each steward. The lens of this site comes first.
GCRI · KEY T
Technical Truth
The evidence supports reading digital public infrastructure as one dependent stack. Common causes recur across providers, failures spread through shared software, cloud and edge layers, and recovery depends on thresholds such as fallback paths and restoration practice. Evidence is strongest for single events and weakest for cross-layer dependency data.
DAT-001 · DAT-002 · CYB-004 · SYS-012
GRF · KEY M
Public Meaning
For most people digital failure arrives as a card that will not work, an app that will not load or an office that has stopped. The baseline asks that public debate treat digital services as shared and keep offline access and recovery, not only prevention, in view.
DAT-001 · DAT-003 · DEV-009
GRA · KEY F
Capital Meaning
Readiness implications only. A single event can carry large losses, as the 2025 manufacturer case shows, and large payment flows run on shared rails91314. These show where finance-readiness evidence will matter. Nothing here is advice, a rating or an approval.
FIN-008 · FIN-010
NEXUS
Synthesis
Digital risk is well described event by event and thinly measured as a system. The 2027 programme should bind dependency data, test the shared provider and power compound loss, and map recovery thresholds before the next large event.
SYS-012 · D-01 · D-03
6.3Standards, Academy and steward contributions
How the Nexus Standards drafts, the Risk Academy and the three stewards feed each quarterly edition for digital public infrastructure. The standards are a preparatory working draft (2026) and are cited as drafts, never as adopted standards.
| Quarter | Edition | Question | Boundary |
|---|---|---|---|
| Q1 | State and Agenda | What matters this year, and what is the starting position? | observed baseline stays distinct from planned work |
| Q2 | Evidence and Build | What new evidence and capability exist? | a configured capability is not a validated result |
| Q3 | Stress Test and Readiness | What do scenarios and tests show? | simulated loss or performance is not observed impact |
| Q4 | Annual Synthesis and Renewal | What changed in the year, and what renews? | release follows review, not event publicity deadlines |
| Steward or body | Role | Contribution route |
|---|---|---|
| The Global Centre for Risk and Innovation (GCRI Canada) | Lead Institution and Consortium Secretariat; publisher of record; technical truth (key T) | science and practice communities · GCRI gateway |
| The Global Risks Forum (GRF) | leadership, dialogue and the Universe programme; public meaning (key M) | policy, Universe and national adoption · GRF gateway |
| The Global Risks Alliance (GRA) | finance, insurance and development readiness; capital meaning (key F) | finance and insurance · GRA gateway |
| Nexus Standards | preparatory drafts on vocabulary, hazards, indicators and methods | Standards site · working groups HAZ, IND, MTH, FIN, AI |
| Risk Academy | learning pathways tied to the agenda questions | Academy gateway · learning by review |
| Reports strategic desks | digital chapter inputs: GCRI evidence and GRA readiness | strategic editorial board |
Standards drafts used in this edition
- Risk vocabulary NRS-C1 (424 terms) for terms in the glossary
- Hazard atlas NHS-1 1.1.0 (905 hazards in 120 families) for risk objects
- Seven risk classes: global, catastrophic, existential, emerging, planetary, exponential, frontier-tech
Standards calendar to watch
- Founding calls from 20 October 2026; working groups meet from 5 November 2026
- Inaugural Global Standards Council session, 12 January 2027
- Quarterly reviews in March, June, September and December, aligned with each edition
6.4GCRI reading: the model card
GCRI’s reading of this edition is its model card: what the national model is, what it computes and where it stops. It is printed in full in Annex A, with the methods it belongs to. Annex A, methodology
6.5Global Risks Forum reading: editorial essays
Four signed essays by the Reports editorial team set out the positions this edition takes. They are interpretation, labelled as such; the evidence they draw on is in the findings register.
Identity, payments and data exchange run on cloud, software and edge layers. Treating each layer alone understates how a fault in one becomes a fault in all. This edition reads the stack.
EDITORIAL ESSAY · 01
Digital systems are one stack
Prevention fails sometimes. The published timelines for the 2025 cloud and edge events show that restoration practice is a distinct and measurable asset.
EDITORIAL ESSAY · 02
Recovery is part of resilience
Agency reporting describes long-lived access to operator networks rather than visible outages. The risk is a capability held in reserve, which is hard to count and easy to underestimate.
