Critical Infrastructure Failure
Critical Infrastructure failure is defined as the failure in one or more of the physical structures, facilities, networks and other assets which provide services that are essential to the social and economic functioning of a community or society (UNGA, 2016).
Critical Infrastructures as described in the ANNEX of (CER - DIRECTIVE (EU) 2022/2557 of the European Parliament and of the council) can be defined as: Energy (e.g., Electricity, District heating and cooling, Oli, Gas, Hydrogen); Transport (Air, Rail, Water, Road, Public Transport); Banking; Financial market infrastructure; Health; Drinking water; Waste water; Digital Infrastructure; Public administration; Space (European Parliament 2022).
Primary reference(s)
UNGA, 2016. Report of the open-ended intergovernmental expert working group on indicators and terminology relating to disaster risk reduction A/71/644. United Nations General Assembly (UNGA). Accessed 16 December 2024.
European Parliament 2022. Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC. Accessed 16 December 2024.
Annotations
Additional scientific description
The criteria for the determination of the significance of a disruptive effect that can lead to a failure (CER - DIRECTIVE (EU) 2022/2557 of the European Parliament and of the council)
- The number of users relying on the essential service provided by the entity concerned
- The extent to which other sectors and subsectors as set out in the Annex depend on the essential service in question
- The impact that incidents could have, in terms of degree and duration, on economic and societal activities, the environment, public safety and security, or the health of the population
- The entity's market share in the market for the essential service or essential services concerned
- The geographic area that could be affected by an incident, including any cross-border impact, taking into account the vulnerability associated with the degree of isolation of certain types of geographic areas, such as insular regions, remote regions or mountainous areas
In the Article 13 ''Resilience measures of critical entities'', CER directives lay down obligations for critical entities aimed at enhancing their resilience and ability to provide services in the internal market, and are offering the resilience philosophy concept that needs to be followed by critical infrastructure operators:.
- Prevent incidents from occurring, duly considering disaster risk reduction and climate adaptation measures.
- Ensure adequate physical protection of their premises and critical infrastructure, duly considering.
- Respond to, resist and mitigate the consequences of incidents, duly considering the implementation of risk and crisis management procedures and protocols and alert routines.
- Recover from incidents, duly considering business continuity measures and the identification of alternative supply chains, in order to resume the provision of the essential service.
- Ensure adequate employee security management, such as setting out categories of personnel who exercise critical functions, establishing access rights to premises and laying down appropriate training requirements and qualifications.
Raise awareness about the measures referred to in points (a) to (e) among relevant personnel, duly considering training courses, information materials and exercises.
Paragraph 18 of the Sendai Framework on Disaster Risk Reduction 2015-2030 calls for the global target of:
d. Substantially reduce disaster damage to critical infrastructure and disruption of basic services, among them health and educational facilities, including through developing their resilience by 2030 (UNDRR, 2015).
The Sendai Framework identified as priorities for action (Priority 4: Enhancing disaster preparedness for effective response and to 'Build Back Better' in recovery, rehabilitation and reconstruction) this example of reducing critical infrastructure hazards and failures:
c. To promote the resilience of new and existing critical infrastructure, including water, transportation and telecommunications infrastructure, educational facilities, hospitals and other health facilities, to ensure that they remain safe, effective and operational during and after disasters in order to provide live-saving and essential service (UNDRR, 2015).
The United Nations General Assembly report of the open-ended intergovernmental expert working group on indicators and terminology relating to disaster risk reduction, defines the following of relevance to critical infrastructure failure:
- "A sudden onset disaster is one triggered by a hazardous event that emerges quickly or unexpectedly. Sudden onset disasters could be associated with, e.g., earthquake, volcanic eruption, flash flood, chemical explosion, critical infrastructure failure, transport accident" in the Disaster impact definition (UNGA, 2016).
- "Corrective disaster risk management activities address and seek to remove or reduce disaster risks which are already present, and which need to be managed and reduced now. Examples are the retrofitting of critical infrastructure or the relocation of exposed populations or assets" in the Disaster risk management definition (UNGA, 2016).
