A new PwC report, prepared for the National Preparedness Commission, argues that the UK needs to move beyond organization-by-organization resilience planning and adopt a more joined-up model for protecting critical national infrastructure. Connecting for continuity in a crisis says modern crises increasingly interact, overlap, and cascade, meaning that individual preparedness is no longer enough.
The report’s central lesson is that resilience must be understood as a system-of-systems challenge. PwC warns that UK CNI is still too often managed through sectoral and organizational silos, with limited visibility of dependencies, inconsistent information sharing, and no universally agreed definition of criticality.
To address this, PwC proposes a twin-track approach: each CNI organization should define its own ‘minimum viable company’, while government and industry work together to define a ‘minimum viable UK’. This would identify the critical functions, assets, dependencies, service levels, and recovery timelines needed to keep essential economic and civic activity operating during severe disruption.
A key recommendation is the creation of a National Exchange for Sustaining Critical Infrastructure Services, or NEXSCIS. This cross-sector body would define national needs, minimum essential service levels, maximum system recovery timelines, and accountability between government and CNI operators. It would also support cooperation between market competitors, use trade bodies as trusted conveners, and explore technologies including AI to strengthen systemic resilience.
For individual organizations, the report recommends immediate action to identify what matters most, map dependencies, assess which other parts of CNI rely on them, define critical systems, calculate minimum revenue needs, and determine recovery time requirements. It also calls for a competent board-level resilience lead, real-time monitoring, resilience dashboards, integrated risk and continuity data, and automated scenario testing.
The report concludes that plans alone are insufficient: organizations must evidence capability through cross-sector exercising, maturity scoring, communications stress-testing, and continuous improvement.
