Policy paper

The UK Government Resilience Framework (HTML)

Updated 4 December 2023

Foreword from the Chancellor of the Duchy of Lancaster

These are unsettled and troubling times. Russia’s brutal invasion of Ukraine; the wide ranging impacts of the COVID-19 pandemic; increasing signs of the impact of climate change; and constant and evolving cyber challenges are recent examples of an evolving threat picture.

We live in an increasingly volatile world, defined by geopolitical and geoeconomic shifts, rapid technological change and a changing climate. This context means that crises will have far reaching consequences and are likely to be greater in frequency and scale in the next decade than we have been used to. We have a responsibility to prepare for this future.

This challenge is not unique to the United Kingdom but faced by countries around the world. However, we must act now to bolster the United Kingdom’s resilience and ensure we have plans to prepare for and mitigate a wide range of risks when they arise on our shores, ensuring that we can face the future with confidence.

We have bold and comprehensive plans to build resilience to specific risks. We have launched our Net Zero Strategy, the National Cyber Strategy and the British Energy Security Strategy, all of which tackle some of the most pressing challenges we face. We are also refreshing our Integrated Review to ensure that the UK’s security, defence, development and foreign policy strategy is keeping pace with the evolving environment.

But alongside these plans, we need to strengthen the underpinning systems that provide our resilience to all risks. This UK Government Resilience Framework is our plan to achieve this.

The core of the Framework is built around three fundamental principles: that we need a shared understanding of the risks we face; that we must focus on prevention and preparation; and that resilience requires a whole of society approach.

This Framework is a broad and tangible set of actions. It is the first step in our commitment to develop a wide and strategic approach to resilience. We are committed to working with partners, industry and academia from across the UK to implement this Framework but also as we continue to develop our approach.

A strong resilience system - including UK Government departments, devolved administrations, local authorities, emergency services and the private and voluntary and community sectors - is more important than ever.

Working together to build our national resilience will mean we are better equipped to tackle the challenges that come our way, ensuring businesses grow, our communities thrive and citizens can build a brighter future.

Rt Hon. Oliver Dowden CBE MP

UK Government’s Approach to Resilience

The professionalism and commitment of the people who contribute to the UK’s resilience is extraordinary and we have a well established framework for civil protection in the UK. But the last few years have exposed the need to build on these strong foundations and strengthen our resilience in order to better prevent, mitigate, respond to and recover from the risks facing the nation. That is why the UK Government committed, in the Integrated Review^{[footnote 1]}, to a new Resilience Strategy.

The framework is the first articulation of how the UK Government will deliver on a new strategic approach to resilience. It is based on three core principles:

• A developed and shared understanding of the civil contingencies risks we face is fundamental;

• Prevention rather than cure wherever possible: a greater emphasis on preparation and prevention; and

• Resilience is a ‘whole of society’ endeavour, so we must be more transparent and empower everyone to make a contribution.

This framework focuses on the foundational building blocks of resilience, setting out the plan to 2030 to strengthen the frameworks, systems and capabilities which underpin the UK’s resilience to all civil contingencies risks. The framework’s implementation window reflects the UK Government’s long term commitment to the systemic changes needed to strengthen resilience over time and matches the commitments made in the Integrated Review.^{[footnote 2]} Delivery has already begun and we are making quick progress on our commitments with 12 expected to be completed by 2025 (see Annex B).

It proposes measures and investment to enable the UK’s resilience system to prevent risks manifesting or crises happening where possible. But, while prevention is a key principle, it cannot replace careful and effective management of emergencies as they occur. Some risks are inherently unpredictable, or manifest in unpredictable ways - whether over a wide geographic area, or as a result of a wide range of triggers and/or other risks. For example, we cannot stop substantial rainfall from causing flooding, or entirely eradicate the risk of cyber threats from hostile actors. For this reason, this framework also proposes actions to improve response and preparation for risks and ensure that partners throughout the system are able to play their part fully. There will be a shift away from simply dealing with the effects of emergencies towards a stronger focus on prevention and preparation for risks.

This is just the starting point for the UK Government’s ambitions on resilience. We have already introduced new structures at the heart of the UK Government to focus on resilience and ensure decisions are made with an eye on the challenges we might face. The new Resilience Directorate in the Cabinet Office will drive the implementation of the measures set out in this framework and develop our ongoing resilience programme. This will include building on the National Security Risk Assessment (NSRA) to consider the chronic vulnerabilities and challenges that arise from the geopolitical and geoeconomic shifts, systemic competition, rapid technological change and transnational challenges such as climate change, health risks and state threats that define contemporary crises.

This work will bring together and complement the bespoke plans and programmes of work which manage individual risks and build cross cutting capabilities that underpin resilience across Government. This includes:

• The UK Government 10 Point Plan for a Green Industrial Revolution^{[footnote 3]} and the Net Zero Strategy^{[footnote 4]} set out a clear vision for how the UK Government will transform the production and use of energy, in a decisive shift away from fossil fuels. The British Energy Security Strategy^{[footnote 5]} accelerates this plan, in a series of bold commitments which put Great Britain at the leading edge of the global energy revolution. The Energy Security Strategy will deliver a more independent, more secure energy system and support consumers to manage their energy bills. That Strategy sets out how the UK Government will enhance the use of wind, new nuclear, solar and hydrogen, and support the production of domestic oil and gas in the near term.

• The UK was among the first countries to legislate for climate adaptation and the Climate Change Act provides a strong framework for the UK Government. This includes commitments to produce a UK Climate Change Risk Assessment^{[footnote 6]} to identify risks, followed by a National Adaptation Programme^{[footnote 7]} to address those risks every five years. The UK Government fully recognises the scale of the challenge of adapting to climate change, and is developing a Third National Adaptation Programme (NAP3) which will set out how we will meet that challenge. Having undertaken the Third Climate Change Risk Assessment, the UK Government is committed to significantly increasing efforts to respond to identified risks and opportunities in NAP3.

• The UK Government has developed a Supply Chains Resilience Framework^{[footnote 8]} which highlights 5 areas to explore when building resilience in supply chains. The framework aims to provide a useful guide for both public and private sector organisations in considering potential actions aimed at mitigating risks and vulnerabilities in their supply chains.

• In 2021, the UK Government published the National Cyber Strategy^{[footnote 9]}, building on the National Cyber Security Strategy 2016-2021 and the Integrated Review. A key pillar of the strategy focuses on “building a resilient and prosperous digital UK”. Through this pillar, the Cyber Strategy aims to improve understanding of cyber risk, prevent and resist cyber attacks more effectively, and strengthen resilience at the national, and organisational level, to prepare for, respond to and recover from cyber attacks.

This framework focuses on drawing together the many actors and programmes across the resilience system. The framework primarily outlines action for England and the UK Government in areas where responsibilities are reserved to the UK Government. All four nations of the United Kingdom share the same goal - to protect our citizens from the impacts of crises - and resilience encompasses both reserved and devolved matters. Where elements of the resilience system are overseen by the UK Government, the UK Government is committed to work in partnership with the devolved administrations (DAs). Significant elements of resilience are wholly the responsibilities of the devolved administrations. The resilience arrangements in each part of the UK are set out in Annex A.

Executive Summary

This framework focuses on the UK’s ability to anticipate, assess, prevent, mitigate, respond to, and recover from known, unknown, direct, indirect and emerging civil contingency risks.^{[footnote 10]} It is applicable to building resilience to risks that have a domestic source, and those that have their roots overseas (but which would impact the UK). In this context, the framework uses ‘resilience’ to refer to an ability to withstand or quickly recover from a difficult situation, but also to get ahead of those risks and tackle challenges before they manifest.

The framework is guided by the three core principles which characterise the UK Government’s strategy for resilience:

• A developed and shared understanding of the civil contingencies risks we face is fundamental: it must underpin everything that we do to prepare for and recover from crises. The risks that impact our prosperity and stability are complex and dynamic, and they pose more profound structural and societal questions. We need to adapt the resilience system to face these and incentivise risk-based decision making around our new understanding. This will start with the actions outlined in this document around practical steps to improve our risk system;

• Prevention rather than cure wherever possible: resilience-building spans the whole risk cycle so we must make sure we focus effort across the cycle, particularly before crises happen. It is more cost effective to invest in risk prevention and building resilient systems that can withstand crises rather than to rely solely on having the world’s best crisis response systems. Accomplishing this means putting resilience at the heart of our decision making and investment, well beyond areas that are explicitly focused on emergencies. This framework sets the direction for actions we are already taking to improve the system, with the new standing resilience function in the UK Government taking forward sustained work to identify issues that require action to prevent or mitigate risk; and

• Resilience is a ‘whole of society’ endeavour, so we must be more transparent and empower everyone to make a contribution. We need to prepare and respond to emergencies on a whole of system, whole of society scale. This means organising society in a coherent, resilience-focused way, but also taking a much broader focus on resilience. This includes how we structure the centre of the UK Government, what we expect of businesses, the local tier, voluntary organisations, community groups, and the public.

This framework represents a package of measures to broaden and strengthen the resilience system centred on six themes: risk, responsibility and accountability, partnership, community, investment and skills. For each theme this framework aims to demonstrate how our proposals will deliver tangible changes and benefits for those working in the resilience system and the public. A list summarising the actions we will take is at Annex B.

By 2030:

• Our understanding of national and local risks will be dynamic, driven by data and insight where appropriate, and informed by the best UK and international expertise and experience. Within the UK Government there will be clear ownership of all risks, including complex and catastrophic risks, underpinned by sharpened governance and accountability. The UK Government will communicate about risk in an accessible, actionable and transparent way, so that everyone understands the risks they should plan for and how to protect themselves. Decision making on risk by ministers and officials will be informed by dynamic and expert data and insight, and will take into account underlying vulnerabilities in communities impacted by risks.

• In every part of the resilience system, responsibilities and accountability will be clear, coordinated, and coherent. The crisis management and resilience capabilities within the UK Government will be overhauled and strengthened. Local Resilience Forums in England will be strengthened and enhanced, in recognition of the vital role they play in resilience. The UK Government will have the emergency powers we need to act decisively in a crisis. Standards will be introduced throughout the public sector, to drive continuous improvement in preparedness.

• Partnerships with the private sector and experts will be strengthened to deliver and inform vital work on resilience. To support a new way of partnership working with the private sector, the UK Government will provide guidance on risk in order to help the private sector to meet new standards on resilience. These standards will be enforced through regulation only in the highest priority cases. The UK Government will build on existing structures to draw in external expertise and challenge to ensure that our approach is based on wide ranging knowledge and experience. The UK Government will continue to show leadership on resilience through international fora and through strong bilateral relationships, recognising the risks we face are part of an interconnected world. This will include providing support to international partners to build their own resilience, and working together to tackle risks before they manifest.

• A strengthened partnership with the Voluntary and Community Sector will support them to maximise their contribution to resilience at local and national level. Recognising the importance of protecting communities from the impacts of emergencies and crises, the UK Government will strengthen standards for statutory responders in England to consider community resilience as an essential part of their work. Support for vulnerable groups will be improved through better guidance for the local tier, and through work with the operators of essential services to identify and support vulnerable customers in an emergency.

• Resilience investment decisions in the UK Government will be underpinned by a shared understanding of risk and priorities, allowing a better and more efficient use of our capabilities and resources. Models of funding for Local Resilience Forums (LRFs) in England will be reviewed to ensure they are appropriate to the expectations placed upon them. The UK Government will incentivise further investment in resilience by the private sector through sharing better information on risk, to inform investment decisions. Better information on risk will also help communities and households to decide how to invest in their own preparedness.

• A new Resilience Academy built out of the Emergency Planning College and skills and training pathway will ensure that all those who work on resilience have the capability and knowledge they need to play their part. A reinvigorated National Exercising Programme will test preparedness throughout the resilience system.

This work will be driven by the UK Government’s new standing resilience function, the Resilience Directorate, and delivery has already begun. There are many actions in the framework that the Government is committed to delivering in the next year, including the first annual statement to Parliament on civil contingency risk and resilience, launching the UK Resilience Academy and appointing a Head of Resilience.

The UK Government is committed to working in partnership with the devolved administrations to implement change across the four nations where appropriate. The direct scope of the framework is action for England, UK Government departments and in areas where responsibilities in Scotland, Wales and Northern Ireland are reserved to the UK Government. Nevertheless, there are clearly areas where alignment and shared objectives will deliver a better result for the four nations. The end of each chapter outlines the applicability of the proposals across the UK.

Our action plan: Risk

On risk, we are already taking action by:

• Refreshing the National Security Risk Assessment (NSRA) process, so it will look over a longer timescale, include multiple scenarios, look at chronic risks and interdependencies and use the widest possible range of relevant data and insight alongside external challenge.

• Creating a new Head of Resilience, to guide best practice, encourage adherence to standards, and set guidance.

By 2025, we will:

• Clarify roles and responsibilities in the UK Government for each NSRA risk, to drive activity across the risk lifecycle.

• Conduct an annual survey of public perceptions of risk, resilience and preparedness.

• Introduce an Annual Statement to Parliament on civil contingencies risk and the UK Government’s performance on resilience.

• Develop a measurement of socio-economic resilience, including how risks impact across communities and vulnerable groups - to guide and inform decision making on risk and resilience.

By 2030, we will:

• Make the UK Government’s communications on risk more relevant and easily accessible.

The starting point of all resilience work is understanding risk. In this framework we use ‘risk’ to refer to civil contingency risk.^{[footnote 1]} A risk can be any event that poses a serious threat to safety and security of livelihoods either locally or nationally, this can include, amongst others, threats to lives; health; critical infrastructure; economy; and sovereignty. These risks can be acute (e.g. flooding and terrorist attacks) or chronic (e.g. an enduring health emergency or serious and organised crime).

In all parts of the resilience system, we are driven by the risks we face. Those risks determine which capabilities we need, which skills we need to develop, who we need to work with, how we invest our money, how we act in a crisis, and how we best recover from crises and emergencies. Some risks are well understood and are relatively easy to measure and predict, whilst others currently remain unknown and can only be identified in advance through sustained research and analysis across multiple fields of expertise. For this reason, we will always need to consider the right balance between risk-specific capabilities and cross-cutting capabilities to ensure we can be as prepared as possible for the widest possible range of risks. This framework focuses on the cross-cutting capabilities that are delivered through the resilience system, with risk-specific capabilities addressed through work being conducted across the UK Government and by partners.

The risks that influence our prosperity and stability are complex, evolving, and sometimes uncertain and this raises profound structural and societal questions. The UK Government needs to adapt the system to face these and incentivise risk-based decision making. To achieve this, we will make the UK Government’s risk assessment more dynamic and insight- and foresight-led, taking greater account of complex, cascading and chronic risks. Central to this will be working closely with LRFs in England as well as wider partners to ensure they can make full use of these new assessments.