- "Examples of physical assets that are the basis for calculating direct economic loss include homes, schools, hospitals, commercial and governmental buildings, transport, energy, telecommunications infrastructures and other infrastructure; business assets and industrial plants; and production such as crops, livestock and production infrastructure. They may also encompass environmental assets and cultural heritage" in the Economic loss definition (UNGA, 2016).
- "Technological hazards originate from technological or industrial conditions, dangerous procedures, infrastructure failures or specific human activities. Examples include industrial pollution, nuclear radiation, toxic wastes, dam failures, transport accidents, factory explosions, fires and chemical spills. Technological hazards also may arise directly as a result of the impacts of a natural hazard event" in the Hazard Definition (UNGA, 2016).
- "The medium and long term rebuilding and sustainable restoration of resilient critical infrastructures, services, housing, facilities and livelihoods required for the full functioning of a community or a society affected by a disaster, aligning with the principles of sustainable development and 'build back better', to avoid or reduce future disaster risk" in the reconstruction definition (UNGA, 2016).
Critical infrastructure is essential for community, national, regional and global resilience. It includes water, transportation and telecommunications infrastructure, educational facilities, hospitals and other health facilities that ensure that all remain safe, effective and operational during and after disasters in order to provide lifesaving and essential services.
Historically, critical infrastructure has primarily faced risks from accidents and natural hazards. However, in today's increasingly digital and interconnected world, the range of threats to its resilience has expanded significantly. It is expected that by 2025, 30% of critical infrastructure organizations will suffer security breaches severe enough to disrupt operations. In response, governments are placing greater emphasis on protecting critical assets, particularly those spanning international borders. Over the past five years, cyberattacks on critical infrastructure have risen, resulting in significant impacts on public safety, economic stability, and national security. Threat actors are employing advanced methods to exploit networks, software vulnerabilities, and even launch physical attacks on cyber systems (Gallagher, 2023). According to the World Economic Forum, cyberattacks on critical infrastructure were ranked among the top 5 global risks with the greatest potential impact in 2023 (WEF, 2023).
Examples of recent events leading to critical infrastructure failure include:
- Texas Power Grid Failure (2021): A severe winter storm in February 2021 led to unprecedented cold temperatures across Texas. The state's power grid, managed by the Electric Reliability Council of Texas (ERCOT), was not adequately winterized to handle such extreme conditions. This resulted in widespread equipment failures and a significant reduction in power generation capacity. The power grid failure left millions of Texans without electricity, heat, and water for several days. The disruption caused at least 246 deaths, extensive property damage, and economic losses (Madhavan & Rajamani, 2022).
- Western European Floods (July 2021): Extreme precipitation caused by a persistent low-pressure system led to record-breaking water levels in parts of Germany, Belgium, and the Netherlands. The floods resulted in severe damage to critical infrastructure, including bridges, sewage systems, schools, and hospitals. In Germany and Belgium, many infrastructure assets were either severely damaged or destroyed. The floods caused at least 220 casualties and significant economic losses (Koks et al., 2022).
- Baltic Sea Pipeline and Communication Cable Incidents (Autumn 2023): Incidents affecting a pipeline and communication cables in the Baltic Sea, which are still under investigation, highlighted the vulnerabilities of critical infrastructure to potential sabotage or accidents (Bueger & Liebetrau, 2023).
Metrics and numeric limits
The Sendai Framework Monitor calls for all UN member states to report on the agreed global targets. Of note is Global Target D: Substantially reduce disaster damage to critical infrastructure and disruption of basic services, among them health and educational facilities, including through developing their resilience by 2030 (UNDRR, 2017).
- D1 (compound) Damage to critical infrastructure attributed to disasters.
- D2 Number of destroyed or damaged health facilities attributed to disasters.
- D3 Number of destroyed or damaged educational facilities attributed to disasters.
- D4 Number of other destroyed or damaged critical infrastructure units and facilities attributed to disasters. The decision regarding those elements of critical infrastructure to be included in the calculation will be left to the Member States and described in the accompanying metadata. Protective infrastructure and green infrastructure should be included where relevant.
- D5 (compound) Number of disruptions to basic services attributed to disasters.
- D6 Number of disruptions to educational services attributed to disasters.
- D7 Number of disruptions to health services attributed to disasters.
- D8 Number of disruptions to other basic services attributed to disasters. The decision regarding those elements of basic services to be included in the calculation will be left to the Member States and described in the accompanying metadata.
WHO technical guidance notes on Sendai Framework Reporting by Ministries of Health (WHO, 2020).
Key relevant UN convention / multilateral treaty
Sendai Framework for Disaster Risk Reduction 2015–2030 (UNDRR, 2015).
Drivers
Climate change and the increasing frequency of natural hazards pose significant challenges to infrastructure. Flooding, geomagnetic and convective storms, as well as wildfire damage, are causing greater loss severity and disrupting supply chains (Gallagher, 2023).
Heavy rainfall and river overflow can lead to significant flooding, which can damage or overwhelm infrastructure. Similarly, hurricanes, cyclones, and severe storms can cause widespread damage to infrastructure (Mühlhofer et al., 2023). Earthquakes can cause structural damage or failure of critical infrastructure while landslides can impact the stability and functionality of infrastructure, ash and lava flows from volcanic eruptions can disrupt and damage infrastructure and tsunamis can inundate coastal areas and damage infrastructure. Droughts and prolonged periods of low rainfall can reduce water levels, affecting the operation of dams and other water-related infrastructure.
Failures in industrial facilities can release hazardous materials, impacting nearby critical infrastructure. This includes accidental releases of hazardous chemicals, such as ammonium nitrate (see HIP CH0902) that can cause structural damage or compromise the integrity of infrastructure, and incidents involving nuclear or radiological materials that can have catastrophic impacts on infrastructure safety. Incidents involving the transportation of hazardous materials can also pose risks to nearby infrastructure. Poor maintenance and oversight, design flaws, or ageing infrastructure can lead to failures. Deliberate terrorist attacks and cybersecurity threats can also disrupt the operation and safety of critical infrastructure systems.
Impacts
Failures in critical infrastructure often lead to cascading effects. For instance, during the 2021 floods in Western Europe, communication systems in Germany's Ahr Valley were disrupted, and steep valley roads became impassable, making it extremely difficult to evacuate hospitals and care facilities. When critical infrastructure fails, it disproportionately affects socially vulnerable groups such as the elderly, the sick, or those living in poverty (UNU, 2024).
Multi-hazard context
The figure below summarises common interactions between critical infrastructure failure and other hazards. This information should be used with caution and not be solely relied upon in Disaster Risk Management, particularly as some interactions may not have been included. Note that hazardous events occurring together or locally in space or time may not necessarily cause, amplify, or be otherwise related to each other. Specific examples of multi-hazard context can be found in the ‘Hazard drivers’ and ‘Impacts’ sections above.
Multi-hazard diagram
Risk Management
CER directives (European Parliament, 2022) are updating the previous version of them (Directive 2008/114/EC) and have as objectives to:
- Lay down obligations on Member States to take specific measures aimed at ensuring that services which are essential for the maintenance of vital societal functions or economic activities
- Lay down obligations for critical entities aimed at enhancing their resilience and ability to provide services in the internal market
- Establishes rules on the supervision of critical entities, on enforcement and for the identification of critical entities of particular European significance establishes common procedures for cooperation and reporting on the application of this Directive
- Lays down measures with a view to achieving a high level of resilience of critical entities in order to ensure the provision of essential services within the Union and to improve the functioning of the internal market.
