Draft, not yet released. In stewardship review. Not indexed until the first approved release.

Systems and sectors at baseline

6 min read0 figures2 tables17 notesNR-STRATEGIC-DPI-GLOBAL-2026-BASELINE

Contents
  1. ·Edition home
  2. ·Executive summary
  3. 1Digital systems fail together
  4. 2Key findings
  5. 3Systems and sectors at baseline
    1. 3.1 Where each system stood at evidence close
    2. 3.2 Domain posture
    3. 3.3 Sector screens
  6. 4Risks and capability
  7. 5Shared provider failure that overlaps a power or network loss
  8. 6Readings from the other desks
  9. 7The 2027 agenda
  10. 8Systems in depth
  11. AMethodology
  12. BData appendix
  13. CReferences and record
  14. ·Complete edition, for print

3.1Where each system stood at evidence close

DAT · Software

Windows devices hit by one update

8.5million

under 1% of Windows machines, 18 July 2024.

Reported2024Microsoft3

CYB · Threat

Nationally significant incidents, UK

204a year

up from 89 the year before.

Reported2024 to 2025NCSC8

FIN · Payments

UPI transactions in one month

20.7billion

October 2025, a record.

Reported2025NPCI data13

DEV · Access

People offline

2.2billion

94% online in high-income countries, 23% in low-income.

Reported2025ITU10

INF · Cloud

Hours from first impact to the end of one cloud event

14.5hours

DNS fault at one regional endpoint, 19 to 20 October 2025.

Reported2025AWS4

FIN · Inclusion

Adults with an account

79%

global share, Global Findex 2025.

Reported2025World Bank12

3.2Domain posture

Each of the twelve coupled domains is read through digital public infrastructure, in words, not scored. The coupling column names the dependency that carries digital public infrastructure risk into each domain.

Table 3.1Each domain read in words, not scored
DomainPosture at baselineCouplingStatus
WATWater operators were among the sectors where state-sponsored access was reported6; control networks depend on telecoms and power.WAT ↔ DATReported EQL 3
ENEEnergy operators were among the sectors where access was reported6; every digital rail depends on power.ENE → DATReported EQL 3
FOOFood supply uses payment and logistics systems; no consolidated series here.DAT → FOOExpert input EQL 2
HLTHealth claims and records run on shared platforms; a 2024 claims-platform breach led to about 100 million notices28.DAT → HLTReported EQL 2
BIOBiodiversity monitoring data runs on shared digital services; not consolidated here.DAT → BIOExpert input EQL 2
CLIHeat and storm events strain data centres and grids; not consolidated here.CLI → DATExpert input EQL 2
INFThe core layer: a DNS fault at one regional endpoint and a configuration file limit disrupted many services in 202545.the core systemReported EQL 4
FINUPI handled 20.7 billion transactions in October 2025 and Pix 313.3 million in one day1314.DAT → FINReported EQL 3
DATOne update reached 8.5 million devices; the UK handled 204 nationally significant incidents38.DAT ↔ INFReported EQL 4
AICMachine-learning services run on a few cloud platforms; no consolidated figure here.AIC ↔ DATExpert input EQL 2
MINHardware, cables and data-centre equipment depend on refined minerals; sibling editions hold the data.MIN → INFInferred EQL 2
TRDDigital trade and cross-border payments depend on shared rails; no figure here.DAT ↔ TRDInferred EQL 2

3.3Sector screens

All sixteen sectors are screened for their dependence on digital public infrastructure, on the same grammar as every national edition. The evidence column describes coverage of the baseline evidence, not the performance of the sector.

Table 3.2Sectors: baseline evidence and the exposure to watch
CodeSectorBaseline evidenceExposure to watchEvidence coverage
GS-00Cross-systemdigital layers couple every sector34; the US lists sixteen critical infrastructure sectors, including communications, energy, IT and water20provider failure with power lossPARTIAL
GS-01Waterwater operators among sectors with reported access6control-network intrusionTHIN
GS-02Energyenergy operators among sectors with reported access6intrusion and grid controlPARTIAL
GS-03Food and agrifoodpayments and logistics run on shared railspayment outageTHIN
GS-04Healthclaims platform breach notified about 100 million people28platform outage or breachTHIN
GS-05Finance and economyUPI 20.7 billion and Pix 313.3 million in a day1314payment rail outagePARTIAL
GS-06Development2.2 billion people offline10exclusion from digital servicesGOOD
GS-07Climateheat and storms strain data centresconcurrent hazardsTHIN
GS-08Disasterdigital services needed in recoveryloss of communicationsTHIN
GS-09Infrastructurecloud and edge providers sit under many services45regional endpoint faultGOOD
GS-10Citiesdense dependence on digital servicesmulti-service outageTHIN
GS-11Biodiversitymonitoring data on shared servicesloss of data servicesTHIN
GS-12Earth observationpositioning and timing signals underpin networkssignal interferenceTHIN
GS-13Cyber and digitallong-lived access reported67; 4,875 incidents1disruptive attacksGOOD
GS-14Policynetwork security and financial resilience rules1819implementation gapsPARTIAL
GS-15Scienceinterdependency science is mature3435data at operating scalePARTIAL

Notes

Numbers are the edition’s reference numbers, so a note reads the same in every chapter. The full list, with every source and its licence, is in Annex C. Annex C, references