Alongside the framework for approaching civil contingency risks outlined here, the UK Government will work with the Government Risk Profession and the Government Risk Centre of Excellence to ensure appropriate cohesion and collaboration with the broader risk management community across the UK Government and the wider resilience sector. The Head of the Government Risk Profession will work closely with the new Head of Resilience, introduced later in this chapter. Further, the approach to assessment of civil contingency risk outlined in this chapter will complement broader risk management practices in the public sector, as outlined in the HM Treasury Orange Book^{[footnote 12]}.

Risk Assessment

Understanding civil contingencies risk is essential to everything we do, and our risk assessment methodology and processes are how we do this. Most risks are, by their nature, dynamic and hard to predict. We cannot therefore always perfectly predict how risks develop and manifest. But as the global risk picture evolves, and the impacts become more interconnected and complex, the way that we assess risk must also evolve. Assessment must be based on a wide range of relevant data, information and insight, and must be carried out on a timeline that bears proportionate relation to how risks develop.

The National Security Risk Assessment

The National Security Risk Assessment (NSRA) will remain the main tool for assessing the most serious civil contingencies risks facing the UK. The NSRA assesses, compares and prioritises the top national level risks facing the UK, focusing on both likelihood of the risk occurring and the impact it would have, were it to happen. This remains an invaluable tool for policy makers and operational leaders to form contingency plans for a wide range of scenarios that might impact on a national or local level.

In the last year, the UK Government has led the most substantial review of the NSRA since its inception (in the early 2000s), in conjunction with the Royal Academy of Engineering. Although the fundamentals of the NSRA remain solid, we have identified a set of significant and ambitious changes to ensure the NSRA is comprehensive, robust and incorporates extensive expert challenge. The UK Government’s ambition is to create an NSRA process which readily invites external challenge from experts, academia, industry and the international risk community. Relevant information from the NSRA, sensitivity permitting, will be openly available to the public. By doing this we can maintain the UK’s reputation as exponents of best practice in national risk assessment. To achieve this, the UK Government will work to make sure that the NSRA:

• includes clearer separate consideration of the interplay between acute and chronic risks as they require different planning and responses and are not equally measured through an identical process. Currently both are included in the assessment. However, we will do more to differentiate our approach to these two categories of risk in order to aid better planning. Linked to this, risks with significantly different planning and/or responses in their different manifestations will be represented by multiple scenarios in the NSRA, to aid planning against a wider range of possible impacts. Across all risks under the NSRA, we will improve how we factor in consideration of impacts and vulnerabilities to produce more accurate overall judgements.

• Uses the widest possible range of relevant data and insight. For example, the National Situation Centre will expand the data sources on which the NSRA risk assessment is based. The UK Government will also increase the role of external expertise in the NSRA process.

• lengthens the timescale over which risks are measured. It is currently over a two year period for most risks but we will look to measure some risks over a five year period where appropriate, while still providing a robust assessment of likelihood. We will identify the most efficient way to visualise risks measured over different timescales on the same matrix.

Further to these changes, in the longer term the UK Government will move towards making the NSRA a more live and interactive product, in order to provide resilience practitioners and policymakers at national and local levels with better risk assessment to inform their work. The benefits of this approach will be reflected in the National Risk Register (NRR), which is the publicly available counterpart of the NSRA and is important in communicating about risk with resilience practitioners.

Wider UK Government Risk assessment

While the NSRA remains our core centralised risk assessment tool, it is not the only government product that helps us to understand the civil contingencies risks we face. Looking beyond the timescales of the NSRA, there are forward-looking projects such as the Government Office for Science’s Resilience Foresight project^{[footnote 13]}, which identifies long-term governance, economy, social, technology and environmental trends that impact on risk and resilience, while its Trend Deck^{[footnote 14]} sets out the broader evidence, trends and context for policy makers. The GO-Science Futures Toolkit^{[footnote 15]} and Institute of Risk Management Horizon scanning: A Practitioner’s Guide^{[footnote 16]} show how trends can be used in foresight approaches to anticipate change and reduce uncertainty. The UK Government will use these tools within our risk and resilience planning to extend our risk horizon scanning and to improve the long-term resilience of government policy. We will also consider the value in making these or similar products available to key resilience partners to support their own risk and resilience planning.

The UK Government has many centres of risk assessment expertise spread across departments, agencies and arm’s length bodies. One example is the Committee on Climate Change, an independent, statutory body, established under the Climate Change Act 2008 which advises the UK Government and devolved administrations on greenhouse gas emissions targets and climate risks and opportunities. It also monitors progress in achieving UK Government and devolved administration carbon budgets and emissions targets and implementing adaptation policies. We can and will do more to ensure that all these and wider sources of information and expertise are fed into our understanding of risk in a more coordinated and effective way. In addition to the commitments around the NSRA, the UK Government will work towards sharing risk assessment with partners throughout the resilience system (including those outside of government) as our default position, accepting that there will still be times when sensitive information will have to remain within government.

Risk Ownership

The UK Government’s ownership model on risk must ensure that all civil contingencies risks are appropriately and effectively managed and funded through all parts of the risk cycle. Effective and clear ownership of risk is not only important in a crisis, but also in planning for and recovering from it. It is vital that the government understands risks, how they might manifest, what impacts they have and which capabilities are available to tackle them.

The UK Government will continue to use the Lead Government Department model to guide risk ownership, but there will be further clarification of roles and responsibilities for complex risks. Currently, NSRA risks are primarily owned and managed within Lead Government Departments (LGDs), although LGDs must work with a range of departments and regulators to make sure they are well understood, managed and invested in across the risk lifecycle. Additional coordination or support comes from the Cabinet Office at times of crisis, particularly when the impact of a risk crosses sectors or is particularly geographically widespread. This model works well in principle, and in practice, in the vast majority of cases. But there are also limitations of the LGD model, particularly where risks become more complex, meaning that their impacts can cross departmental and sectoral boundaries. For example, the response to COVID-19 demonstrated the challenge for a single part of government leading on an emergency which reached deeply into all parts of the economy and society, and required leadership from all parts of government. Although there was an understanding of the risk of pandemic flu, treating it as a health emergency meant that there was limited planning outside of the healthcare sector.

To ensure, therefore, that all risk continues to be fully owned and managed, the UK Government will clarify roles and responsibilities for all NSRA risks. This is not a radical change to the LGD model and will continue to be underpinned by the core principles of subsidiarity and local leadership. However, we will review existing LGD responsibilities, ensure responsibilities are placed with those best placed to discharge them and provide clarity in accountability and responsibility for the small number of risks where ownership is less clear (e.g. where they currently span departments or are cascading risks). This will help the Cabinet Office and departments to support each other more effectively. For many risks, this will simply formalise and complement existing roles and responsibilities for owning risk, however for some risks we may need a bespoke model and for a small number of complex or catastrophic risks we may need a change to roles and responsibilities. This work will not create conflict with other duties or impinge on regulatory independence, particularly risks are owned by a department or Arms Length Body that has regulatory responsibilities for aspects of the risk cycle or for responders and other involved parties.

LGDs will continue to be responsible for driving activity across the risk lifecycle, including with other LGDs where relevant, and coordinating across government and partners as needed - particularly when it cuts across departmental boundaries. While good collaboration will continue to be vital, departments will need clear levers to ensure that they can take action.

While the LGDs are responsible for ensuring there are adequate plans and capabilities to manage their NSRA risks, as part of our efforts on risk ownership, the UK Government will create a new Head of Resilience role to provide leadership for this system. This new role will guide best practice, support adherence to resilience standards, and test planning in a meaningful and proportionate way to support the LGD model. The Head of Resilience will complement the existing role of the National Security Advisor (NSA). The UK Government will ensure that a Head of Resilience will not duplicate or cut across the responsibilities of existing senior officials or LGDs but will provide leadership for the system. They would also not cut across the responsibilities of the devolved administrations, but would work with them in partnership.

Risk Communications

Working out how to appropriately tailor risk communications and the sharing of information on risk is complex. In some cases it can be important to share information in a broadly consistent way across all groups, in other cases different partners and groups will need different information about different risks. Similarly the levels of detail that will be needed or expected will vary. As an example, large corporations may need detailed and technical advice on cyber security, but this advice would be of no practical use to most individuals, who would be better served by general advice on good online security behaviours. Specialist advice is already available for many sectors and organisations. For example, the ​​Emergency planning and response for education, childcare, and children’s social care settings guidance^{[footnote 17]} sets out how educational and childcare settings should plan for and deal with emergencies, and focuses on minimising the amount and length of any disruption to education or childcare.

Government communications on risks should draw on evidence-based principles for communications in an emergency; be transparent, accessible, diverse in platform, and tailored for the diverse audiences that we need to reach; as well as being designed in consultation with different socio demographic, vulnerable and at-risk groups who will require tailored approaches. They should also draw on ‘trusted voices’, recognising that those partnerships are often the best way of reaching audiences.

The UK Government will improve its communication of risk, focussing on personalisation (for organisations and individuals) as a means to ensure that organisations and individuals have access to relevant, actionable information. We will work closely with both national and local partners to develop and deliver these messages, as well as supporting partners to develop and deliver their own communications campaigns. The UK Government will not only communicate about the risk itself, but also the impacts of the risk so people better understand what they may actually see or experience, and the action that people can take to protect themselves and their communities. The UK Government will also be clear about the reasons why government cannot be transparent in discussing all risks, such as for reasons of commercial sensitivity or national security.

Vulnerable and at-risk groups and communities are often most impacted by risk materialisation, as seen in the current rise in the cost of living. The UK Government will develop appropriate communications on civil contingencies risks for disproportionately affected populations, engaging with these groups to better understand their barriers to action and developing co-produced materials for use in risk planning and response. Working with local and national partners and those in these communities will be crucial to this. Developing tailored communications will also include how to avoid stigmatising particular communities.To support the UK Government’s risk communications and ensure they are appropriately targeted, the UK Government will conduct an annual survey of public perceptions of risk, resilience and preparedness that uses a representative sample of the population. This will ensure the risk communications strategy is built on an understanding of how aware the public is of the risks we face and how prepared they are for emergencies.

The UK Government will increase public accountability on risk, to ensure that risks continue to be adequately assessed and prepared for. This will start with the introduction of an Annual Statement to Parliament on civil contingencies risks and our performance on resilience. This Statement will include the government’s understanding of the current risk picture, performance on resilience and current state of preparedness. This will represent a shift in our transparency on risk, and will complement the more technical risk information provided to practitioners. It will also provide a public baseline for work on civil contingencies across the public and private sectors.

The UK Government will develop proposals to make our communications on risk personalised, and more relevant, actionable and easily accessible. Currently, advice from the UK Government on specific risks is available through a range of gov.uk pages which are successful in their own right, but are not necessarily easily accessible beyond their defined target audiences ​​and do not give a holistic view when considering whole-of-society risks. UK Government departments also deliver communications campaigns on the risks that they own. For example, the FCDO’s Travel Aware campaign provides easily accessible and dynamic travel advice, and its reach is increasing annually. However, this means that organisations and citizens who are not already formally part of the resilience system, or are not proactively searching for information on a risk, may find it difficult to access the information that is useful to them.

Making advice on risk more directly accessible to the public will not only improve the visibility of information on risk, but will also include an element of personalisation so that individuals, households and organisations have actionable information on how they can prepare for the risks that might impact them. There are already some examples such as Ready Scotland^{[footnote 18]}, a Scottish Government website, providing relevant and actionable information for citizens and businesses in Scotland.

The National Risk Register (NRR) remains an important way for the government to communicate about risk with resilience practitioners. The NRR is the publicly available counterpart of the NSRA, aimed at providing detailed information for those with formal contingency planning responsibilities at a national and local level. The UK Government will reform the NRR, and include more information from the NSRA to make it more useful to practitioners and ensure this product is shared proactively with them and the wider public. The UK Government will also ensure the NRR is usable by local resilience partners, Small and Medium-sized Enterprises and community VCS organisations, by better detailing the common types of disruption that could impact their business continuity.

The National Risk Register is complemented by Community Risk Registers (CRR), which are produced by the local tier. CRRs are based on the NSRA, risk assessments in the devolved administrations (such as the Scottish Risk Assessment and the Northern Ireland Civil Contingencies Risk Register), and the NRR, but focus on the risks that are the highest priority in each local area. The production and use of CRRs is the responsibility of local resilience partners (including LRFs). However, as set out in the CCA Post Implementation Review 2022^{[footnote 19]} and as part of the wider strengthening of LRFs in England, the UK Government will strengthen the requirements around the production of the CRR so that responders consider community demographics, particularly vulnerable groups. As a first step, the improvements made to the NSRA and NRR should in turn make CRRs more dynamic and better aid local contingency planning. The UK Government will continue to review how it can support local responders to better communicate risks to the communities they serve and to tailor communications.

Using data to better embed risk in decision making

The UK risk picture is constantly changing. Modern technology means that we are better able to keep up, and to gather, analyse and visualise vast amounts of data to better understand and protect our vulnerabilities and identify how and where civil contingencies risks may manifest. It is important that decision-makers and experts have access to the right information at the right time during an emergency. This requires us to continue to improve our understanding of data flows, ownership, and interoperability as part of our preparedness. But quality matters as much as quantity, and the UK Government will continue to make improvements in the data and analysis that supports our decision making on risk, in advance of and during a crisis. The UK Government will also use external experts to test and challenge thinking on risk and resilience (more detail in the Partnerships chapter).

The National Situation Centre

The National Situation Centre (SitCen) within the Cabinet Office has been established to bring data, analysis and expertise together for crisis management. Announced as part of the Integrated Review^{[footnote 20]}, and drawing upon lessons learned from the COVID-19 pandemic, the SitCen has accelerated the UK Government’s journey of modernisation and use of data and wider information and insight. The UK Government will continue to deliver a step change in the use of data to assess risk and support the UK Government’s crisis response. By continuing to develop the National Situation Centre, we will continue work in proactively identifying, monitoring and managing risks. Framed around the NSRA, the SitCen brings together expertise and a range of government, international, local, national and commercial data feeds to provide a holistic picture. The unique value of the SitCen is its ability to understand the intersection of multiple risks and provide insights at pace due to its preparatory work and automated data pipelines. Key to this is the SitCen’s data map, which can visualise how data feeds, risks and impacts interact.

The SitCen started operating on 30 September 2021 and has already made a step change in the speed at which data is drawn together, analysed and made available across the government. During the UK Government’s response to Russia’s invasion of Ukraine in early 2022, the SitCen acted as a central point for data, insights and analysis on international, national security and domestic implications.

A focus on continuous capability development and innovation is core to the SitCen’s future evolution. In terms of internal systems, greater automation is a near term goal, leading to use of machine learning techniques to create models capable of testing, refining and expanding linkages between data sets, which may ultimately pave the way for the creation of digital replicas of the real world, known as digital twins or synthetic environments. Looking more broadly it is important that we consider the wider systems in which we operate and the partners who both act as key sources of data and information and who may come to be key users of outputs and analysis. Our ambition is to be able to draw in relevant data points from across the private and public sector, including Local Resilience Forums in England where we will support them in building their capacity and capability as a key part of their strengthening.

