The Global Risks Forum (GRF)
GRF · AI and Digital Governance
Situational awarenessEvents, outlooks and readiness for those who decide
Public services and critical infrastructure run on digital systems that attackers target and that fail through error. Cyber governance sets security obligations, incident reporting duties and the authorities that coordinate response. This page sets out how cyber risk to public infrastructure develops and how governance responds, the records that show it, and who holds the decisions.
Cyber and public infrastructure · Algorithm register · Quarter 3
| Benefit fraud flagging | Social agency | High | Missing | Partial |
| Permit triage | Planning | Limited | Done | Yes |
| School placement | Education | High | Done | Yes |
| Chat assistant | Tax office | Minimal | Done | n/a |
Fig.Public algorithm register. Design wireframe with placeholder names and illustrative values, not a record or a live system.
Governance of digital dependencies. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Public bodies run old software that is costly to replace and hard to secure. Budget cycles favour new services over patching and replacement, so known weaknesses stay.
Many agencies use the same software, cloud and managed service providers. A compromise of one supplier reaches all its customers at once.
Ransomware at a hospital, utility or local council disrupts physical services. Dependencies between digital and physical infrastructure turn a cyber incident into a public safety event.
Mandatory incident reporting to national authorities lets them warn others and coordinate. Late or partial reporting leaves other targets exposed.
Night lights, population density and flood water over East Asia, from NASA GIBS. Each layer carries its own date.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Connected activity, framed on East Asia. Layers as NASA publishes them, each with its own date.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| National cybersecurity strategy in force | yes or no | on change | Government records | Published statistics |
| National computer security incident response team | yes or no, with mandate | on change | FIRST and ITU records | Published statistics |
| Significant incidents reported by public bodies | count by sector | annual | National authority reports | Published statistics |
| Global Cybersecurity Index tier | tier, categorical | periodic | ITU | ESTIMATED |
| Known exploited vulnerabilities remediated within deadline | share | periodic | Agency compliance reports | REPORTED |
| Public service downtime from cyber incidents | hours | per incident | Incident reports | REPORTED |
How spare capacity and dependencies between sectors decide whether local damage stays local, the levers resilience regulation and investment can pull. Teaching model with stated illustrative values, not a prediction. The map on this page shows East Asia; the model itself is not tied to a place.
Controls
Readouts
| Step | Data centres working (%) | Networks working (%) | Power working (%) |
|---|---|---|---|
| 0 | 89 | 89 | 100 |
| 1 | 56 | 72 | 94 |
| 2 | 50 | 33 | 28 |
| 3 | 33 | 33 | 11 |
| 4 | 22 | 33 | 6 |
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
Across the six pillars, led by Nexus Consortium
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
The steps an instrument takes from mandate to evaluation, each in the lane of the pillar that runs it and the authority's decisions in their own lane; play it step by step. Teaching model with stated illustrative values, not a prediction. The map on this page shows East Asia; the model itself is not tied to a place.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ITU Global Cybersecurity Index | Country commitments on legal, technical, organizational, capacity and cooperation measures | Free to read, ITU terms |
| ENISA Threat Landscape and NIS incident reports | Threats and incidents across EU sectors | Free, ENISA terms |
| CISA Known Exploited Vulnerabilities catalog | Vulnerabilities known to be exploited, with remediation deadlines for US federal agencies | Public domain |
| National cyber security centre annual reviews | Incidents handled and threat assessments | Public records, terms per centre |
| FIRST member directory | Incident response teams and their constituencies | Free to read, FIRST terms |
Assembled from the Nexus Standards area profile Cyber and digital risk standards: the hazards it names, the systems and communities that carry the loss, the controls and institutions that dampen it and the data that observe it. Pick an initiating event and step through the cascade to see where mandates meet and which decisions fall to whom. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise for dialogue, not a forecast, an assessment or a position.
Hazards
Systems and couplings
Controls
NS-0 Constitution and principlesNS-9 Contextual UNIs (deployments, instances, programme instances)NS-10 Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11 Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12 Software, model and AI/ML artifacts (supply chain, model cards, dataset sheets)NRS-H94 Hazard family: Systemic cyber events (NHS-1 cyber.systemic-cyber)NRS-X6 Cyber and digital security riskNRS-H51 Hazard family: Malicious compromise (NHS-1 cyber.intrusion)NRS-T8 Software and supply-chain integrity riskNRS-H93 Hazard family: Identity, trust and cryptographic failure (NHS-1 cyber.identity)NRS-H54 Hazard family: Signal and platform disruption (NHS-1 cyber.platform)Observation
Example geography
AI and Digital Governance prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| National cybersecurity authorities | Which obligations apply and how incidents are coordinated | Comparative regimes and incident data |
| Public body leadership | How much to invest in security and legacy replacement | Threat data and comparable practice |
| Legislatures | Which sectors fall under cyber obligations and reporting duties | Comparative laws and incident evidence |
| Procurement authorities | What security requirements suppliers must meet | Supply chain incident evidence and standards |
The instruments, mandates, actors and accountability arrangements a policymaker, diplomat or development agency works with, citing the agreements that set them. Structures follow the frameworks named. Any state or progress drawn is illustrative, not a record.
The kinds of instrument available on cyber and public infrastructure, by level of government and cooperation.
| Instrument type | Local | National | Regional | Global |
|---|---|---|---|---|
| Regulatory | Zoning, building codes | Laws, standards, licensing | Harmonised rules | Conventions and treaties |
| Economic | Local levies, grants | Budget lines, taxes, insurance schemes | Risk pools, regional funds | Financing mechanisms |
| Information | Local warnings | Disclosure, early warning, statistics | Data sharing arrangements | Global monitoring and reporting |
| Institutional | Local committees | Lead agencies, coordination councils | Regional bodies and secretariats | Multilateral mandates |
| Cooperative | Community agreements | Partnership compacts | Memoranda and joint programmes | Agreements and joint commitments |
Ransomware attacks on hospitals, local governments and schools have shown how quickly encrypted systems can halt services, with patients diverted and payments delayed. Supply chain compromises, in which attackers enter through a trusted software update or provider, can reach many organizations at once. Faulty updates from a single vendor have also disrupted services widely without any attack at all.
Public bodies often have older systems, limited security staff and complex procurement, which makes them attractive targets. Responsibility is fragmented between the agency, its suppliers and national cyber authorities. Concentration on a few cloud and software providers creates efficiency and security benefits but also shared points of failure.
Why now: cyber incidents now halt hospitals, ports and payments, and the UN process on security in the use of information technologies agreed in 2025 to move to a permanent mechanism. The platform is designed to convene public infrastructure owners on decision rights during an incident and exercise them without touching live systems.
Identifying which services depend on which systems and providers. Limits: hidden sub-dependencies.
Minimum controls for public bodies and suppliers. Limits: compliance does not ensure security.
Mandatory reporting and national coordination. Limits: under-reporting and slow information sharing.
Cross-agency cyber exercises. Limits: participants know it is an exercise.
Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.