Stress-Testing the Resilience of Critical Infrastructures Exposed to Polycrises Triggered by Emerging Risks

Abstract

This article introduces a new approach for stress-testing the resilience of critical infrastructures exposed or potentially exposed to adverse events, polycrises, or disasters. This approach focuses on extreme threats (x-threats or XTs) and the functionality testing during such events. The methodology relies on resilience indicators, considering both the threat side and the asset side of adverse events. This enables simultaneous consideration of factors such as increased intensity, impact potential, complexity, systemic risks, and interconnectedness or cascading effects. The resilience of critical infrastructures is analyzed across phases of the resilience cycle: analysis of potential risk, preparation, absorption, recovery, and adaptation/transformation. The proposed stress-testing approach builds on the author’s previous work in EU projects and standards organizations (ISO—the International Organization for Standardization, DIN—German Institute for Standardization), incorporating recent developments like the EU regulations (the Critical Entities Resilience CER Directive) and the use of AI in resilience analysis. Specifically, it extends the stress-testing concept proposed in DIN SPEC 91461 and links it to applications for resilience assessment within EU projects and industry.

Keywords

Critical infrastructures / Emerging risks / Extreme threats / Polycrises / Resilience / Resilience indicators

References

[1] BABSFederal Office for Civil Protection (FOCP or BABS—Das Bundesamt für Bevölkerungsschutz): National risk analysis methodology; Disasters and emergencies in Switzerland 2020 (Version 20), 2020, Bern. FOCP.

[2] BABSFederal Office for Civil Protection (FOCP or BABS—Das Bundesamt für Bevölkerungsschutz): What risks is Switzerland exposed to? Disasters and emergencies in Switzerland 2020, 2020, Bern. FOCP.

[3] Brem S., and S. Hohl. 2015. The national risk analysis of disasters and emergencies in Switzerland. Bern: Federal Office for Civil Protection. https://www.babs.admin.ch/en/aufgabenbabs/gefaehrdrisiken/natgefaehrdanalyse.html. Accessed 6 Aug 2025.

[4] DIN (German Institute for Standardization). 2023. DIN SPEC 91461:2023. Framework for stress-testing resilience of industrial plants and sites exposed to cyber-physical attacks. https://www.beuth.de/de/technische-regel/din-spec-91461/346873248. Accessed 6 Aug 2025.

[5] EBA (European Banking Authority). 2025. The EBA launches its 2025 EU-wide stress test. https://www.eba.europa.eu/publications-and-media/press-releases/eba-launches-its-2025-eu-wide-stress-test. Accessed 6 Aug 2025.

[6] ECB (European Central Bank). 2018. TIBER-EU framework—How to implement the European framework for Threat Intelligence-based Ethical Red Teaming. Frankfurt: European Central Bank. https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework.en.pdf. Accessed 6 Aug 2025.

[7] ENSREG (European Nuclear Safety Regulatory Group). 2011. Declaration of ENSREG on EU “Stress tests” specifications. http://www.ensreg.eu/sites/default/files/EU%20Stress%20tests%20specifications_0.pdf. Accessed 6 Aug 2025.

[8] ERCOT (Electric Reliability Council of Texas). 2021. The timeline and events of the February 2021 Texas electric grid blackouts. Austin: ERCOT.

[9] EU-CER (European Commission—The Critical Entities Resilience Directive). 2022. The Critical Entities Resilience Directive (CER). https://www.critical-entities-resilience-directive.com/. Accessed 6 Aug 2025.

[10] EU-CIP (European Critical Infrastructure Protection) project. 2024. European knowledge hub and policy testbed for critical infrastructure protection. Project No. 101073878. https://www.eucip.eu. Accessed 6 Aug 2025.

[11] EU-ECHO (European Commission—European Civil Protection and Humanitarian Aid Operations). 2017. Overview of natural and man-made disaster risks the European Union may face. Brussels: EU-ECHO. https://data.europa.eu/doi/10.2795/560045. Accessed 6 Aug 2025.

[12] EU-VRi (European Risk & Resilience Institute). 2013. iNTeg-Risk early recognition, monitoring and integrated management of emerging, new technology related risks (Risk Radar). EU FP7 project Nr. 213345. http://www.integrisk.eu-vri.eu/. Accessed 6 Aug 2025.

[13] Geneva AssociationThe value of insurance in a changing risk landscape, 2023, Zürich. Geneva Association.

[14] IRGC (International Risk Governance Council)Emerging risks: Sources, drivers and governance issues, 2010, Lausanne. IRGC.

[15] IRGC (International Risk Governance Council)The emergence of risks: Contributing factors, 2010, Lausanne. IRGC.

[16] IRGC (International Risk Governance Council)Improving the management of emerging risks: Risks from new technologies, system interactions and unforeseen or changing circumstances, 20112Lausanne. IRGC.

[17] ISO. 2018. ISO 31000: Risk management guidelines. www.iso.org/iso-31000-risk-management.html; https://www.iso.org/obp/ui/#iso:std:iso:guide:73:ed-1:v1:en. Accessed 6 Aug 2025.

[18] ISO (International Organization for Standardization). 2020. ISO 56000: Innovation management—Fundamentals and vocabulary. https://www.iso.org/obp/ui/#iso:std:iso:56000:ed-2:v1:en. Accessed 6 Aug 2025.