This is underpinned by the SitCen’s data strategy, which maps public and private sector data against the NSRA risks. This supports more effective and rapid deployment of data during crisis response, as well as improving resilience by identifying and addressing data gaps. The SitCen regularly convenes a cross-government network of crisis data experts to support this, and to promote resilience through best practice for using data in crisis response.

Social Vulnerability

With the UK facing an increasingly complex risk landscape, it is critical that the UK Government is able to fully utilise all available information both before and during crises. If we are to improve resilience across the whole of society and make targeted interventions during crises, we must ensure we understand which groups are acutely vulnerable to local and national risks.

Improving the use and sharing of data, analysis and insight will allow us to improve our understanding of how different groups and communities might be affected by emergencies and give planners and responders the information they need to understand and serve their communities at all stages of the resilience cycle.

The UK Government has always known that risks do not impact communities equally across the UK for a wide variety of factors. Recently, we have seen that the impacts of COVID-19 had a disproportionate impact on ethnic minority and low income groups. Plans and preparations must reflect this and enable us to better plan, prepare, respond and recover from crises.

To support that, the UK Government, with input from Local Resilience Forums in England and wider partners, will develop a measurement of socio-economic resilience and vulnerability to key civil contingencies risks, including how civil contingency risks and emergencies impact across communities and vulnerable groups, to guide and inform decision making on risk and resilience. This measurement will need to be driven by a nuanced view of vulnerability and the factors that can cause vulnerability, and will be informed by behavioural and social science evidence. This tool will use new and existing data to provide a snapshot of the key characteristics of local areas, and build the evidence base on how risks and emergencies have impacted across communities and vulnerable groups and assess where there may be particular vulnerabilities to civil contingencies risks. The devolved administrations will also be encouraged to participate where beneficial. The tool will:

• support the UK Government LGDs in understanding how the implications of their risks materialising will impact communities differently and ensure that their prevention and planning takes into account these differentiations.

• offer a key tool in developing targeted communications strategies and offer a degree of personalisation in the risk information available to the public.

• be an open tool that LRFs in England and the wider local tier and voluntary and community sector will be able to use to support their own work.

• enable stress-testing of national (LGD) contingency plans and be able to add depth to exercising through the National Exercise Programme (see Skills chapter).

---

Applicability across the UK

Some of the actions proposed in this, and the following chapters, will be the responsibility of the UK Government, some will be the joint responsibilities of the UK Government and the devolved administrations, and some wholly the responsibilities of the devolved administrations. At the time of publication, it is anticipated that:

• The DAs will remain involved in the production of the NSRA, and will continue to use it to inform their own activity.

• The principle of risk transparency is shared with the DAs, but for specific products the decision on transparency will sit with existing owners.

• Changes to risk ownership and governance within the UK Government will not directly change any arrangements inside the DAs, although the UK Government will be mindful of any adjustments needed in working practices as a result of these internal developments.

• The Annual Statement to Parliament on civil contingencies risk will be produced by the UK Government, and will cover risks that impact reserved competencies and international risks. In this context, it will refer to joint working with the DAs on these risks.

• Improvements to risk communications will be developed by the UK Government and will be accessible to residents in all four nations. These will also draw on advice provided by the DAs.

• The proposed measure of Social Vulnerability will draw on ONS data covering all four nations and will be an open tool, accessible to the DAs. The UK Government would welcome additional data from the DAs.

Our action plan: Responsibilities and Accountability

On responsibilities and accountability, we are already taking action by:

• Strengthening UK Government resilience structures by creating a new resilience function to deliver longer term capability building and risk mitigation to work alongside the UK Government’s crisis management infrastructure.

By 2025, we will:

• Expand the scope and use of standards and assurance in the public sector to support better contingency planning and risk management.

• Run a pilot across three key pillars of reform to significantly strengthen Local Resilience Forums (LRFs) in England: Leadership, Accountability, and Integration of resilience into the UK’s levelling up mission.

By 2030, we will:

• Work across three key pillars of reform to significantly strengthen LRFs in England: Leadership, Accountability, and Integration of resilience into the UK’s levelling up mission.

The approach to resilience within the UK public sector is driven by the efforts of UK Government departments, arm’s length bodies and agencies, devolved administrations, local authorities, LRFs and a wide range of responders. The extensive efforts of the private and voluntary and community sectors are covered in the Partnerships chapter. In planning, preparing, responding and recovering from emergencies it is essential for each part of the system to understand their role and specific responsibilities.

Our strategic approach will continue on the basis of where responsibility and accountability lies in the system, but this framework will further clarify and develop the roles and responsibilities of the UK Government, LRFs and the wider Local Tier, all Category 1 and 2 responders and the Military. In some cases this framework outlines new or strengthened roles and responsibilities and makes those accountable for resilience more visible to local communities. The responsibilities of the devolved administrations in resilience will remain unaltered, but the UK Government will continue to support a strong and clear understanding throughout the resilience system of the vital role that the devolved administrations play in the UK’s resilience. The framework underpinning UK resilience is the Civil Contingencies Act (CCA) 2004 and this together with clearer expectations will enable all parts of the system, across the whole resilience cycle, to work together with renewed clarity and confidence.

UK Government

The UK Government will continue to provide leadership across the resilience cycle, but its responsibilities will be clarified and, in some cases formalised, to provide clarity to other partners. The Lead Government Department (LGD) model will continue to guide responsibilities on resilience, as covered in the Risk chapter. The devolved administrations will continue to lead on devolved areas of resilience policy and practice.

Crisis Management in the UK Government

We will significantly overhaul UK Government resilience structures to ensure that we can draw on world class capabilities and resources during an emergency, whilst in parallel delivering longer term capability building and risk mitigation. This will ensure that we have dedicated resource across the risk cycle from assessment, prevention and preparation to response, recovery and lessons capture.

Throughout numerous domestic and international crises - the Salisbury attack, the Russian invasion of Ukraine, terrorist attacks, and floods - the UK Government has proven its ability to quickly stand up a world class response. However, this range of recent emergencies has naturally tested our existing arrangements. While we have been able to successfully provide an effective response, there is no room for complacency. We need to continue to build our collective resilience, bolstering our existing strengths and preparedness and continue to strengthen our ability to anticipate, prevent, prepare, respond and recover from emergencies.

To do this, we have refocused our work on prevention and preparation by creating a dedicated function for resilience, the Resilience Directorate, to focus on the prevention and mitigation of both acute and chronic risks rather than only dealing with the consequences of crises.

The new Resilience Directorate sits at the heart of UK Government and takes a strategic approach to economic and societal resilience, overseeing how we are tackling both acute and chronic risks in order to make the UK a stable and safe place to live and work. It drives the implementation of the measures set out in this framework and also works across government to develop a programme of action to bolster critical cross cutting capabilities, building on successful work to date such as supply chain resilience. It gives the UK Government the opportunity to properly focus on major challenges, anticipating and properly preparing for the crises of the future.

The new Resilience Directorate works alongside the UK Government’s crisis management infrastructure, which has been developed over many years, and is highly regarded internationally. This separate crisis management function - COBR Unit - leads the UK Government’s response to acute emergencies and drives further professionalisation of emergency management in government. Delivery capacity and capability will be uplifted by crisis teams and resources that are composed of crisis professionals, with the time and resource to prepare and exercise their capabilities, to ensure that they can respond whenever needed. Key to this is the need to make sure that while the Cabinet Office must have the right crisis structure, ownership of risk and crisis roles must also be clear between departments. The new approach to risk ownership outlined in the Risk chapter will be part of this ongoing management of risk within government, but our new crisis structures also makes sure that this ownership is reflected in protocol and responsibilities during an emergency.

The UK Government will continue to invest in our crisis response infrastructure at the centre of the UK Government, to maintain the momentum of improvements in the use of data and technology, alongside maintaining the necessary security to protect discussions appropriately. The system is designed to be flexible and has been repeatedly adapted to meet a changing risk landscape with subsidiarity at its core. The UK Government Concept of Operations (CONOPs)^{[footnote 21]} describes the UK response model and this will be updated to reflect this framework shortly after publication. The Cabinet Office Briefing Rooms (COBR) remain the key mechanism through which the UK Government responds quickly to emergencies that require decisions urgently. A resilient environment for strategic decision-making during crises, COBR brings people together to respond to domestic and international emergencies affecting UK interests. The UK Government has already launched a new National Situation Centre in 2021 to enhance our data analysis and visualisation capabilities. The UK Government also brought a series of planned infrastructure improvements in COBR into service to better support decision making discussions.

The UK Government will continue to maintain a number of specialist central crisis management capabilities, across the command, control and communications (C3) spectrum. A current example of this is the Resilient Satellite Network (RSN) which provides an alternative form of communication during a scenario when terrestrial communication has been disrupted. The system is placed in Police HQs, certain UK Government departments and Civil Contingency offices across the four nations. Consequently, the system ensures stable communications with those who lead crisis response in the most challenging scenarios.

The UK Government will shortly introduce a new system of Emergency Alerts. This system is already used internationally, and is expected to launch in early 2023. It will allow government organisations and emergency responders to send alerts, with a distinctive message appearance and tone, to every compatible mobile device (over  85% of 4G/5G smartphones released since 2015) within a chosen geographical area at very short notice (typically seconds), providing a highly flexible capability for informing and where appropriate prompting rapid action from the public in the vicinity of a life-threatening incident. Their key attributes are speed of delivery and versatility- they can be used in any life-threatening situation where the public need to be given life-saving information.

Formalising UK Government Departments’ Responsibilities

There are excellent examples of partners throughout the system working together openly and seamlessly during an emergency, but too often we have found that this is dependent on individuals or informally agreed ways of working. While this can be effective, we need greater assurance that we can depend on vital links between local and national partners working effectively. For most parts of the resilience system there are duties to set expectations about how essential parts of the system carry out their roles to the necessary standard, which in turn ensures that the system as a whole can function.

The UK Government should not be an exception to this. One of the functions that UK Government departments must carry out is to effectively share appropriate information with the local tier. While some information is sensitive and this should continue to be protected, there is more we will do to share information about risk with all our partners. But supporting and guiding contingency planning in local areas goes beyond just sharing aspects of the NSRA. At any point in an emergency - whether it is as a risk is starting to materialise, or when recovery efforts begin - it is essential that the local tier is able to access the information it needs in order to make informed local decisions. Too often, we have heard that the UK Government is slow to keep local responders informed in an emergency, which hinders efforts on the ground.

The UK Government will consider a range of options for improving this and develop an action plan to deliver these, including by developing proposals for formalising duties on UK Government departments, particularly in respect of working with Local Resilience Forums and wider local responders in England on resilience across the whole resilience cycle. Any new duty would be subject to an impact assessment, to ensure that it did not place a counterproductive burden on the UK Government department and would not alter the fundamental roles of either the UK Government or the devolved administrations on resilience.

In addition, as part of a renewed effort to improve working between the UK Government and local partners, all UK Government departments must make sure that they have appropriate fora and mechanisms for working with local responders, and that all guidance is up to date and effective.

The Local Tier & Local Resilience Forums

The multi-agency work across planning, preparation, response and recovery at the local level will continue to be the building block of the UK’s resilience. All risks and emergencies and their impacts are local; only some are regional or national. The 38 Local Resilience Forums (LRFs) in England, the four LRFs in Wales, three Regional Resilience Partnerships (RRPs) in Scotland and Emergency Preparedness Groups (EPGs) in Northern Ireland play a critical role in bringing local responders, such as the emergency services, together to plan and prepare for emergencies. They are supported by the common framework for multi-agency working provided by the CCA drawing together individual Category 1 and 2 responders.^{[footnote 22]}

In England, the LRF multi-agency model plans and prepares for risks and emergencies; leads multi-agency response and recovery activity through the standing up of Strategic Coordination Groups and Recovery Coordination Groups; and coordinates support for communities. The recent Post Implementation Review of the CCA^{[footnote 23]} made clear that the core principles of subsidiarity and local leadership remain critical. However, we must recognise that expectations and pressures on local resilience structures have grown significantly over recent years, and that this is unlikely to change in the future.

The UK Government remains fully committed to working closely with the devolved administrations to ensure integration of respective approaches, share best practice and learning, and ensure strong cross-border collaboration – delivering on our duty to protect citizens in every part of the UK. The devolved administrations have their own established and effective local resilience partnerships, and these will not be impacted by the planned strengthening of English LRFs.

Building resilient places and communities will be critical in our mission to Level Up and drive growth across the United Kingdom. Risks, emergencies, and disruptive events can damage local economies and limit new investment, reducing the potential of areas to take advantage of the opportunities of levelling up and the new global Britain. We also see that disruptive events can affect different areas in different ways, with the most vulnerable often the most severely affected. Empowering local areas and communities to build their resilience, including providing appropriate additional support to the most vulnerable, will enable our places and communities to be better prepared and able to respond to and recover from emergencies. This in turn has the potential to reduce the overall impact, disruption, and cost of adverse events, as well as reducing key vulnerabilities in communities and places.

The ambition for change in England

In recognition of the central, and growing, role of LRFs and to ensure that all parts of England can anticipate, prevent, prepare for, respond and recover from risks and emergencies, the UK Government will work to significantly strengthen LRFs. There are three key pillars to this reform: Leadership, Accountability, and Integration of resilience into the UK’s levelling up and growth mission and wider local policy and place making. Recognising the scale of this change, the UK Government will work closely with the sector and begin with a programme of piloting and trailblazer projects.

The aim is to empower LRFs, local partners and local leaders to consider, drive and improve resilience across the places for which they are responsible. They will be given a clear mandate to support the building of more resilient communities and places that are best able to adapt and respond to, and recover from risks, emergencies and disruptive events and to take full advantage of the opportunities of levelling up. This will include identifying those communities most vulnerable to key risks and addressing these vulnerabilities to build their resilience.

Leadership of LRFs in England

As the role and expectations on LRFs have grown to meet the varied challenges of recent years, so too has the role of LRF Chairs. For many years LRFs have been led to great effect by committed senior leaders drawn from a variety of responder organisations, including the Police, Fire Service and Local Authorities. This has typically been as part of a wider role within their organisations that included a range of other duties and responsibilities. The UK Government will work with LRFs and their members to ensure LRF leaders have the resources, capacity, and capability to sustain this work as they engage with an ever more challenging risk landscape and drive resilience in their areas.

It is critical to the success of LRFs that senior leaders from the organisations outlined in the CCA and beyond continue to take a key leadership role in the work of LRFs. It is equally vital to ensure that LRF Chairs have the capacity and capability to lead LRFs in delivery of the strengthened roles and responsibilities we are proposing. They will need the time and space to fully embed themselves and their LRFs in wider local structures – including working in close partnership with locally elected democratic leaders and the full range of senior leaders across local government and responder organisations. To best enable this, the UK Government will work with the sector to pilot evolving the nature of the LRF Chair role, including considering a full time permanent role occupied by an appropriately qualified and experienced individual who will become the Chief Resilience Officer (CRO) for each LRF area. The LRF CRO should be provided with the resources, support, mandate and levers to bring together the full range of partners to drive and enhance resilience in their areas and we will work with the sector to consider how best we can do this. The LRF CRO will be distinct from the UK Government Head of Resilience role discussed in the Risk chapter, with both having complementary leadership roles across the resilience system.

The UK Government will set clear expectations for LRF Chief Resilience Officers to lead the building of resilience and delivery of resilience activity in their areas and they will be accountable to executive local democratic leaders. This will give these democratic leaders a clear role in ensuring effective delivery of resilience activity, including integrating resilience into wider local delivery and levelling up.

As set out in the 2022 Post Implementation Review of the CCA^{[footnote 24]}, at present the fulfilment of the duties of the Act by Category 1 and 2 responders remains fit for purpose. However, we recognise that the evolving risk landscape, and the ambition to strengthen LRFs in England may require future consideration and may necessitate future changes to underpinning legislation and regulatory frameworks.

Accountability for LRFs in England

Strengthening the accountability and assurance across LRFs in England will ensure local leaders have key tools to drive the building of resilience and multi-agency collaboration in their communities. Clear mechanisms and expectations for accountability between LRF Chief Resilience Officers and executive local democratic leaders will make LRFs more accountable to the communities that they serve and provide a mechanism for local communities to hold local leaders to account for driving and delivering resilience.

To support this, we will consider the best way to develop a means of stronger assurance of LRF collective delivery in England, including auditable frameworks, to set and drive standards and support local places to develop their resilience whilst providing assurance of levels of resilience across the LRF system and England as a whole. We will build the assessment of resilience activity into the inspection and audit regimes of individual responders, working closely with the relevant assurance and inspection bodies. Alongside this we will establish clear mechanisms for the assurance of the multi-agency activity at LRF level. This will give local leaders new information and tools to understand the impact of their work, identify areas for improvement or mitigate risk or vulnerability by targeting resilience activity.

The introduction of new assurance activity will contribute to continuous improvement in emergency management, provide further opportunities to celebrate and share good or best practice and crucially address emerging risk through early mitigation measures or prevention activity. Alongside this it will enable the UK Government to consider the level of support that may be required (before, during or after an emergency) to assist the local level at any stage of the resilience cycle.

Integration of Resilience into Local policy and place making in England

The UK Government needs to build a solid foundation of resilient communities and places, drawing on the full range of national and local levers. This means placing resilience at the heart of levelling up and wider place making. This will ensure that all areas can take advantage of the opportunities this affords, tackle key vulnerabilities, and minimise the potential for risks and emergencies to stop areas achieving their full potential. The UK Government will empower the new LRF CRO and the local elected leaders work across the full range of local policy making and delivery to make the building and delivery of resilience central to wider place making, including other key policy areas such as Net Zero and Build Back Better.

Resilience will be included as a key aspect of the regional devolution deals in England being delivered as a part of levelling up, with local areas taking formal responsibility for building and delivering local resilience. The UK Government will work with areas not preparing a devolution deal to integrate resilience into wider delivery including, as appropriate, working with Police, Fire and Crime Commissioners to make resilience the third strand of community safety. Alongside this we will consider the case for making Combined Authorities and Mayoral Combined Authorities Category 1 Responders.

The UK Government will encourage and facilitate stronger collaboration between regions and across the four nations to maximise the opportunities for shared learning, insight, and cooperation. Similarities between areas are not just geographical and we will link places, even if they are at opposite ends of the country, to share good practice.

The UK Government will work with LRFs to strengthen data, intelligence and analysis capacity and capability. This will support them to make the best use of data to target activity and measure success as well as being a vital tool in response and recovery. Central to this will be ensuring appropriate sharing of UK Government data and information and building strong links with the National Situation Centre.

Civil Contingencies Act 2004 and Emergency Powers

Emergencies can require quick action, and they require powers to allow us to take that action. They require government, responders and businesses to work with partners in a way that they would not normally. When dealing with crises, actual or potential, it is vital that we have the powers we need to take decisive action.

The Civil Contingencies Act (CCA) 2004 will continue to be the legislative basis for the UK’s resilience frameworks^{[footnote 25]}. The CCA sets out a framework for emergency preparedness. It provides a definition of ‘emergency’, sets out arrangements for multi-agency working at the local level, and provides emergency powers to allow the UK Government to make temporary legislation in the most serious of emergencies. The Act is made up of two parts:

• Part 1: local arrangements for civil protection, establishing a statutory framework of roles and responsibilities for local responders.

• Part 2: allows for the creation of temporary special legislation in an emergency without prior parliamentary scrutiny.

Under the CCA, there are two groups of responders that have defined responsibilities. Category 1 responders are those that have a statutory duty to plan for emergencies and put those plans into action when an emergency occurs. Category 2 responders are obliged to cooperate with and share information with local responders to aid planning activity^{[footnote 26]}.

The CCA was subject to statutory review in 2022, and this review recommended some amendments to primarily Part 1 of the Act and found that Part 2 remains fit for purpose with no need for fundamental alterations. The review identified three areas in which the Act should be further strengthened.

Firstly, there is a need for enhanced accountability for the multi-agency preparedness activities conducted by local resilience arrangements. To support this, the UK Government will clarify the statutory and non-statutory guidance around accountability where these components come together in the planning and emergency response stages. New methods for accountability and assurance for resilience will continue to be considered as part of the measures to strengthen LRFs.

Secondly, while the CCA sets out expectations on responder organisations clearly, it does not ensure adherence to those expectations. As part of the wider strengthening of the roles and responsibilities of LRFs, the UK Government will consider putting the Resilience Standards that apply to responder organisations in England onto a statutory footing, and will require categorised responders to publicly state how they are meeting their obligations under the CCA. An impact assessment will be done as part of those considerations to ensure no counterproductive burden is placed on responders.

Thirdly, the definition and scope of Category 1 and 2 responders (see above) remain effective, and there is not yet a case for expanding or changing the duties of either category. However, the statutory review of the CCA recommended adding two new Category 2 responders (the Met Office and Coal Authority). Likewise, as part of the wider strengthening of LRFs we will look at strengthening the requirement to produce a Community Risk Register (CRR) to require responders to consider community demographics (particularly vulnerable groups) in preparing and communicating their CRR, to further consider how emergencies impact on communities.

The review also recommended bringing the legislation up to date with current local responsibilities. The role of the Regional Nominated Coordinator in England, originally added to the Act to aid coordination, will be removed. Instead, we will focus our efforts on working through existing local structures and reporting mechanisms.

The emergency powers under the CCA remain fit for purpose. The primary conditions placed on their use need to be maintained to prevent misuse of the power and ensure that, wherever possible, any legislation required to respond to an emergency goes through Parliament in the normal way. The UK Government has shown we can introduce emergency specific primary legislation to tackle risks but we will consider the need for new non-legislative options to ensure we can act effectively in an emergency.

The UK Government will continue to use sector-specific legislation to tackle risks, as they develop and after they have become emergencies, maintaining the CCA powers as an important option of last resort.

The Devolved Administrations

All four nations of the United Kingdom share the same goal - to protect our citizens from the impacts of crises. Resilience encompasses both reserved and devolved matters. This means that some elements of the resilience system are overseen by the UK Government and it is important that the UK Government works in partnership with the devolved administrations (DAs) as reserved issues may impact devolved responsibilities. Significant elements of resilience are wholly the responsibilities of the devolved administrations.

Crises do not always fall neatly within the boundaries between the four nations of the UK and all four nations have their own Administrations, their own local structure and resilience partners, and their own emergency services. The resilience system must respect these differences, whilst making sure that when crises do spread across the UK every part of the system can come together to tackle it. The UK Government is committed to working in partnership with the devolved administrations to implement change across the four nations where appropriate, to ensure that citizens in every part of the UK are protected from crises.

Where they have responsibility, the devolved administrations will continue to drive resilience activity in their nations, and in partnership with the UK Government, where it has responsibility wherever appropriate. Whilst much of resilience is devolved, we can derive great collective strength and resilience from fostering and building on strong joint working and mutual support. This can range from the active sharing of new ideas to enhanced protocols for cross border and cross-regional support in times of heightened risk or when responding to or recovering from emergencies. We also recognise that similarities in areas are not always bound by the nearest neighbour and we will link places that reflect the local picture even if they are at opposite ends of the country to share good practice.

In order to maximise cooperation on a four nations basis, there will be periodic ministerial level meetings on resilience, informed by quarterly senior official quad meetings and regular official-level contact, as part of a joint governance process.

The Armed Forces

Over the last few years, the armed forces have become one of the most familiar public faces of an emergency. In addition to its primary role of protecting the UK, its citizens and interests, the military can also contribute to domestic resilience through MACA (Military Aid to the Civil Authorities), allowing civil authorities to request military aid during crises. Under this process, they have driven ambulances, rescued households from floods, administered vaccines and much more. The military can provide essential specialist skills and deploy a volume of personnel at short notice across the UK. But the Armed Forces are facing pressure as risks multiply and diversify both at home and overseas, and they cannot be the first port of call whenever an emergency hits. The armed forces will continue to play a vital supporting role to the civil authorities in resilience, but will not be asked to take on an enhanced role.

Record numbers of personnel have been deployed on MACA operations in recent years, with approximately 34,000 servicemen and women (about 21% of the UK’s Armed Forces) deployed to support the UK pandemic response. However, alongside the increase in demand for MACA, the re-posturing of Defence and the need to meet increased persistent overseas threat means that requests for military assistance will need to continue to meet a high bar for authorisation. Utilising the Armed Forces in domestic resilience tasks comes with a cost: both financial for the requesting UK Government department or Devolved Administration, and to the Armed Forces in the military capability diverted from its primary role of protecting the UK’s national interests.

The UK Government will continue to work towards maximising the effectiveness of civilian organisations, with a view to reducing reliance on the Armed Forces. Therefore a more strategic application of MACA will be required in the future as requests for MACA should be an instrument of last resort^{[footnote 27]} and only used when:

• there is a definite need to act and the tasks the Armed Forces are being asked to perform are clear;

• other options, including mutual aid, commercial alternatives and the voluntary sector have been discounted;

• the civil authority lacks the necessary capability to fulfil the task and it is unreasonable or prohibitively expensive to expect it to develop one; or

• the civil authority has all or some capability, but it may not be available immediately, or to the required scale, and the urgency of the task requires rapid external support from the MOD.

The military will remain an ultimate guarantor of national security and resilience in emergencies, however, utilising our Armed Forces for non-emergency, routine tasks where the military do not play a specific and defined role should be seen as an indication of policy failure, inadequate resilience planning or chronic underinvestment.  There will be a shift to deliver some MACA through locally-based Reserves and the UK Government will retain existing MACA thresholds and encourage adherence to them.

Reserve service personnel already participate in the full spectrum of the UK Armed Forces, including recently in operations in support of the UK Government’s COVID-19 response. In the future, as a part of Defence’s Integrated Operating model, it is envisaged that the Reserves will play a greater role in resilience operations and MACA. Key to this will be an enhanced relationship between Defence and the employers of Reservists who may be asked to release them for military duties at shorter periods of notice.

Standards and Assurance

Good assurance, based on commonly understood standards across the public sector, can help to ensure that work across the resilience sector will have a positive real world impact. The UK Government will expand the scope and use of standards and assurance across the public sector in England and develop an action plan to deliver this, to support continuous improvement in risk management and preparedness. Although this approach needs to be flexible according to the needs of the sector, without meaningful, robust and standards-based assurance, risk-owning principals, stakeholders and potentially affected parties have no reliable way of knowing whether capabilities and arrangements to respond to risks and impacts are effective. This approach will be supported through an enhanced offer on skills and training, to help all those working on resilience to meet these standards.

There are some existing standards and frameworks in England at national and local levels in relation to specific risks and resilience capabilities. For example the National Resilience Standards for LRFs^{[footnote 28]} set out expectations of good and leading practice for LRFs, which build on and complement statutory duties under the CCA and other relevant legislation, however there are no current mechanisms for more formal assurance against these standards. More broadly some sectors are regulated and some organisations are inspected but others are not, so arrangements are not complete or coherent at the system level.

The UK Government will adopt a standards-based approach to assurance and develop an action plan to deliver this, setting out what organisations, partnerships and networks should do, should have and should be able to do in order to manage risks effectively, including those within the NSRA, and competently respond to and recover from emergencies arising from those risks. This will introduce greater rigour, provide greater consistency and transparency in assessments, and enable continuous improvement through identifying lessons to address and good practice to build on. To support this, the UK Government will build upon existing structures to develop assurance frameworks that will span departments and agencies, national and local resilience capabilities and arrangements, and encompass Critical National Infrastructure (both public and privately owned) and essential services.

Recovery

Recovery is a key stage in the resilience cycle and can have an important role in catalysing regeneration, renewal and future prevention in the aftermath of an incident. Whilst recovery is woven across all areas of the resilience system, there are some additional specific actions that will be taken.

Strengthened LRFs and their partners in England will continue to have a central role in the planning for and delivery of recovery activity. Working with the VCS and communities they will put plans and protocols for recovery activity in place and will work with these same stakeholders to deliver recovery activity should incidents occur. This includes ensuring the needs and views of communities are fully considered and understood.

The UK Government’s LGDs will take responsibility for the provision of clear guidance across government and to LRFs and wider partners on considerations for recovery related to their risks, ensuring appropriate advice and support are available should they be required. This will sit alongside a refreshed set of national recovery standards and updated National Recovery Guidance^{[footnote 29]}.

As an initial measure, the UK Government will also offer guidance to the local tier on how mental health and psychosocial awareness can be intrinsically factored into recovery work, to support those affected beyond their physical needs.

It is absolutely right that UK Government funding is targeted where the highest impact will be made, including investing more in prevention and preparation. It will always be the case however that emergencies will continue to happen. Where communities are impacted by emergencies the default remains for this to be managed locally, however in exceptional instances the UK Government may intervene to provide additional support and coordination.

At present financial assistance for recovery activity is usually agreed on a case-by-case basis. To ensure consistency for our partners, and building on the example of the Flood Recovery Framework^{[footnote 30]}, we will seek to provide greater clarity and guidance on when and how the UK Government may intervene, and consider if more formal arrangements should be developed to cover recovery from wider risks.

We will strengthen the evidence base on recovery, including developing tools for measuring and assessing the efficacy of recovery interventions. Building on this we will aim to enhance our understanding of what works in supporting communities to manage and recover from the impacts of emergencies to inform future policy development and planning.

Applicability across the UK

At the time of publication, it is anticipated that:

• Any statutory duty considered for UK Government departments will not apply in the devolved administrations.

• The proposed strengthening of Local Resilience Forums will only apply to LRFs in England.

• The expanded use of assurance and standards will apply to England and to reserved sectors across the UK. The UK Government and devolved administrations will work together to ensure that approaches are aligned.

• The scope and applicability of the CCA will remain the same. Any new sector-led legislation will be led by the UK Government, in consultation with the devolved administrations on a case-by-case basis.

Our action plan: Partnerships

On partnerships, we are already taking action by:

• Continuing to take international, bilateral and multilateral action and cooperation on risk and resilience. Continuing to use the UK Government’s international action to identify and tackle risks before they manifest.

By 2025, we will:

• Grow the UK Government’s advisory groups made up of experts, academics and industry experts in order to inform the NSRA. This may include establishing a risk-focused sub-group of the UK Resilience Forum.

By 2030, we will:

• Introduce standards on resilience across the private sector, where these do not already exist, adjusted to take into account the current landscape, priorities and needs across and between sectors.

• Provide the wider private sector with better guidance on resilience to support contingency planning and risk management.

• Build upon existing resilience standards for CNI to create common but flexible resilience standards across CNI, and do more on the assurance of CNI preparedness.

• Review existing regulatory regimes on resilience to ensure they are fit for purpose. In the highest priority sectors that are not already regulated, and for the highest priority risks, consider enforcing standards through regulation.

The resilience of the United Kingdom cannot depend solely on the ability of the public sector to organise emergency preparedness or lead a response in times of crisis. The private sector already provides many services and much expertise on resilience, and is essential in preparing for and managing long term risks, in addition to their role in responding to crises. Our vision is for a much fuller integration of these private and third sector partner organisations into our resilience frameworks, through a combination of new opportunities, guidance and obligations.

We must also look beyond our borders to strengthen our resilience. We live in an increasingly interconnected world. We consume food and goods shipped from the far corners of our planet, and we connect with individuals at home and abroad through technology that is constantly changing. Many risks are global in nature, or require global action. Our lives are therefore often affected not just by our own actions, but by those taken across the world.

Private Sector

Businesses, especially those that run essential services and Critical National Infrastructure (CNI), are an active partner in building our resilience. Many sectors and businesses are already well aware of the risks that they face, and actively undertake effective contingency planning. Others are actively involved in increasing the UK’s resilience and supporting our preparation for emergencies, such as through the development of vaccines. The UK Government must work with businesses to encourage an active partnership in resilience, and to itself learn from the experiences of businesses. This must be a joint endeavour, with the UK Government doing more, through consultation with businesses, to set standards, and share guidance and information. Although regulation can be a powerful tool in ensuring resilience behaviours, we recognise that it is not always appropriate, and many sectors are already subject to significant regulation. Raising private sector resilience standards may mean that the UK Government asks more of some parts of the private sector, but it will provide the guidance and information on risks that organisations need in order to be able to meet the standards that the UK Government sets.

At the core of our private sector is a group of owners and operators that run and protect some of the UK’s Critical National Infrastructure.^{[footnote 31]} These owners and operators are absolutely vital to the UK’s resilience, and we must put our full efforts into ensuring that they can operate without disruption. The UK Government’s work on CNI is a unique partnership between the public and private sectors. The UK’s CNI is an interconnected system. This interconnectedness brings many benefits but comes with risks, especially the possibility of cascading failures across systems. The vulnerability of these interconnected systems is complex and may be significantly underestimated with the potential for issues to be far reaching.

Many CNI owners and operators already have a high awareness of risk and are forward thinking about resilience; however, with an ever evolving risk landscape, we must be forward thinking on preparedness in CNI. The UK Government will continue to strengthen the resilience of our CNI, across the public and private sectors, by building an ever stronger understanding of our risks and interdependencies, and by developing new standards and assurance processes.

This chapter sets out an overarching approach to partnership with the private sector. Most of the sectors that make up this area span the four nations of the UK, and many of those span reserved and devolved policy areas. The UK Government will work with the devolved administrations to ensure that the approach across all four nations is joined up and consistent.

Standards and regulation

Our aim is that the whole private sector will contribute to UK resilience. But what this will look like will differ depending on the size and type of each organisation, and on the risks to which it is vulnerable. Standards can help businesses work out how they can protect themselves and contribute to UK resilience. The National Infrastructure Commission has recommended that the UK Government should publish a set of standards for energy, water, digital, road and rail services, to be reviewed and updated every five years^{[footnote 32]}. The UK Government will introduce standards on resilience and develop an action plan to deliver these across the private sector, where these do not already exist, to give a clear benchmark on what ‘good’ looks like for resilience. These standards on resilience will be non-statutory, and adjusted to take into account the unique sector landscapes, priorities, needs, and interlinkages with other sectors, to ensure that expectations are appropriate and not overly burdensome or disproportionate to the benefits they can deliver.

As part of this, the UK Government will build upon the resilience standards for CNI which already exist to create common but flexible resilience standards across CNI. These CNI resilience standards will be non-statutory and will consider malicious and non-malicious risks, and will help ensure a stronger common understanding of the resilience expected particularly between sectors, identify gaps in resilience measures and drive forward improvements.

The National Infrastructure Commission also underlines the importance of regular stress testing of resilience standards by regulators^{[footnote 33]}. The UK Government accepts this in principle - as reflected in the approach outlined in this chapter - and will ensure that sectors can continue to manage their own strategies, supported by regulators who can make choices about the best way to stress test the way in which resilience standards are met.

To make sure that CNI resilience standards are effective, the UK Government will also consider what form of assurance might accompany new standards. In considering what form assurance might take, we will need to balance the value of assurance against any additional burden. However, given the importance of CNI to our overall resilience, the UK Government will also do more on the assurance of CNI preparedness and develop an action plan to deliver this, including where they have a role with local partners and LRFs as Category 2 responders. This will take into consideration the roles, responsibilities and obligations of different stakeholders, including regulators. The outcomes of any exercises and testing are used to better understand vulnerabilities, learn and implement improvements in resilience.

Many sectors - particularly CNI - are already subject to regulation on resilience, for example with regards to business continuity or security. Regulators play a key role in linking the priorities and direction of the UK Government and drive improvements to the delivery of resilience. The UK Government will continue to work with regulators to further strengthen key sectors against risk.

The UK Government will review existing regulatory regimes on resilience to ensure that they are fit for purpose, particularly where these are used to assure CNI sectors. Working with regulators, the UK Government will make adjustments where it is agreed they are needed. For example, aviation is highly regulated across a number of areas, including security, but only some of the largest organisations are subject to regulation on resilience. In sectors such as this the UK Government should ensure that organisations are subject to an appropriate and proportionate level of regulation on resilience. This could mean raising baseline requirements or expanding the scope of who is covered by regulation within sectors. Any new regulation or adjustments to regulation will be led by the Lead Government Department, working with the sector, and we will not seek a one-size-fits-all approach.

In the highest priority sectors that are not already regulated, and for the highest priority risks, the UK Government will consider enforcing standards through regulation. This regulation could focus on risk assessment, contingency planning and data sharing. It would be aimed at protecting key sectors and assets against high priority risks, but will respect the ability of companies to run as they need, and will not stifle innovation. Any new regulation will strike a balance between the needs of the sector, consumer impacts, and the national need to guard against risk and we will only regulate where we know that the benefits will outweigh any costs.

This approach will complement broader efforts to improve the resilience of a significant proportion of the private sector^{[footnote 34]} through the use of Resilience Statements, as recommended by the Independent Review into the Quality and Effectiveness of Audit in 2019^{[footnote 35]}. These new Resilience Statements, to be led by the proposed Audit, Reporting and Governance Authority, will compel company directors to make a public statement about a company’s short, medium and long term resilience against a range of organisational risks.

Partnership working

To make such standards effective, the UK Government needs to help set businesses up for success. Some businesses are already heavily involved in areas requiring resilience processes and have developed systems for managing risk and planning for crises. But many have limited or no engagement with the resilience world, and so we must help those businesses to meet the standards that we set. To drive this, the UK Government will support the wider private sector with better guidance on resilience, and risk assessment information, to support contingency planning and risk management. Alongside this the UK Government will work with newly strengthened LRFs in England to support them to work with local businesses across the country to engage with resilience as critical parts of their local communities and economies.

In order for the private sector to meet standards, the UK Government must improve how we share risk assessment and information with them. The UK Government cannot expect organisations to properly prepare if they do not have the tools to understand which risks they face or how those risks may impact on their businesses. In turn, they must also understand how a lack of resilience in their own business may have wider impacts. For example, there are some goods that we may not instinctively link to UK resilience, but they may occupy an essential place in a vital supply chain. Guidance should not only focus on the risks, but also their potential consequences. Sometimes it is not the root cause of a risk that is important in planning, but the consequence that a business must mitigate. For example, if a business’ IT systems headquarters is rendered inaccessible, it is more helpful to have a contingency plan for that situation - whether it is a result of flooding, a pandemic or a security incident. There will always be some risks that require specific responses, but organisations should also be prepared for common consequences.

In addition, the UK Government will make training on resilience accessible to businesses, including through the UK Resilience Academy (see Skills chapter). The private sector can also be a valuable source of data and information on emerging (or active) risks and their impacts. The UK Government will ensure that, as we provide better guidance and information on resilience and risks to private sector partners, we also draw upon the expertise and data within the private sector to inform our resilience efforts.

Understanding risk is particularly crucial for CNI. Here, the UK Government will use the CNI Knowledge Base, a bespoke CNI mapping tool, to identify interdependencies across and within CNI sectors. The CNI Knowledge Base is a visualisation and mapping tool whose data forms the ‘Single Source of Truth’ for UK CNI. The tool helps users across the UK Government to collaborate to build an evolving picture and collective understanding to assist with the proactive management of sector-specific and cross-cutting risk to CNI. The CNI Knowledge Base will enable a step-change in the way the Government anticipates, prevents and responds to cascading risks that could impact our most essential services. A flagship project, initiated under the 2016 National Cyber Security Programme, it provides a world-leading capability in CNI risk management.

Furthermore, the private sector can, and should, be an active partner in planning for and mitigating against the risks the UK faces. For instance, during the COVID-19 pandemic most of the promising innovative COVID-19 vaccines originated from biotech companies or academia, and were ultimately manufactured and sold by major pharmaceutical companies^{[footnote 36]}. The UK Government provided funding and support to the development and distribution of some of these, including the Oxford/AstraZeneca vaccine, which has protected millions of people across the UK.

The UK Government commits to continuing to build partnerships between the public and private sector to improve our collective resilience and to identify opportunities for innovation. This expands on previous work such as the “100 Days Mission to Respond to Future Pandemic Threats” report^{[footnote 37]} (100DM) which the UK initiated during our 2021 Presidency of the G7. The 100DM was developed in collaboration with international organisations, industry chiefs and chief science advisers and presents 25 recommendations to achieve safe and effective diagnostics, therapeutics and vaccines in the first 100 days from the identification of a pandemic threat. Since June 2021, international organisations, governments, industry and philanthropic implementation partners have mobilised and formed strong coalitions to deliver the recommendations.

One excellent example of the partnership between the UK Government and the private sector on risk is the Cyber Essentials programme^{[footnote 38]}. Run by the National Cyber Security Centre (NCSC), the programme helps organisations to protect themselves against a range of the most common cyber attacks and provides certification to those who pass the assessments. Certification provides reassurance for both current and potential customers and enables organisations to better understand their current cyber security status. For instance, certification is a requirement for UK Government contracts involving the handling of sensitive and personal information. In providing certification, the Cyber Essentials programme also acts as a benchmark for wider good cyber security practice within organisations. We look for further opportunities to build on this type of good practice.

External Expertise

Expertise on resilience can be found in all parts of the system, and we must make sure that the UK Government’s policy making and assessment on risk and resilience are informed by as many expert views and evidence as possible. The Iraq Inquiry^{[footnote 39]} demonstrated the danger of basing our decision making on narrow views or groupthink. Although the UK Government already has a solid track record of working with partners across the system, we can formalise this.

NSRA Challenge

The refreshed NSRA process will expand our formal mechanism for involving external expertise, with a greater number of experts from a wider range of disciplines and backgrounds. We will look to resolve security and technical factors that can prevent open and transparent conversation between government and external experts. The UK Government will grow our advisory groups made up of experts, academics and industry experts from a diverse range of specialist fields in order to inform the NSRA including establishing a risk-focused sub-group of the UK Resilience Forum.

UK Resilience Forum

The UK Government has set up a new UK Resilience Forum (UKRF) to strengthen UK resilience by improving communication and collaboration at a national level on key discussions about risk, emergency preparedness, crisis response and recovery. Established in 2021, the UKRF brings together representatives from the UK Government, devolved administrations, emergency services, responder organisations, the private sector and the voluntary and community sector. This advisory board is aimed at aligning efforts across the system, strengthening relationships between partners, and informing the government’s work on its resilience commitments under the Integrated Review^{[footnote 40]}.

SAGE and scientific advice

Scientific advice and expertise are invaluable in how we understand, anticipate, prepare for, and respond to risks. During COVID-19 we saw the essential role that the Scientific Advisory Group for Emergencies (SAGE) played in understanding how the pandemic was evolving, in providing expert science advice to decision makers, and in communicating the risk to the public. The COVID-19 SAGE and its expert sub-groups provided a broad and diverse range of expertise – from multiple institutions and disciplines, including behavioural and social sciences – that allowed for robust, relevant and high-quality science advice to be given to decision makers. Previous SAGEs have provided a critical service to the UK Government across numerous crises, drawing on specialist knowledge and expertise from academia and the private sector and providing evidence-based challenge, advice and analysis for government decisions during an emergency. The diversity of backgrounds and expertise that is drawn upon during active SAGEs can provide broad and data-driven understanding of relevant active emergencies and their impacts, while ensuring diversity of thought. The SAGE model, and its potential subgroups, will continue to play a vital role in supporting government decision makers during active emergencies.

Whilst SAGE sits at the UK level providing scientific advice on emergencies, provision also exists to provide advice to local responders. Science and Technical Advice Cells (STACs) provide expert advice to local Strategic Coordination Groups (SCG) to inform the immediate response to an emergency and the management of longer-term consequences. In an emergency, local decision makers and emergency responders must quickly understand the potential impacts on the ground so that they can take timely tactical and operational decisions, for example whether it is necessary to evacuate an area at risk of flooding. STACs bring together science and technical experts from a range of agencies to advise the Gold Commander. The STAC model will continue to play an important and active role in local crisis response operations. SAGE and STACs are only activated during emergencies that require coordinated science advice and STACs can be activated even if a SAGE is not required, depending on the emergency itself. SAGE Secretariat must liaise and engage with the STAC lead, to facilitate timely knowledge transfer to the local level, and to allow SAGE attendees access to local intel on the incident which could provide critical scientific evidence.

Outside of active emergencies, the UK Government draws on robust, relevant and high-quality science and technology advice to understand, prevent, prepare for, respond to, and recover from risks. The UK Government draws on the science capabilities of public sector research establishments such as the Met Office, Ordnance Survey and British Geological Survey for important data and evidence on resilience challenges. The Natural Hazards Partnership is central in bringing together the science community in the resilience space and supports various aspects of resilience work including the NSRA. UK Government departments should continue to invest in research and development to inform their understanding and planning, and also communicate their priority research questions to academia and industry through their Areas of Research Interest publications.

Lead Government Departments should actively and regularly draw upon their Chief Scientific Adviser (CSA) to access internal and external science advice and relevant expertise for the risks they own. By proactively drawing upon CSAs and their expert networks, as well as analysis teams and futures expertise within departments and across government, LGDs can ensure evidence-based challenge and analysis of response planning beyond existing policy teams and across a diverse range of expertise. The Government Office for Science also facilitates access to the wider CSA network and external S&T expertise, particularly in response to emerging risks and in preparation for potential SAGE activations. The Government Science and Engineering Profession is working to increase STEM skills across government, including upskilling policymakers’ capacity and skills to effectively use evidence and data to provide challenge in policy making.

1. In driving our work on resilience, the Government is committed to inviting expert challenge and input to build its understanding of risk and preparedness. We will remain open to opportunities, in addition to the mechanisms outlined above, to draw in external expertise.

Interconnected World

The Integrated Review^{[footnote 41]} outlines that we are moving towards a more competitive and multipolar world, with growing and diversifying state threats to the UK. Our international allies and partners recognise that mutual support is vital for resilience, and that collective action by like-minded countries is of critical importance.

The UK’s international connections are vectors for both risk and resilience. Risks do not operate in silos, but are interconnected like our economy, environment and society. Those connections draw risks across borders, reinforce or cause other risks, and expose the UK to long-term international trends. The same connections are vital for resilience, supporting global action and shared endeavour on the biggest risks, harnessing international expertise, and providing economic diversity. For the UK, resilience is not simply a matter of homeland security; this is a globally-oriented maritime trading nation without a large continental hinterland, and that must shape our strategic approach.

Understanding this is integral for both addressing the causes of risk and supporting responses and recovery to any materialisation of risk. The UK Government will continue to work through multilateral forums to promote global resilience and, in the ever-contested international world that we find ourselves in, we will raise awareness of the importance of resilience in their work.

The UK Government will continue to take a leading role on resilience in many multilateral organisations. This includes in the G7 where, during the UK’s 2021 G7 Presidency, the Prime Minister nominated Lord Sedwill to chair an independent G7 Panel on Economic Resilience, which published a report titled ‘Global Economic Resilience: Building Forward Better’^{[footnote 42]}. The G7 Leaders noted their appreciation of this work in the Carbis Bay G7 Summit Communiqué and outlined that they will continue to work on the issues highlighted by the panel^{[footnote 43]}. In 2021, and as outlined later in this chapter, the UK also hosted the COP26 climate conference, during which the Glasgow Climate Pact was agreed. At this critical point in history, it is driving action on international climate change mitigation and adaptation measures. In addition, in June 2022, the UK announced^{[footnote 44]} that it will give £25 million to found a new World Bank fund to prevent, prepare for and respond to future devastating pandemics. Furthermore, as a permanent member of the UN Security Council, the UK Government has the influence to advance freedom, peace and security at the highest of global levels.

The UK Government will continue to engage countries bilaterally on resilience, and we can utilise our international networks to support our engagement. We also call upon our expertise, such as in the Emergency Planning College and military, to support any such collaboration on resilience. In this way, bilateral initiatives can create links below the national level, forming effective partnerships between practitioners and experts that can drive real change.

The UK Government will also build capacity and capabilities in low- and middle-income countries around the world to help support improvements to their economies, security and resilience. By enhancing resilience in these partner nations, the UK will improve the global resilience landscape and ultimately support its own. The UK Government will continue to support this through our international development work.

Applicability across the UK

At the time of publication, it is anticipated that:

• The standards, or any new regulations proposed in this chapter will be decided on a sector-by-sector basis. Accordingly, they will be led by the UK Government, but in consultation with the devolved administrations where appropriate.

• New guidance should be created for business across the UK and includes best practice. The UK Government will lead this work in consultation with the devolved administrations. The guidance be made available to the devolved administrations, but the devolved administrations will decide how best to communicate it to their partners.

• While representation at existing multi-and bilateral forums will continue to be led by the UK Government, the devolved administrations will continue to lead their own bilateral and international engagement and action, in devolved areas of responsibility.

Our action plan: Communities

On communities, we are already taking action by:

• Continuing to deepen and strengthen our relationships with the Voluntary and Community Sector (VCS) in England.

By 2025, we will:

• Offer better guidance from the UK Government to LRFs and local partners in England, created with local responders, the VCS and communities to support them working with vulnerable groups.

We regularly see the generosity of people coming forward to help their communities and the capacity of communities to support those in need: from emergency responders and networks of businesses, voluntary groups and local volunteers, to smaller community groups and individuals who undertake those simple and essential acts of good neighbourliness.

Communities^{[footnote 45]} include individuals (e.g. members of the public and households), organisations (e.g. businesses or voluntary, community and social enterprise groups), groups (e.g. those with shared characteristics, interests or identities), and associations and networks (e.g. local community, faith and business networks). The UK Government’s Community Resilience Development Framework^{[footnote 46]} sets out that community resilience in England is enabled when the public are supported to harness local resources and expertise to help themselves and their communities to: prevent, prepare for, respond to and recover from disruptive challenges, in a way that complements the activity of emergency responders; as well as planning and adapting to long term social and environmental changes to ensure their future prosperity and resilience.

For communities, our ‘whole-of-society’ approach to resilience means that everyone recognises their role in, takes responsibility and contributes to, the UK’s resilience. To achieve this, the UK Government will support greater community responsibility and resilience, driving a cultural shift where everyone who can, is prepared and ready to take action and support themselves during an emergency. This will mean those needing more specific or tailored support can be prioritised.

Voluntary and Community Sector

The Voluntary and Community (VCS) sector plays a vital role in the UK’s resilience. The UK Government works with many VCS organisations that contribute to our resilience. This includes for example, the Royal National Lifeboat Institute, British Red Cross, St John Ambulance, Neighbourhood Watch and Citizens Advice. In line with the approach outlined in this chapter, the UK Government will continue to deepen and strengthen its relationships with the VCS in England. The capabilities of the VCS will be better understood and integrated, as appropriate, strengthening resilience at local and national level in England.

The impact of the sector ranges from grassroots and local level right through to providing national and international services working alongside statutory responders. To continue to support the sector, the UK Government will work with strengthened LRFs in England and provide guidance and support for engaging and working with communities and community groups on both acute and chronic risks, so that they become increasingly active partners in building local resilience. The Department for Digital, Culture, Media and Sport is also funding the Voluntary and Community Sector Emergencies Partnership (VCSEP) in England with up to £1.5m, to 2025. This funding will be used to support and coordinate the voluntary and community sector’s input into emergency preparedness, planning and response. Through its partnership and network, the VCSEP will reach thousands of community organisations in order to share insight and build capability at a local and national level.

National, regional, local and grassroots VCS and faith-based organisations have been at the forefront of the response to emergencies. Over the last few years, the UK has also seen the emergence of new voluntary sector capabilities, such as the National Emergencies Trust that launched in November 2019 with the aim of collaborating with charities and other bodies to raise and distribute money and support victims at the time of a domestic emergency. The National Emergencies Trust launched its first fundraising appeal in response to COVID-19 and raised close to £100 million, distributing money raised through UK Community Foundations to national and local charities who could then support those most in need.

Supporting partnerships between statutory responders, the Voluntary and Community Sector, and communities in England

Building relationships and partnerships is an important component of this framework. The UK Resilience Forum has been established to steer partnerships across the resilience system at the UK level, and includes public, private and VCS organisations. To empower and support greater community responsibility and resilience, communities must be active contributors to resilience planning and part of decision-making processes. The UK Government will continue to support and encourage engagement between communities and local responders, ensuring that the knowledge and skills of the diverse people and organisations that exist in our society are enabled to contribute their fullest to local planning. The UK Government will also consider ways to enhance the role of citizens and the VCS as an integrated part of resilience policy making and planning.

At the local level, successful community resilience approaches are often based on connection and relationships. Deepened partnerships between statutory responders, the VCS sector and communities provide benefits across the board. It will mean that community and voluntary capabilities are better understood and integrated into resilience and emergency management activities. It will also assist local responders in developing a better understanding of their communities and needs and will reduce demand on statutory responder resources during emergencies so they can be focused on those most in need. To support this work, the UK Government will consider options for measuring and evaluating statutory responder engagement with the VCS and wider community and develop an action plan to deliver this.

Reducing disparity in the impacts of emergencies

The impact of emergencies can be felt by everyone, but some parts of society are more adversely affected. The UK is faced with a wide range of risks that can have a disproportionate impact on vulnerable and at-risk groups and communities. Individuals within these groups and in these areas can experience more significant impacts from risks and incidents when they happen . They are also more likely to suffer financial hardship either as a direct or indirect consequence of a risk materialising. Health and socioeconomic disparities are also linked and impact on people’s ability to reduce risk and respond in emergencies meaning these communities and places may have fewer resources and less capacity to proactively take steps to build their resilience.

The UK Government will continue to take a leading role on resilience in many multilateral organisations. This includes continuing to work with and through the G7 under the Japanese Presidency in 2023 and beyond, building on work started during the UK’s 2021 G7 Presidency, when the Prime Minister nominated Lord Sedwill to chair an independent G7 Panel on Economic Resilience, which published a report titled ‘Global Economic Resilience: Building Forward Better’.. In 2021, and as outlined later in this chapter, the UK also hosted the COP26 climate conference, during which the Glasgow Climate Pact was agreed. At this critical point in history, it is driving action on international climate change mitigation and adaptation measures. In addition, in June 2022, the UK announced that it will give £25 million to found a new World Bank fund to prevent, prepare for and respond to future devastating pandemics. Furthermore, as a permanent member of the UN Security Council, the UK Government has the influence to advance freedom, peace and security at the highest of global levels.

When crises happen, people and groups can lose access to vital services. We know that the effects of this loss can, and will, be felt the most by the most vulnerable in society^{[footnote 47]}. The UK Government will create a stronger and more consistent approach for operators of essential services to identify, communicate with, and offer support to vulnerable customers and develop an action plan to deliver this, and consistency in the sharing of information of vulnerable customers with LRFs and wider relevant local partners in England involved in emergency planning and response. This will include working with relevant operators of essential services to ensure that plans are in place to assist vulnerable customers in an emergency. The UK Government will work with industry partners to develop guidance to support this.

Applicability across the UK

At the time of publication, it is anticipated that:

• Any new guidance for practitioners and communities will be created in partnership between the UK Government and devolved administrations, so that it reflects the resilience arrangements, and needs of organisations and communities across all four nations.

Our action plan: Investment

On investment, by 2030, we will:

• Have a coordinated and prioritised approach to investment in resilience within the UK Government, informed by a shared understanding of risk.

• Consider options for funding models for any future expanded responsibilities and expectations of LRFs in England.

• Offer new guidance to community organisations and individual householders, to help those people to make more informed decisions about investing in their own resilience and preparedness.

Building preparedness for risks that may threaten the lives of our citizens, national security, economic prosperity, and societal wellbeing is a critical function of government and understanding of risk should be fundamentally built into our investment decisions and structures. Investing adequately in crisis prevention is more cost effective than merely responding to them, so there needs to be more purposeful links between our investment decisions and our understanding of risk.

The UK Government is committed to investing in resilience. It currently invests in a huge range of activities and capabilities that contribute to our resilience, either that are dedicated to resilience or have broader primary aims. For example, having a well functioning national health system is vital to our resilience - but it is not in itself a resilience function.

Investment in resilience is not only the responsibility of Governments, but is for the whole of society. This chapter considers four key areas of investment on resilience: public sector and UK Government investment, investment in local resilience and Local Resilience Forums in England, the private sector, and community and individual investment.

In the devolved administrations, spending on devolved areas of competence in relation to resilience is the responsibility of those administrations and is not considered here.

Public Sector Investment in Resilience

The UK Government spends significant sums on emergencies, with the majority spent on responding and recovering rather than longer term investments in prevention and preparation. When emergencies happen the priority is mitigating the impacts of the event and minimising the effect on the public. The UK Government will continue to spend on recovery as a vital aspect of the emergency management cycle which can ensure improved future preparedness, especially when we draw on ‘lessons learned’ to shape decisions.

Incidents over the last decade have repeatedly demonstrated that the cost of responding to and recovering from emergencies can be significant. This often outweighs the cost of preparing for or preventing such events. Examples include:

• Where there is a risk of flooding, the Environment Agency has helped ensure homes are built in a flood safe way. Every £1 spent advising on flood risk matters in spatial planning applications has saved £12 in future flood damages^{[footnote 48]}.

• During Storm Christoph, 49,000 properties were protected from flooding, with fewer than 1200 inundated.

• Improved response arrangements ensured that a Foot-and-mouth outbreak in 2007 caused much less damage (£150 million) than the outbreak in 2001 which cost the UK around £8 billion.^{[footnote 49]}

In future, the UK Government will drive strategic resilience building to acute and chronic risks through targeted and evidenced prioritisation of investment in prevention and preparation in England. This does not mean that the other stages of the risk life cycle - particularly response and recovery - will go unfunded, but rather that the UK Government should ensure adequate investment and maximise the impact of that investment across the risk lifecycle. Investment in risk reduction will be essential in easing the investment pressures on resilience activity and capabilities. As part of our risk reduction efforts, the UK Government must also bake resilience into wider government projects and policies.

UK Government investment

Resilience building and planning for risk are key responsibilities of the UK Government, and are underpinned by how investment decisions are made. To do this we need to have a shared understanding of how the UK Government invests its money on resilience, in order to ensure that investments are directed where it can make the most impact. This will be informed by a shared understanding of the risks we face, and a shared understanding of our collective risk tolerance.

Spending Reviews (SRs) are led by HM Treasury and set multi-year budgets for departments in line with the UK Government’s policy priorities. The risk landscape is complex and cuts across departmental boundaries, so it is important that investment in resilience is considered and coordinated across government. HM Treasury has prioritised join-up of spending plans where appropriate but as we look to create the most resilient UK by 2030, we can do more to coordinate across the UK Government in resilience.

To make the most of our considerable investment in resilience, the UK Government must be able to prioritise and coordinate both across departmental lines and across the UK Government and local government. Implementation will be iterative and will take time but the UK Government will begin to measure and track departmental investment in resilience across risks, meaning risk owning departments can track investments. On this and other government investments, HM Treasury will continue to ensure that the UK Government is making investment decisions which represent the best value for money. This is particularly important to our overall investment approach as so much resilience activity spans departmental boundaries. Alongside this, it will be crucial to build our evidence base on the impact of civil contingencies risks and emergencies across the country as well as the impact of interventions from the UK Government and our partners. This will allow us to more fully consider outcomes, impacts and value for money assessments in our resilience investment decisions.

The risks that we face are not static but change over time and we must also reflect that in how the UK Government invests in risk prevention and preparation. The UK Government needs a clear view of how we are investing across the risk landscape to ensure our investment priorities can flex to the evolving risk picture and we are mitigating risk effectively.

The UK Government will take a coordinated approach to our investment in resilience. To make strategic investment decisions, we need to understand how current capabilities match up with risks and concentrate investment where gaps are identified. As a first step, the UK Government will agree on a working definition of resilience activities and capabilities, and using that, will map current UK Government resilience capabilities. The UK Government will establish a process to capture current levels of investment across departments and track investment on those capabilities.

Once the UK Government has an agreed map of resilience activity and capability, we will map resilience investment within the UK Government alongside other funding arrangements (e.g. the Counter-Terrorism ringfence) and against UK Government risk assessments. This will highlight where investment needs to be adjusted, or opportunities to reduce duplication, which the Cabinet Office will work with departments to take action on. This mapping should account for investment outside of government. For example, if a risk receives relatively little funding from the UK Government, but is well funded within the private sector or at a local level, then we should consider whether there is a genuine investment gap or not.

This will mean the UK Government can streamline investment in risks and avoid duplication of investment by departments. It will ensure we are making informed investment decisions, which should also be informed by national security and science and technology advice. For example, futures and foresight advice can support forward-looking and long-term investment decisions, enabling investment into emerging technologies and capabilities that could be critical to the UK’s resilience. This will ensure we are investing taxpayer money most effectively by evidencing where investment could best meet the needs identified by our risk assessments. We know that the risk picture is dynamic and can change rapidly, and so although our approach to investment should be fundamentally informed by our understanding of risk, it will not be the only factor that we consider.

Implementing this will require a continuous and iterative process before it is fully embedded. It must also be a process that includes all government departments that contribute to resilience, and the Cabinet Office and HMT will work together with departments to embed the changes.

Investment in local resilience and Local Resilience Forums in England

A country’s resilience is built on the actions, choices and investments made by the individuals, organisations, businesses and government which come together to deliver resilience. When considering local resilience funding it is important to recognise that a wide range of core activities, capabilities and functions that may not be explicitly badged as ‘Resilience’ are crucial to an area’s resilience (e.g. core Fire and Rescue Service capabilities).

Local resilience structures are devolved, and therefore the changes to LRF funding set out below have been implemented within England. The UK Government is fully committed to ensuring integration and enhancing cross border collaboration and we will continue to work with local resilience leaders and practitioners from Scotland, Wales and Northern Ireland, sharing best practice and ensuring the mutual benefits of these changes can be shared across the UK.

As part of our IR commitment to consider strengthening the roles and responsibilities of LRFs in England, the UK Government is carefully considering how LRFs may be appropriately supported and funded into the future. Currently there is no single funding allocation or funding approach for each LRF and until recently the two main sources of LRF funding in England were:

• Direct financial contributions from partners: often in the form of voluntary and locally managed contributions from partner organisations, used to fund staffing and other resources to run a core secretariat function for coordinating the activities of the LRF.

• In-kind contributions from partners: LRFs receive a wide range of benefits in kind, provided by the chair organisation and other funders. These benefits are provided to support a core secretariat function. The most common benefits in kind LRFs receive are IT equipment, office and meeting space, training and partner HR and welfare support.

In highly exceptional circumstances, some LRFs have also received ad-hoc funding directly from the UK Government to support the delivery of locally led resilience activity tied to specific events, such as planning for the UK’s departure from the European Union and the COVID-19 pandemic.

In 2021, the UK Government announced £7.5m of funding to LRFs in England as a 12-month pilot project to collect evidence on the potential efficacy, challenges and opportunities of the UK Government providing a degree of central funding to LRFs. The aim of the LRF funding pilot was to enable LRFs to build new capacity and capability and to encourage innovation within the sector, without displacing existing partner contributions. The evaluation of this pilot has indicated that the funding pilot has met its objectives: funding has increased essential capacity and capability across LRFs in England to support the multi-agency coordination of planning and preparation activities, with LRFs recruiting new staff and delivering a wide range of projects in support of specific nationally and locally defined priorities. The evaluation concluded that the evidence available suggests that the pilot funding is likely to represent value for money in the long term and that there is currently no evidence of displacement of partner contributions.

Building on the success of the funding pilot, in late 2021 DLUHC agreed a £22m three-year funding settlement for LRFs in England starting in the 22/23 financial year. This additional UK Government funding will complement the contributions of partners and will allow LRFs to continue to enhance their strategic coordination capacity and capabilities to reflect the already enhanced expectations the UK Government has of LRFs.

We recognise that LRFs need a consistent, sustainable funding model to continue to build the necessary capacity and capability to deliver what the UK Government has grown to expect of them and the proposals set out to further strengthen their role and responsibilities. The UK Government will consider options for funding models for any future expanded responsibilities and expectations of LRFs. The UK Government also recognises that funding from the UK Government alone should not be the answer. Over many years LRFs have developed through the contributions of partner organisations to reflect local priorities and ways of working. Any future funding model must build on the principle that funding for local resilience should continue to be provided by the categorised responders of English LRFs alongside any funding from UK Government. Any direct funding from the UK Government should seek to compliment, not displace or disrupt, these arrangements.

Private Sector investment in resilience

There is already significant investment in resilience throughout the private sector. Some of this is direct investment in preparation for or protection from risk - for example, businesses investing in cyber security to protect their assets. Some of this is indirect, as businesses seek to make their supply chains, services or products reliable in order to secure commercial advantage.

Ultimately, decisions are taken by private companies based on multiple competing factors: the need to maintain profit margins, manage their reputation or balance decisions against overall operational planning means that private sector organisations do not always put resilience at the heart of their investment decisions. The UK Government will not aim to change or overrule the private sector’s right to take these decisions.

Not least because the private sector has demonstrated that it can be capable of independently increasing investment in resilience when the need arises - 95% of UK business leaders are aware of the need for investment in wider resilience^{[footnote 50]} and following COVID-19 and the vulnerabilities in international supply chains that it exposed, worldwide investment in supply chain management companies increased from $5.9bn in 2020 to $11.3bn in 2021.^{[footnote 51]} However, there was a clear immediate commercial alignment with longer term resilience here, whereas businesses may find other emergencies (such as flooding) harder to recognise or quantify.

Businesses do make independent investment in risk and resilience when advice is provided by governments - London Gatwick Airport allocated £30m in 2013 to implement the recommendations of a UK Government review into flooding disruption that had affected the airport, including improved flood modelling, and the completion of a bespoke flood warning scheme.^{[footnote 52]}

This is important because the economic impact of catastrophic events has continued to grow and the estimated resilience investment requirements have grown accordingly as threats such as cybersecurity and climate change increase in severity. There is still an average worldwide gap between the economic cost of a catastrophic event and private sector insurance coverage for costs of over 60%.^{[footnote 53]}

Private sector investment in resilience differs across sectors, organisations and risks. Although investment decisions must remain the responsibility of sectors and companies, the UK Government will provide improved guidance for businesses on risk, and support the insurance sector to help protect against specific risks.

Insurance

When used alongside good preparation and planning, having adequate insurance against risks is an important part of building resilience for individuals and businesses. The UK Government and the insurance industry have worked together in a variety of ways to ensure there is insurance available for individuals and businesses. The Flood Re and Pool Re schemes are the most often cited examples of insurance used by the UK Government in relation to risks and are examples of longer-term government supported reinsurance schemes. This approach can also work in the shorter term. For example, the Film & TV Production Restart Scheme which provided confidence to the UK Film and TV industry to restart productions during the COVID-19 pandemic.

Insurance is increasingly supporting resilience in other sectors. Cyber attacks are a key expanding risk to UK businesses and here we can see both the private sector’s desire to invest in cyber security, and the importance of governments in aiding and directing that investment. The scale of the threat is significant: 39% of all UK businesses reported a cyber breach or attack in 2022.^{[footnote 54]} UK Government support for businesses centres around the creation of the National Cyber Security Centre, which offered support to 777 significant incidents in 2020/21.^{[footnote 55]} As the threat has grown, so has interest in guarding against the threat. We have seen an increase in senior business interest in cyber security, from 69% in 2016 to 82% in 2022. The private sector market for cyber insurance has grown in tandem: 5% of UK businesses now have a specific cyber security insurance policy and 38% have cyber security as part of a wider insurance policy.[^56]

The UK Government, with the devolved administrations, will continue to explore opportunities to better support the insurance industry and develop an action plan to deliver this, recognising it is an important way to encourage organisations to take action on risk and ensure that, when a crisis hits, we are all well prepared. However, insurance is not a substitute for good preparation, and both the insurance sector and UK Government have an important role to play in encouraging businesses to have appropriate contingency plans in place as well as adequate insurance.

Community and individual investment in resilience

Every level of society has a part to play in building national resilience, including at a community and individual level. In the Risk chapter, we set out how the UK Government will make improvements to how it communicates about risk so that communities and members of the public can make informed decisions about managing risks in their local area. Alongside this, the UK Government will work with LRFs in England and local partners to offer new guidance to community organisations and individual householders, to help those people to make more informed decisions about investing in their own resilience and preparedness.

Investment in community resilience is a key part of the Levelling Up agenda. The UK Shared Prosperity Fund is a central pillar of the UK Government’s ambitious Levelling Up agenda and a significant component of its support for places across the UK. It provides £2.6 billion of new funding for local investment by March 2025, of which £559m is set aside for the adult numeracy programme ‘Multiply’. More than £2bn will be made available for places to identify and build on their own strengths and needs at a local level, focused on building pride in place and increasing life chances, and delivered through three investment priorities: communities and place, local businesses and people and skills.

[^56] Cyber Security Breaches Survey 2022

Applicability across the UK

At the time of publication, it is anticipated that:

• The proposals on public sector investment will apply to the UK Government only.

• Guidance to inform and drive private sector, community, and individual investment will be created in partnership between the UK Government and devolved administrations, but individual Administrations will be able to decide how best to communicate the guidance with their stakeholders.

• Work with the insurance industry will be led by the UK Government, with close consultation with the devolved administrations where it impacts devolved responsibilities.

Our action plan: Skills

On skills, by 2025, we will:

• Deliver a new UK Resilience Academy, built out from the Emergency Planning College, making world class professional training available to all that need it.

• Deliver a new training and skills pathway to drive professionalism and support all those pursuing a career in resilience.

• Reinvigorate the National Exercising Programme to test plans, structures and skills.

At the heart of the resilience system are the resilience specialists and many individuals who lend their skills and time to building resilience. The UK Government cannot deliver an ambitious programme of change on resilience without making sure that these people have the required skills and knowledge to draw upon. This chapter focuses on what the UK Government can do to develop skills throughout the resilience system, as well as complement the wealth of expertise and training driven by universities, private institutes and the private sector. Our aim here is to build on this, and support and encourage the upskilling of all those that work in all areas of civil contingency risk and resilience.

The declaration on Government Reform in June 2021 set out an ambitious statement for improving how the UK Government delivers for the public. To do this we need the best people leading and working in government and across the wider resilience sector to deliver better outcomes for citizens and achieve our ambitions for the country. By doing so, we will also be making the most effective use of the finite resources available.

Resilience skills

To deliver this framework, public servants must have both specialist and generalist knowledge, skills, and networks. This will be delivered through the recently published plan by the UK Government Skills and Curriculum Unit (GSCU) to create a Government Campus and new curriculum for civil servants: Better Training, Skills and Networks^{[footnote 57]} in January 2021. Developing resilience and crisis management skills, knowledge and networks form part of the new GSCU Campus which will also address wider aspects of risk management. These skills must be rigorous and accessible across the Civil Service, from core universal knowledge to specialist training. We will also consider whether resilience can be reflected more explicitly in the frameworks of government professions. Including resilience in the policy profession standards framework, for example, could raise the baseline competency across the UK Government as part of broader risk management improvement initiatives.

Excellent learning and development elevates the effectiveness of all resilience and crisis activity. Investment in knowledge, skills and resilience behaviours needs to be made at the pre-emergency phase, building preparedness and resilience before it is needed, particularly for areas with only a small number of specialists currently practising.

The UK Government will build resilience knowledge, skills and behaviours for all in the resilience system through:

• defining competence standards that align to extant British Standards Institution standards

• providing appropriate individual training and education, assessment and accreditation and mechanisms to share best practice;

• providing collective training and exercising; and

• continual professional development and retention to remain up-to-date.

This chapter focuses mainly on crisis and response skills and training, as that is where the majority of specialist skills are required in resilience work. Our renewed efforts will require a broadening of skills within specific risk areas. For example, efforts to mitigate or prevent supply chain or climate risks will require specialist skills and knowledge that are specific to that subject.

Professionalisation

The UK Government will play a central role in both driving and enabling the development of skills and knowledge of people working right across resilience. To reflect this broad audience with a shared purpose, the UK Government will further strengthen the professionalisation of resilience work through the creation of the UK Resilience Academy and by the creation of training pathways as part of broader risk management learning journeys.

UK Resilience Academy

At the centre of our professionalisation offering will be a new UK Resilience Academy (UKRA), which will be the heart of a network of similar UK-Government affiliated providers and deliver leadership and learning to all those in the resilience system. This will be built up and out of the Cabinet Office’s Emergency Planning College (EPC) which is already partnered with the UK GSCU.

Our vision is that the UKRA will be a physical and virtual campus delivering the scoping, design and delivery of training, wider education, learning and development and exercising for resilience professionals. It will bring together similar providers into a network, becoming a wider centre of excellence, incorporating concepts and doctrine, training and education, exercise and experimentation, lessons learning and implementation and innovation.

The EPC already contains much of the capability and expertise required to deliver this, however it will need a broadened remit to include the private sector covering CNI, the voluntary sector and finance. It will also provide ratified and current mechanisms, methods, materials, and guidance to inform individual citizens in a way that is clear, simple and would benefit their lives. Although our intention is to make the UKRA accessible to as broad a range of partners as possible, attendance at UKRA training will not be a condition for working with the UK Government on resilience, nor will it replace other excellent training partnerships elsewhere in government.

In addition to the EPC, there are a number of UK Government affiliated learning and development providers sharing skills, expertise and powerful networks, for example, the UK Leadership College for Government and College for National Security, as well as JESIP, UK Defence Academy and the College of Policing. All make different and essential contributions to the resilience learning and development landscape. Networked to the UKRA, this will create a comprehensive skills and training centre that needs to be promoted and made accessible to all those that have a role in resilience.