An example from the Energy infrastructures domain, of an EU-based research program with applications in the real-life practice that aligned and strengthened these directives was SecureGas (Securing the European Gas Network, https://www.securegas-project.eu/):
SecureGas promoted CIs resilience through the adoption of key attributes that support a system-thinking approach. The Gas CI network was analysed at system level, meaning that this wide complex system has been studied from the production phase to the transmission one, till the distribution to the users, considering also multi-sectoral and transboundary interdependencies. Moreover, adopting an all-hazards risk-based approach, it targeted the establishment of the resilience concept throughout the entire life cycle of the Gas CI network, from the design phase to its operation and maintenance. As such, the main principles of a resilience-based asset management framework have been elaborated to pursue a comprehensive risk-based approach for managing threats and vulnerabilities. Security, safety, technical and environmental aspects have been assessed, providing documented guidance for the selection of appropriate alternatives to be examined during the various phases of infrastructure projects. In line with the above, an innovative all hazards & all threats risk assessment study of a pipeline hub (including compressor stations) has been performed in the SecureGas project.
The project contributed, in practice, to the update of the CER directives, by adopting an approach demonstrating how new threats, like cyber-attacks, as well as unconventional disruptions of critical infrastructures, will be incorporated in an innovative tool for security assessment and integrated into more conventional risk assessment approaches. The outcomes of these drivers and risk management knowledge and tools were the base for expanding this philosophy and contributing to the updated CER directives by spreading the type of studied hazards (hybrid) and including new types of infrastructures (subsea infrastructures).
The Sendai Framework is the successor instrument to the Hyogo Framework for Action (HFA) 2005-2015: Building the Resilience of Nations and Communities to Disasters. The HFA was conceived to give further impetus to the global work under the International Framework for Action for the International Decade for Natural Disaster Reduction of 1989, and the Yokohama Strategy for a Safer World: Guidelines for Natural Disaster Prevention, Preparedness and Mitigation and its Plan of Action, adopted in 1994 and the International Strategy for Disaster Reduction of 1999 (UNDRR, 2015).
The Sendai Framework has a significantly strong emphasis on disaster risk management as opposed to disaster management. The scope of disaster risk reduction has been broadened significantly to focus on both natural and man-made hazards and related environmental, technological and biological hazards and risks. Health resilience is strongly promoted throughout (UNDRR, 2015).
Two examples from the health domain are shared below to show how leadership at a UN level engages to deliver approaches to help at local and national levels to reduce critical infrastructure failures:
Making health facilities safe in emergencies: In emergencies, disasters and other crises, the lives and well-being of the affected population must always be protected, particularly in the minutes and hours immediately following impact or exposure as time is of the essence in saving lives. The ability of health services to be delivered by critical infrastructure such as health facilities without interruption in these situations is a matter of life and death. For a safe health facility to remain intact, accessible and functioning at maximum capacity before, during and immediately following an emergency or disaster, it relies on key factors: health infrastructure that can resist exposures and forces from all types of hazards (e.g., retrofitted towards disaster risk reduction); medicine and medical equipment that are essential, accessible and protected from damage from all hazards (including climate change impacts); community infrastructure and critical services (such as water, food, electricity and medical supplies) that are available to support the delivery of health services; and health personnel who can provide medical assistance in safe and secure settings where and when they are most needed (WHO, no date).The World Health Organization (WHO)’s safe health facilities’ programme supports Member States to: develop national policies and regulations on making health facilities safe from disasters; protect the lives of the occupants of a health facility; protect the economic investment as well as the functionality of both new and existing health facilities and those identified as priorities (e.g., hub hospital) within the health services network; compile, organise and monitor the implementation of policies as well as national and international regulations on safe health facilities; and make health facilities safe, energy-efficient and resilient to future risks, including climate change (WHO, no date).
The Hospital Safety Index, developed by the WHO is a tool used by health authorities and multidisciplinary partners to gauge the probability that a health facility will continue to be safe and operational in emergency situations. The tool includes evaluation forms, a guide for evaluators, and a safety index calculator (WHO, no date).