  1. 3Microsoft (ed.), Helping our customers through the CrowdStrike outage (blog post of 20 July 2024; estimate of 8.5 million Windows devices, less than one percent of all Windows machines). Microsoft, Redmond. Observation year 2024. Accessed 2026-11-03.back
  2. 8National Cyber Security Centre (ed.), NCSC Annual Review 2025, incident management chapter and news item (period 1 September 2024 to 31 August 2025; 429 incidents; 204 nationally significant; 18 highly significant). NCSC, London. Observation year 2025. Accessed 2026-11-03.back
  3. 13Entrackr, UPI hits all-time high of 20.7 bn transactions in October (press report of NPCI data: 20.7 billion transactions, Rs 27.28 lakh crore, up 25% and 16% year on year); the NPCI statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  4. 10ITU (ed.), Facts and Figures 2025 (press release of 17 November 2025: about 6 billion online, 2.2 billion offline; 94% and 23% by income group; 85% urban and 58% rural). International Telecommunication Union, Geneva. Observation year 2025. Accessed 2026-11-03.back
  5. 4Amazon Web Services (ed.), Summary of the Amazon DynamoDB service disruption in the Northern Virginia (US-EAST-1) Region, 19 to 20 October 2025 (post-event summary). Amazon Web Services, Seattle. Observation year 2025. Accessed 2026-11-03.back
  6. 12World Bank (ed.), The Global Findex Database 2025 (publication page: 79% of adults globally have an account). World Bank, Washington. Observation year 2025. Accessed 2026-11-03.back
  7. 6CISA, NSA, FBI and partner agencies (eds.), Joint cybersecurity advisory AA24-038A on state-sponsored actor persistent access to critical infrastructure networks, 7 February 2024 (page text read to character 100,000 of 132,303). CISA, Arlington. Observation year 2024. Accessed 2026-11-03.back
  8. 28UNVERIFIED, not opened: US Department of Health and Human Services Office for Civil Rights, Change Healthcare cybersecurity incident (about 100 million notices sent by October 2024), taken from search-result summaries of HHS statements; a later figure of 192.7 million appears in one press report and is not used. Observation year 2024. Accessed 2026-11-03.back
  9. 5Cloudflare (ed.), Cloudflare outage on November 18, 2025 (incident report). Cloudflare, San Francisco. Observation year 2025. Accessed 2026-11-03.back
  10. 14Agência Brasil, Pix bate recorde e supera 313 milhões de transações em um dia (press report of Banco Central do Brasil data: about 313.3 million transactions and R$ 179.9 billion on 5 December 2025; previous record 297.4 million on 28 November 2025); the central bank statistics page returned no figures. Observation year 2025. Accessed 2026-11-03.back
  11. 20CISA (ed.), Critical Infrastructure Sectors (page: sixteen sectors, including Communications, Energy, Information Technology and Water and Wastewater). Cybersecurity and Infrastructure Security Agency, Arlington. Observation year 2026. Accessed 2026-11-03.back
  12. 7CISA and partner agencies (eds.), Joint cybersecurity advisory AA25-239A on state-sponsored actor compromise of networks worldwide, 27 August 2025 (revised 3 September 2025). CISA, Arlington. Observation year 2025. Accessed 2026-11-03.back
  13. 1ENISA (ed.), ENISA Threat Landscape 2025 (publication page; period 1 July 2024 to 30 June 2025; published 1 October 2025; 4,875 incidents; version 1.3 of 22 September 2026). European Union Agency for Cybersecurity, Athens. Observation year 2025. Accessed 2026-11-03.back
  14. 18European Commission (ed.), NIS2 Directive, Directive (EU) 2022/2555 (policy page: in force January 2023; transposition deadline 17 October 2024; 18 critical sectors). European Commission, Brussels. Observation year 2024. Accessed 2026-11-03.back
  15. 19European Insurance and Occupational Pensions Authority (ed.), Digital Operational Resilience Act, Regulation (EU) 2022/2554 (page: applied from 17 January 2025; oversight framework for critical ICT third-party providers). EIOPA, Frankfurt. Observation year 2025. Accessed 2026-11-03.back
  16. 34UNVERIFIED, not opened: Rinaldi, S.M., Peerenboom, J.P. and Kelly, T.K., Identifying, understanding, and analysing critical infrastructure interdependencies, IEEE Control Systems Magazine 21(6), 11 to 25, 2001, cited from memory. Observation year 2001. Accessed 2026-11-03.back
  17. 35UNVERIFIED, not opened: Buldyrev, S.V. et al., Catastrophic cascade of failures in interdependent networks, Nature 464, 1025 to 1028, 2010, cited from memory. Springer Nature. Observation year 2010. Accessed 2026-11-03.back

Cite this chapter

Valadbaygi, S. (Ed.). (2026). Chapter 3: Systems and sectors at baseline. In Strategic Systems Report 2026: Digital Public Infrastructure and Systemic Cyber Risk (Baseline Edition 2026, Report No. NR-STRATEGIC-DPI-GLOBAL-2026-BASELINE) [Draft under review]. The Global Centre for Risk and Innovation (GCRI).

Every citation form of the whole report, BibTeX and RIS included, is on the edition home. Cite this report

ReportsContribute

Send evidence or a correction on Digital Public Infrastructure and Systemic Cyber Risk.

Reports is the Consortium’s quarterly publication, written by six desks. This page sits with the Global Centre for Risk and Innovation (GCRI) Systems Evidence desk. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work. Sent to the wrong desk, it is forwarded, not refused.

GCRI Systems Evidence deskStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

CC BY 4.0 Free to read. Text and figures: CC BY 4.0. Data: CC0 1.0. Authors keep copyright. Published by GCRI Canada.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices