The UK Government has released an updated version of the National Risk Register, which provides an assessment of the risks facing UK infrastructure, communities, organizations, and individuals.
The top risks identified are:
- Water infrastructure failure or loss of drinking water
- Pandemic
These are both assessed as having a potentially catastrophic impact (five out of five on the impact scale) and are four out of five on the likelihood scale.
- Terrorist attacks in publicly accessible locations
This is assessed as having a significant impact (four out of five on the impact scale) and the highest likelihood (five out of five).
New additions to the National Risk Register include:
- Digital resilience failure – to reflect learning from incidents such as the CrowdStrike IT outage in July 2024.
- Two risks on data infrastructure (one focused on a cyber attack and the other on disruption) – following further assessment of potential risks to this sector following its establishment as a CNI sub-sector in 2024.
- Cyber attack: water infrastructure – to reflect learning from reported cyber attacks targeting the water sector.
- Cyber attack: police systems – to reflect the heightened risk of cyber attacks across all systems and work carried out by government and the police to strengthen resilience.
- Accidental damage on the National Gas Transmission Network – to explore damage to the gas transmission network as a result of agricultural digging.
The ‘Disruption of Russian gas supplies to Europe’ risk has been removed, as reliance on Russian gas imports has significantly reduced.
The UK Government has also announced Operation ALBISTON SHADOW, described as the country’s largest home-defence exercise in decades. The multi-day exercise scheduled for 2027 will involve ministers and hundreds of government and public-sector officials and will test preparedness for hybrid attacks. Government crisis plans known as the ‘War Books’ are also being updated for the first time since 2004.
From a resilience and business continuity professional perspective, it is worth exploring the latest National Risk Register to identify any potential business impacts from the 95 risk areas described. It is particularly worth considering whether your organizational pandemic threat assessments match the severity of the risk from a governmental point of view and whether additional pandemic planning activities may be justified.