[19] ISO (International Organization for Standardization). 2021. ISO 22300: Security and resilience—Vocabulary (referred in the text also as “ISO 223xx series” for other standards in the same group). https://www.iso.org/obp/ui/#iso:std:iso:22300:ed-3:v1:en. Accessed 6 Aug 2025.

[20] ISO (International Organization for Standardization). 2023. ISO TS 31050: Risk management—Guidelines for managing emerging risk to enhance resilience. https://www.iso.org/obp/ui/#iso:std:iso:ts:31050:ed-1:v1:en. Accessed 6 Aug 2025.

[21] ISO/IEC (International Organization for Standardization/International Electrotechnical Commission). 2019. ISO/IEC 31010: Risk management—Risk assessment techniques. https://www.iso.org/obp/ui/#iso:std:iec:31010:ed-2:v1:en.fr. Accessed 6 Aug 2025.

[22] Jovanović, A. 2021. DIN SPEC Request (D111) DIN SPEC 91461: Framework for stress-testing resilience of industrial plants and sites (critical entities) exposed to cyber-physical attacks (DIN SPEC 91461: Framework für Stresstesten der Widerstandsfähigkeit von Industrieanlagen und -standorten (kritische Einrichtungen), ausgesetzt den cyber-physischen Angriffen). Berlin: DIN (German Institute for Standardization).

[23] JovanovićA, BelliniEAligning the resilience-related research efforts in the EU-DRS projects. Joint Workshop DRS-7&14 projects, 13–14 September 2017, Brussels, Belgium, 2017SteinbeisStuttgart. EU-VRi.

[24] JovanovicAS, ChakravartyS, JelicMRosatoV, Di PietroA. Resilience and situational awareness in critical infrastructure protection: an indicator-based approach. Issues on risk analysis for critical infrastructure protection, 2021, London. IntechOpen.

[25] Jovanovic, A., M. Jelic, T. Rosen, P. Klimek, S. Macika, and K. Øien. 2019. SmartResilience D3.7: “The ResilienceTool” of the Smart-Resilience project. EU project SmartResilience. Project No. 700621. http://www.smartresilience.eu-vri.eu/sites/default/files/publications/SmartResD3.7.pdf. Accessed 6 Aug 2025.

[26] JovanovićA, KlimekP, RennO, SchneiderR, ØienK, BrownJ, DiGennaroM, LiuY, et al.. Assessing resilience of healthcare infrastructure exposed to COVID-19: emerging risks, resilience indicators, interdependencies and international standards. Environment Systems and Decisions, 2020, 40: 252-286.

[27] JovanovićA, SchernbergH, JelićM. Indicator-based assessment of extreme threats (XTs) and their impacts on the resilience of geographical areas and critical infrastructures. Environment Systems and Decisions, 2023, 43: 599-624.

[28] KlimekP, JovanovićAS, EgloffR, SchneiderR. Successful fish go with the flow: citation impact prediction based on centrality measures for term-document networks. Scientometrics, 2016, 107: 1265-1282.

[29] LinkovI, Fox-LentC, ReadL, AllenCR, ArnottJC, BelliniE, CoaffeeJ, FlorinM-V, et al.. Tiered approach to resilience assessment. Risk Analysis, 2018, 38(9): 1772-1780.

[30] LinkovI, TrumpBD, TrumpJ, PescaroliG, HynesW, MavrodievaA, PandaA. Resilience stress testing for critical infrastructure. International Journal of Disaster Risk Reduction, 2022, 82Article 103323.

[31] LiuH, RennO. Polycrisis and systemic risk: Assessment, governance, and communication. International Journal of Disaster Risk Science, 2025.

[32] ECD (Organisation for Economic Co-operation and Development)Handbook on constructing composite indicators, methodology and user guide, 2008, Pairs. OECD.

[33] SmartResilience. 2019. EU project smart resilience indicators for smart critical infrastructures. Project No. 700621. http://www.smartresilience.eu-vri.eu/. Accessed 6 Aug 2025.

[34] Steinbeis. 2020. Steinbeis transfermagazine—Risk Radar Tool. https://www.risk-technologies.com/home.aspx?lan=230&tab=1&itm=1&pag=12. Accessed 6 Aug 2025.

[35] STREST (Harmonized Approach to Stress Tests for Critical Infrastructures Against Natural Hazards). 2016. Final report summary of the EU project—STREST (Harmonized approach to stress tests for critical infrastructures against natural hazards), project 603389. https://cordis.europa.eu/project/id/603389/reporting?form=MG0AV3. Accessed 6 Aug 2025.

[36] The City of New York. 2014. One New York—The plan for a strong and just city. https://www.nyc.gov/html/onenyc/downloads/pdf/publications/OneNYC.pdf. Accessed 6 Aug 2025.

[37] Tonurist, O., and A. Hanson. 2018. Anticipatory innovation governance: Shaping the future through proactive policy making. OECD Working Papers on Public Governance No. 44. Pairs: OECD.

[38] WEF (World Economic Forum)The global risks report, 202520Geneva. WEF.

RIGHTS & PERMISSIONS

The Author(s)