Recently the UK Cabinet Office published their guidelines on Critical Infrastructure Resilience, entitled “Keeping the Country Running: Natural Hazards and Infrastructure“.
They propose building infrastructure resilience based on four components – as shown at right. Unlike the graphic, each component is not specified as making an equal contribution. It is suggested that the size/contribution of each component should be tailored to different levels, as required by the sector or infrastructure owner/operator.
For the purposes of this guide resilience is defined as “the ability of assets, networks and systems to anticipate, absorb, adapt to and / or rapidly recover from a disruptive event.” [p14]
This is a useful definition, which is achieved by narrowing the focus to their specific context for resilience. The definition, in my mind, covers the key dimensions – anticipate, absorb some impacts, recover when you break and the need to have an adaptive capacity.
Interesting acknowledgement that they have narrowed the definition of resilience for this paper, noting in a footnote that the broader meaning has greater focus on “adaptive capacity gained from understanding of the risks and uncertainties in our environment.”[Footnote 10, p14]
I would have thought that Infrastructure Resilience should also have to embrace uncertainty and build adaptive capacity by understanding risk and uncertainty.
- Resistance is the traditional “Prevent” mode. Building resistance to a hazard, or its primary impact.
- One of the nice features of this model is the recognition that activities such as this will be limited by the nature of the threats we envisage and plan for – and the historic measure of impacts.
- Reliability includes ensuring that the infrastructure components will operate under a range of conditions.
- This is a feature that must be designed into infrastructure components.
- Redundancy applies to the network/system level. The previous component was defined at the component level.
- This is the element where redundant capacity and alternative installations are counted.
- Again it must be a design factor – and also relates to available capacity.
- Here they make a key point that is not highlighted often enough I feel;
- “The resilience of networks reduces when running at or near capacity.” [p16]
- Response and Recovery is potentially being re-defined here as “organisational resilience” (or vice versa)
- the “ability, capacity and capability to respond and recover”. BCM is considered a key discipline in this component.
- Personally I don’t see this piece going far enough.
- It is clearly stated that planning will be driven by “reasonable worst case scenario for each type of hazard“, as specified in the National Risk Assessment.
- These represent the limits of threat/impact that need to be planned for
- Given the limitations of historical-based risk assessment that this will introduce for the first three components, this item needs to be clearly articulated as needing to provide the level of Adaptive Capacity to deal with a failure of anticipation and impact identification in the earlier components.
Sadly this critical fourth component is elaborated under a chapter heading of “Governance”. Probably the only interesting bit here is that this publication comes from the body that sponsored the development of PAS 200 (Crisis Management), so the need to go beyond BS25999 ‘incidents’ and include Crisis Management is specified.
There is some content in other chapters about the need to share information – “shift the thinking from ‘need to know’ to the ‘need to share’.” [p41]. And also about the different categories and ways to assess infrastructure dependencies – physical, geographic, upstream, downstream and interdependencies. Look at Pp86-89 on this if you want to cherry pick on this.
Cherry picking is recommended, unless you are in the UK and will feel mandated to follow this process.
It is interesting to compare this publication to a similar one from the Australian Government (my review) – you may also be interested in a review of the Australian version by Jan Husdal.
Not enough discussion of the cultural and startegic aspects of building resilience in the UK paper for my liking – what do you think?
Leave a Reply