EDITORIAL ESSAY · 03
Cyber evidence is mostly about access
A data-exchange layer that signs and encrypts what it sends reduces one kind of risk. It does not reach the 2.2 billion people who are offline, and safeguards must cover both.
EDITORIAL ESSAY · 04
Design and inclusion travel together
6.6Global Risks Alliance reading: 2027 digital public infrastructure readiness pack
The registers that open the 2027 global cycle. At baseline each is initialised from this edition.
| Item | Register | State at baseline | First 2027 entry |
|---|---|---|---|
| E1 | Global risk state delta | baseline set by this edition | changes against the baseline |
| E2 | WEFH+B state delta | five global system readings set | indicator updates and freshness |
| E3 | Agenda and Portfolio movement | eight agenda items · 6 proposed objects | admission decisions |
| E4 | Federation delivery register | national chapters in preparation | national chapters |
| E5 | Consortium capability register | national consortia forming | first contributions |
| E6 | Leadership questions and challenges | none yet | first challenge log |
| E7 | Foundry technical state | national environments prepared | first federation cut |
| E8 | Publication candidates | twelve findings carried forward | PUBLISH · HOLD dispositions |
| E9 | Universe readiness | one candidate mission | admission and role spine |
| E10 | Correction register | none | first federation-wide cycle |
Publication dispositions
- Publish
- Hold
- Needs evidence
- Restricted
- Superseded
6.7Nexus Standards reading: standards and regulatory watch
Instruments and published guidance that shape the systems in this edition, by status on the retrieval date. The edition assesses no one’s compliance.
- IN FORCE
- ADOPTED
- PUBLISHED · GUIDANCE
- PUBLISHED · VOLUNTARY
| Instrument | Body | Scope | Status | Relevance |
|---|---|---|---|---|
| NIS2 Directive18 | European Union | EU | IN FORCE | network security |
| Digital Operational Resilience Act19 | European Union | EU | APPLIED 2025 | financial sector ICT risk |
| Cyber Resilience Act29 | European Union | EU | IN FORCE | products with digital elements |
| European Digital Identity Framework30 | European Union | EU | IN FORCE | digital identity wallets |
| UN Convention against Cybercrime1743 | United Nations | global | OPEN FOR SIGNATURE | cybercrime cooperation |
| Global Digital Compact16 | United Nations | global | ADOPTED 2024 | digital public infrastructure |
| Universal DPI Safeguards Framework32 | UNDP and partners | global | PUBLISHED · GUIDANCE | safeguards |
| NIST Cybersecurity Framework 2.024 | NIST | global use | PUBLISHED · VOLUNTARY | cyber risk |
| ISO/IEC 27001 information security31 | ISO | global | PUBLISHED · VOLUNTARY | security management |
| Cross-Sector Cybersecurity Performance Goals42 | CISA | US | PUBLISHED · GUIDANCE | baseline practices |
| Recommendation on Digital Security of Critical Activities41 | OECD | global | ADOPTED 2019 | digital security |
Changed since 2024
6.8Risk Academy reading: literature and evidence review, science and assessments
The review behind this edition covers digital public infrastructure assessments, peer-reviewed science and the institutional reports that bind its findings. Systematic reviews for each agenda item begin in 2027.
Review protocol
- Question
- What does the published evidence establish about the world’s digital public infrastructure and systemic cyber risk and its couplings?