WHO Health Emergency and Disaster Risk Management Framework: Launched at the Global Platform for Disaster Risk Reduction in May 2019, the WHO Health Emergency and Disaster Risk Management Framework is designed to reduce the health risks and consequences of emergencies and is vital to local, national and global health security and for building the resilience of communities, countries and health systems. Sound risk management is essential to safeguard the development and implementation of the Sustainable Development Goals (SDGs), including the pathway to universal health coverage (UHC), the Sendai Framework for Disaster Risk Reduction 2015–2030 (Sendai Framework), International Health Regulations (IHR) (2005), the Paris Agreement on Climate Change (Paris Agreement) and other related global, regional and national frameworks (WHO, 2019).
The WHO Health Emergency and Disaster Risk Management Framework provides a common language and a comprehensive approach that can be adapted and applied by all actors in health and other sectors who are working to reduce health risks and consequences of emergencies and disasters. The Framework also focuses on improving health outcomes and well-being for communities at risk in different contexts, including in fragile, low- and high-resource settings (WHO, 2019).
The WHO Health Emergency and Disaster Risk Management Framework emphasises assessing, communicating and reducing risks across the continuum of prevention, preparedness, readiness, response and recovery, and building the resilience of communities, countries and health systems (WHO, 2019).
Monitoring
Monitoring critical infrastructure for potential failures involves a multifaceted approach, including real-time data collection, advanced analytics, and proactive response measures. Many systems exist and depend on the infrastructure at risk.
References
Bueger, C., & Liebetrau, T., 2023. ritical maritime infrastructure protection: What’s the trouble? Marine Policy, 155, 105772. DOI: 10.1016/j.marpol.2023.105772. Accessed 13 February 2025.
European Parliament, 2022. Directive (European Union) EU 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC. Accessed 16 December 2024.
Gallagher, 2023. Four Key Threats to Critical Infrastructure – Building Resilience in an Increasingly Interconnected World. Accessed 26 January 2025.
SecureGas (Securing the European Gas Network), no date. Project website. Accessed 13 February 2025.
Koks, E. E., van Ginkel, K. C. H., van Marle, M. J. E., & Lemnitzer, A., 2022. Critical infrastructure impacts of the 2021 mid-July western European flood event. Natural Hazards and Earth System Sciences, 22(12), 3831–3838. Accessed 13 February 2025.
Madhavan, K., & Rajamani, D., 2023. 2021 Texas Electricity Black-out Crisis: Root-Cause Analysis and Recommendations. Journal of Student Research, 11(1). DOI: 10.47611/jsrhs.v11i1.2333. Accessed 13 February 2025.
Mühlhofer, E., Koks, E. E., Kropf, C. M., Sansavini, G., & Bresch, D. N., 2023. A generalized natural hazard risk modelling framework for infrastructure failure cascades. Reliability Engineering & System Safety, 234, 109194. DOI: 10.1016/j.ress.2023.109194Accessed 13 February 2025.
United Nations Office for Disaster Risk Reduction (UNDRR), 2015. Sendai Framework for Disaster Risk Reduction 2015–2030. Accessed 13 February 2025.
United Nations Office for Disaster Risk Reduction (UNDRR), 2017. Measuring implementation of the Sendai Framework. Accessed 13 February 2025.
United Nations General Assembly (UNGA), 2016. Report of the open-ended intergovernmental expert working group on indicators and terminology relating to disaster risk reduction (A/71/644). Accessed 13 February 2025.
United Nations University (UNU), 2024. 5 Things You Need to Know About Critical Infrastructure. Accessed 26 January 2025.
World Economic Forum (WEF), 2023. Global Risks Report 2023. Accessed 25 January 2025.
World Health Organization (WHO), no date. Making health facilities safe in emergencies. Accessed 13 February 2025.
World Health Organization (WHO), 2019. WHO Health Emergency and Disaster Risk Management Framework. Accessed 13 February 2025.
World Health Organization (WHO), 2020. WHO Technical Guidance Notes on Sendai Framework Reporting by Ministries of Health. Accessed 13 February 2025.