- Sources searched
- agency advisories; provider post-incident reports; peer-reviewed interdependency literature; access and payment statistics
- Window
- releases available at evidence close, 30 September 2026
- Selection
- sources that bind or contextualise a finding in this edition
- Next step
- systematic reviews for agenda items 01 to 05 in 2027
| Reference | Type | Year | Role | Used for |
|---|---|---|---|---|
| Rinaldi, Peerenboom and Kelly34 | journal article | 2001 | framework | interdependencies |
| Buldyrev et al.35 | journal article | 2010 | supports | cascading failure |
| Helbing37 | journal article | 2013 | framework | networked risk |
| Perrow, Normal Accidents36 | book | 1984 | framework | tight coupling |
| Zscheischler et al.38 | journal article | 2018 | framework | compound events |
| Tikk, Kaska and Vihul33 | report | 2010 | context | national-scale cyber incident |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| ENISA Threat Landscape 20251 | ENISA | 2025 | supports | incident counts |
| ENISA Threat Landscape 20242 | ENISA | 2024 | context | prime threats |
| Joint cybersecurity advisory AA24-038A6 | CISA and partners | 2024 | supports | pre-positioning |
| Joint cybersecurity advisory AA25-239A7 | CISA and partners | 2025 | supports | telecom campaign |
| Annual Review 20258 | UK NCSC | 2025 | supports | incident load |
| Global Financial Stability Report, April 202423 | IMF | 2024 | context | cyber risk and finance |
| Global Digital Compact16 | United Nations | 2024 | context | digital public infrastructure |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Facts and Figures 202510 | ITU | 2025 | supports | offline population |
| Facts and Figures 202611 | ITU | 2026 | context | newer estimates |
| Global Findex 202512 | World Bank | 2025 | supports | account ownership |
| ID4D Global Dataset 202126 | World Bank | 2022 | context | people without identity |
| UPI statistics report13 | NPCI data | 2025 | supports | payment volume |
| Pix daily record report14 | Banco Central do Brasil data | 2025 | supports | payment peak |
| Cost of a Data Breach 202621 | IBM | 2026 | context | breach cost |
| Data Breach Investigations Report 202622 | Verizon | 2026 | context | initial access |
| Reference | Issuer | Year | Role | Used for |
|---|---|---|---|---|
| Microsoft statement on the 2024 outage3 | Microsoft | 2024 | supports | software failure |
| Post-event summary, October 20254 | Amazon Web Services | 2025 | supports | cloud failure |
| Outage report, 18 November 20255 | Cloudflare | 2025 | supports | edge failure |
| X-Road programme page15 | e-Estonia | 2025 | supports | data exchange |
| Cyber event statement9 | Cyber Monitoring Centre | 2025 | supports | event loss |
| Log4j review39 | Cyber Safety Review Board | 2022 | context | shared software |
| Costa Rica emergency report25 | press | 2022 | context | public-sector ransomware |
Where the evidence agrees
Notes
Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references
- 9Infosecurity Magazine, JLR hack UK’s costliest ever, hitting economy with GBP 1.9bn loss (press report of the Cyber Monitoring Centre statement of 22 October 2025; Category 3; over 5,000 organisations); the Cyber Monitoring Centre statement itself returned an error and was not opened. Observation year 2025. Accessed 2026-11-03.back
- 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
- 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
- 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
- 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
- 29UNVERIFIED, not opened: Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act), Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
- 30UNVERIFIED, not opened: Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework, Official Journal of the European Union, 2024, cited from memory. Observation year 2024. Accessed 2026-11-03.back
- 17United Nations Office of Legal Affairs (ed.), United Nations Convention against Cybercrime (treaty page: signing ceremony in Hanoi on 25 and 26 October 2025; seventy-one States and the European Union; article 65, entry into force on the ninetieth day after the fortieth instrument of ratification). United Nations, New York. Observation year 2025. Accessed 2026-11-03.back
- 43UNVERIFIED, not opened: United Nations General Assembly, resolution adopting the United Nations Convention against Cybercrime (December 2024), cited from memory; the resolution number is not stated. United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
- 16United Nations (ed.), Global Digital Compact (programme page; negotiated by 193 Member States; opened for endorsement in September 2024; commitment to increase investment in digital public goods and digital public infrastructure). United Nations, New York. Observation year 2024. Accessed 2026-11-03.back
- 32UNVERIFIED, not opened: United Nations Development Programme and partners, Universal Digital Public Infrastructure Safeguards Framework, 2023, cited from memory. Observation year 2023. Accessed 2026-11-03.back
- 24NIST (ed.), The NIST Cybersecurity Framework (CSF) 2.0 (programme page; two-year anniversary note of 24 February 2026; intended for industry, government and organisations). National Institute of Standards and Technology, Gaithersburg. Observation year 2024. Accessed 2026-11-03.back
- 31UNVERIFIED, not opened: ISO/IEC 27001:2022, Information security management systems. International Organization for Standardization, Geneva. Observation year 2022. Accessed 2026-11-03.back
- 42UNVERIFIED, not opened: CISA (ed.), Cross-Sector Cybersecurity Performance Goals, cited from memory. Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2022. Accessed 2026-11-03.back
- 41UNVERIFIED, not opened: OECD, Recommendation of the Council on Digital Security of Critical Activities, 2019, cited from memory. OECD Publishing, Paris. Observation year 2019. Accessed 2026-11-03.back
- 27UNVERIFIED, not opened: G20, New Delhi Leaders’ Declaration, 9 to 10 September 2023 (welcomed the G20 Framework for Systems of Digital Public Infrastructure and a global repository of digital public infrastructure), taken from press coverage of the declaration. Observation year 2023. Accessed 2026-11-03.back
- 40UNVERIFIED, not opened: Schmitt, M.N. (ed.), Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Cambridge University Press, 2017, cited from memory. Observation year 2017. Accessed 2026-11-03.back
- 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
- 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back
- 37UNVERIFIED, not opened: Helbing, D., Globally networked risks and how to respond, Nature 497, 51 to 59, 2013, cited from memory. Springer Nature. Observation year 2013. Accessed 2026-11-03.back
- 36UNVERIFIED, not opened: Perrow, C., Normal Accidents: Living with High-Risk Technologies. Basic Books, New York, 1984, cited from memory. Observation year 1984. Accessed 2026-11-03.back
- 38UNVERIFIED, not opened: Zscheischler, J. et al., Future climate risk from compound events, Nature Climate Change 8, 469 to 477, 2018, cited from memory. Springer Nature. Observation year 2018. Accessed 2026-11-03.back
- 33UNVERIFIED, not opened: Tikk, E., Kaska, K. and Vihul, L., International Cyber Incidents: Legal Considerations. Cooperative Cyber Defence Centre of Excellence, Tallinn, 2010, cited from memory. Observation year 2007. Accessed 2026-11-03.back
- 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
- 2ENISA (ed.), ENISA Threat Landscape 2024 (publication page; published 19 September 2024; seven prime threats; no counts on the page). European Union Agency for Cybersecurity, Athens. Observation year 2024. Accessed 2026-11-03.back
- 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
- 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
- 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
- 23International Monetary Fund (ed.), Global Financial Stability Report, April 2024 (publication page: risk of extreme losses from cyber incidents has increased; the financial sector is highly exposed; chapter figures not read). IMF, Washington. Observation year 2024. Accessed 2026-11-03.back
- 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
- 11POST-CLOSE, context only: ITU (ed.), Facts and Figures statistics page (2026 edition: 6.3 billion online, 76%; about 2 billion offline; materials dated November 2026), read as a newer estimate and not used in findings. International Telecommunication Union, Geneva. Observation year 2026. Accessed 2026-11-03.back
- 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
- 26UNVERIFIED, not opened: World Bank (ed.), ID4D Global Dataset 2021, Volume 1: Global ID Coverage Estimates (just under 850 million people without official proof of identity in 2021; about half children; 194 countries), taken from search-result summaries; the repository returned an access error. World Bank, Washington, 2022. Observation year 2021. Accessed 2026-11-03.back
- 21IBM (ed.), Cost of a Data Breach Report 2026 (report page: global average cost of USD 4.99 million, up 12% on the previous year, described as a record). IBM, Armonk. Observation year 2026. Accessed 2026-11-03.back
- 22Verizon (ed.), Data Breach Investigations Report 2026 (report page: 31% of breaches begin with software vulnerabilities; coverage 1 November 2024 to 31 October 2025). Verizon, New York. Observation year 2025. Accessed 2026-11-03.back
- 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
- 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
- 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
- 15e-Estonia (ed.), X-Road (programme page: 2.2 billion transactions a year; more than 3,800 e-services; outgoing data digitally signed and encrypted). e-Estonia, Tallinn. Observation year 2025. Accessed 2026-11-03.back
- 39UNVERIFIED, not opened: Cyber Safety Review Board, Review of the December 2021 Log4j Event, 2022, cited from memory; no figure used. Department of Homeland Security, Washington. Observation year 2022. Accessed 2026-11-03.back
- 25BleepingComputer, Costa Rica declares national emergency after Conti ransomware attacks (press report of 9 May 2022: declaration on 8 May 2022 under Decree No. 42542; Ministry of Finance and other bodies affected). Observation year 2022. Accessed 2026-11-03.back