Standards and Training pathways

Lessons identified from incidents and complex, long-term responses such as COVID-19 have demonstrated that, as well as the need for wider risk management improvement, there is the need to improve coherence of the crisis management system and its overall operational effectiveness.

Building on existing good practice across government, the UKRA will work with Lead Government Departments and other learning and development providers to further enhance resilience capabilities and develop a resilience training pathway focusing on;

• The development and recognition of resilience knowledge, skills and behaviours and considering a progressive competence framework for individuals, aligned to relevant guidance, standards, lessons and good practice that is associated with a clear Learning & Development pathway. The UK Government will - in line with the GSCU curriculum for UK Government skills - consider audiences across government who need a wide but less deep grounding in resilience;

• exploring the use of enhanced capability standards by drawing on existing best-practice. This will establish a ladder for progressive improvement and a yardstick for assessment and assurance; and

• establishing a network or community of resilience professionals across government to develop, deliver and signpost L&D opportunities; facilitate communications across the network; organise continuing professional development events; and provide a forum for members of the resilience community to share and raise issues relating to professional development and improvement.

The resilience training pathway must also link to other risk and resilience training across the UK Government such as business continuity training and risk management.

The UK Government will establish a regular UK Resilience Lessons Digest^{[footnote 58]}. This will summarise lessons from a wide range of relevant sources to share insights consistently across the UK Government and wider partners. It will coordinate knowledge to promote continual improvement in UK resilience training, exercising, doctrine, standards and good practice. The Lessons Digest will complement existing mechanisms for identifying and implementing lessons, including the JESIP Joint Organisational Learning (JOL) system, methods which drives continuous improvement in multi agency interoperability, and the Home Office Counter Terrorism Exercising (CTX) Team, which captures and monitors lessons from national Counter Terrorism exercises.

National Exercising Programme (NEP)

Planning for emergencies cannot be considered reliable until it has been exercised and has been shown to be workable. Exercises have three main purposes: to validate plans; to develop competencies and give them practice in carrying out their roles in the plans; and to test well-established procedures and identify areas for refinement and improvement.

The UK Government will reinvigorate the National Exercising Programme to bring together key partners to stress test our plans, structures and skills and embed lessons captured into our doctrine and standards. Previously the NEP focused on civil contingency emergencies caused by natural events (e.g. flooding) or accidents (a plane crash). Following the IR, it is recognised the NEP should also test the UK Government’s capacity to manage civil contingencies emergencies caused by^{[footnote 59]}, and impacted by^{[footnote 60]} malign state activity.

To reflect this, the NEP will now be designed to test rigorously the concept of operations from the coordinated central response through the range of lead government department responsibilities and the involvement of the devolved administrations, from government to local responders. The NEP will complement existing resilience exercising conducted by UK Government departments, local authorities and the emergency services for specific risks.

Civil Service Crisis Skills and Resource

During a crisis, the Civil Service must be able to draw on the skills and experience that it needs. Within the UK Government and DAs, there are already thousands of crisis management and subject matter experts that can act when an emergency happens. But there are times when a risk impacts so widely, or requires niche or specialist knowledge, that the UK Government needs to be able to quickly access different or additional support. When this happens, we must be able to work with those partners quickly and efficiently, integrating them seamlessly into our response. Some of this knowledge and experience is held by those who used to be civil servants, and some of it is held within the private sector.

Rapid re-prioritisation within the Civil Service was required during COVID-19. 40,000 FTEs worked in COVID-19 roles across the Civil Service, covering a hugely diverse range of activity. Whilst some COVID-19 roles were filled through recruitment, many more were filled by existing Civil Servants, through internal redeployment within departments or re-focussing existing roles on the COVID-19 response. The UK Government Resourcing Hub in Civil Service Human Resources facilitated short-term loans between departments, with almost 3,000 individuals moving across government to fill COVID-19 roles. Although there was immense flexibility and capability within government, this is not a sustainable approach, as other work programmes were paused or cancelled as a result of this surge. It was also common for departments to report similar resourcing gaps.

One of the success stories of the COVID-19 pandemic was the NHS Reserve. The approach was piloted by eight early adopter Integrated Care Systems in different regions of England, in response to the need to develop an additional emergency preparedness workforce to support surge demand. The early adopter pilots recruited over 17,000 individuals and since August 2020 have on boarded an additional 1,307 reservists. All remaining Integrated Care Systems are currently working to set up local reserve programmes as part of a national roll-out and these are forecast to grow the national reserve pool by around 10,000 by March 2023.

The Integrated Review recognised the need for a reserve to enable ‘access to people with the right skills, experience and security clearances to form flexible, diverse and multidisciplinary teams’^{[footnote 61]}. The 2020 Boardman Review of pandemic procurement also recommended that ‘there should be a cadre of retired and current Senior Civil Servants trained for crisis management who can be brought in to head up a crisis team as senior leaders’^{[footnote 62]}. The UK Government will continue to consider options to ensure that it is able to quickly draw on the expertise and resources that it needs during a crisis. This will be a common theme across the resilience system.

Applicability across the UK

At the time of publication, it is anticipated that:

• The UK Resilience Academy will be fully accessible to all partners including from the devolved administrations. However, it will not replace any training or skills-building in the DAs, and attendance at UKRA courses would not be compulsory. Similarly, any new training and skills pathway would be available in the devolved administrations, but would not be compulsory or replace existing activities.

• The NEP will work closely with the DAs. While DAs remain responsible for assuring their own contingency plans, the NEP will work with DAs on exercising for scenarios that cross borders and jurisdictions.

Annex A: The Devolved Administrations and Resilience

In Scotland, Wales and Northern Ireland, where a matter is devolved (such as flood defence), the administration in that nation leads planning, preparation, crisis response and recovery for these areas. In practice, where a crisis in a devolved policy area spans across borders, the relevant devolved administration(s) and the UK Government will work together to respond and recover. This can be further complicated where a risk is a reserved matter (for example, energy policy), but the impacts of that risk (for example, the impact of energy failure on schools) is devolved. Therefore all resilience work between the four nations must include a partnership approach.

In each DA, resilience arrangements, systems and processes have developed to reflect local requirements.

In Scotland, the Scottish Resilience Partnership (SRP) is a core group of the most senior statutory responders and key resilience partners. The SRP acts as a strategic policy forum for resilience issues. It provides collective assurance to Scottish Ministers, statutory responders and key partners. It also gives advice to the resilience community on how best to ensure that Scotland is prepared to respond effectively to major emergencies. Resilience is delivered through three Regional Resilience Partnerships which are established by regulation. They work with twelve Local Resilience Forums. Guidance on the principles, good practice and guidance on specific resilience matters is set out in a suite of guidance called Preparing Scotland.

In Wales, strategic issues of emergency preparedness are considered at the Wales Resilience Forum (WRF) Chaired by the First Minister. The WRF provides a national forum for multi-agency strategic discussion and assurance for Welsh Ministers on civil contingencies and emergency planning. Local Resilience Forums (LRF), like their English counterparts, are the principal mechanism for multi-agency cooperation on resilience. The Welsh Government is currently undertaking a review of Civil Contingencies Governance structures in Wales. This will inform the Welsh Government’s approach to strengthening civil contingencies in Wales to enable delivery of the most effective model of multi-agency emergency preparedness and response across Wales.

The Civil Contingencies Group (CCG) (Northern Ireland) is the strategic-level multi-agency forum for the development, discussion and agreement of civil contingencies, preparedness and resilience policy for the Northern Ireland public sector. The Northern Ireland Emergency Preparedness Group, as a Sub Group of CCG (NI), oversees the work of the three Emergency Preparedness Groups at the local level and also acts as a conduit to escalate issues to the strategic level. Civil Contingencies guidance and the principles underpinning preparing for, responding to, and recovering from emergencies, are provided in the Northern Ireland Civil Contingencies Framework - Building Resilience Together.

Annex B: Summary of Framework actions

The UK Government is already taking action by:

Theme	Actions
Risk	- Refreshing the NSRA process, so it will look over a longer timescale, include multiple scenarios, look at chronic risks and interdependencies and use the widest possible range of relevant data and insight alongside external challenge. The NSRA was updated in 2022 based on the new methodology. - Creating a new Head of Resilience, to guide best practice, encourage adherence to standards, and set guidance.
Responsibilities and Accountability	- Strengthening UK Government resilience structures by creating a new resilience function to deliver longer term capability building and risk mitigation to work alongside the UK Government’s crisis management infrastructure.
Partnerships	- Continuing to take international, bilateral and multilateral action and cooperation on risk and resilience. Continue to use the UK Government’s international action to identify and tackle risks before they manifest.
Communities	- Continuing to deepen and strengthen its relationships with the Voluntary and Community Sector in England

By 2025, the UK Government is committing to take the following actions:

Theme	Actions
Risk	- Clarify roles and responsibilities in the UK Government for each NSRA risk, to drive activity across the risk lifecycle. - Conduct an annual survey of public perceptions of risk, resilience and preparedness. - Introduce an Annual Statement to Parliament on civil contingencies risk and the UK Government’s performance on resilience. - Develop a Social Vulnerability Index - a measurement of socio-economic resilience, including how risks impact across communities and vulnerable groups - to guide and inform decision making on risk and resilience.
Responsibilities and Accountability	- Expand the scope and use of standards and assurance in the public sector to support better contingency planning and risk management. - Run a pilot across three key pillars of reform to significantly strengthen LRFs in England: Leadership, Accountability, and Integration of resilience into the UK’s levelling up mission.
Partnerships	- Grow the UK Government’s advisory groups made up of experts, academics and industry experts in order to inform the NSRA. This may include establishing a risk-focused sub-group of the UK Resilience Forum.
Communities	- Offer better guidance from the UK Government to LRFs and local partners in England, created with local responders, the VCS and communities to support them working with vulnerable groups.
Skills	- Deliver a new UK Resilience Academy, built out from the Emergency Planning College, making world class professional training available to all that need it. - Deliver a new training and skills pathway to drive professionalism and support all those pursuing a career in resilience. - Reinvigorate the National Exercising Programme to test plans, structures and skills.

By 2030, the UK Government will:

Theme	Strategic deliverable
Risk	- Develop proposals to make the UK Government’s communications on risk more relevant and easily accessible.
Responsibilities and Accountability	- Work across three key pillars of reform to significantly strengthen LRFs in England: Leadership, Accountability, and Integration of resilience into the UK’s levelling up mission.
Partnerships	- Introduce standards on resilience across the private sector, where these do not already exist, adjusted to take into account the current landscape, priorities and needs across and between sectors. - Provide the wider private sector with better guidance on resilience to support contingency planning and risk management. - Build upon existing resilience standards for CNI to create common but flexible resilience standards across CNI, and do more on the assurance of CNI preparedness. - Review existing regulatory regimes on resilience to ensure they are fit for purpose. In the highest priority sectors that are not already regulated, and for the highest priority risks, consider enforcing standards through regulation.
Investment	- Have a coordinated and prioritised approach to investment in resilience within the UK Government, informed by a shared understanding of risk. - Consider options for funding models for any future expanded responsibilities and expectations of LRFs in England. - Offer new guidance to community organisations and individual householders, to help those people to make more informed decisions about investing in their own resilience and preparedness.

Equalities Considerations of the Deliverables

The Resilience Framework is an outline of, and commitment to, a range of measures and policies that will go through further development and implementation. The equality implications of those will continue to be assessed and monitored accordingly by those leading on development and implementation.

Annex C: Evidence and Engagement

This annex sets out our approach to building the evidence base for this framework. The ambition was to root the framework in the best available evidence, analysis and expertise, drawing on a diverse range of high-quality sources.

To achieve this ambition, the UK Government undertook a systematic programme of engagement, analysis and challenge. The UK Government established new processes and products where these were needed to address gaps and better inform decision-making. Lessons learned during the process will inform our approach at the implementation stage.

Approach

This programme was designed to support each stage of the framework development and drafting process. This involved working with government departments and agencies, the UK’s overseas networks, and experts, practitioners and partners from the risk and resilience sector. In particular, the UK Government sought to:

• Agree common understandings and agree the scope for the framework.

• Establish the current risk and resilience landscape and identify potential models to follow.

• Identify priority areas for policy development.

Evidence base

The framework looked across a range of reports and projects from varying sources to help formulate and inform policy. Amongst others, these included:

• Government departmental reports

• Integrated Operating Concept (2021)

• Government Science Foresight Project: Technology and Innovation (2017)

• BEIS: Storm Arwen Response Interim Review (2022)

• External and government partnership reports

• The Centre for Long Term Resilience: Future Proof, The Opportunity to Transform the UK’s Resilience to Extreme Risks (2021)

• Civil Contingencies Resilience Strategy for Northern Ireland 2020-2025

• Greater Manchester Resilience Strategy 2020-2030 (2021)

• Grenfell Tower Inquiry: Phase 1 Report (2019)

• House of Lords Risk Committee: Preparing for Extreme Risks, Building a Resilient Society (2021)

• Joint Committee for National Security Strategy: Biosecurity and National Security (2020)

• Joint Committee for National Security Strategy: The UK’s National Security Machinery (2021)

• Leeds Beckett University: Research into Community Resilience, A place-based case study approach England, Wales, Scotland and Northern Ireland (2021)

• London Resilience Partnership: Chronic Incident Review (2021)

• Manchester Arena Inquiry Volume 1: Security for the Arena (2021)

• National Audit Office: The Government’s Preparedness for the COVID-19 Pandemic: Lessons for Government on Risk Management (2021)

• National Preparedness Commission: Building Better Resilience (2020)

• National Preparedness Commission: Independent Review of the 2004 Civil Contingencies Act (2022)

• National Infrastructure Commission Report: Anticipate, React, Recover, Resilient Infrastructure Systems (2019)

• RAND Europe: Enhancing Defence’s Contribution to Societal Resilience in the UK, Lessons from International Approaches (2021)

• Royal Society of Edinburgh: Response to the House of Lords Risk Assessment and Risk Planning Committee Enquiry (2021)

• Royal Academy of Engineering: Resilience, Building UK Capability and Considering Interdependencies.

• St John Ambulance: Ask Us About Our Million Hours, St John People on their Million Hours and how we built a Lasting Legacy of Emergency Resilience (2021)

• International reports and frameworks

• The Australian Government: Royal Commission into Natural Disaster Arrangements (2020)

• Government of Canada: Emergency Management Strategy for Canada, Toward a Resilient 2030 (2019)

• New Zealand Government: National Disaster Resilience Strategy (2019)

• Norwegian Directorate for Civil Protection: Analyses of Crisis Scenarios (2019)

• Organisation for Economic Co-operation and Development: Resilience Strategies and Approaches to Contain Systematic Threats (2019)

• United Nations Office for Disaster Risk Reduction: Sendai Framework for Disaster Risk Reduction 2015-2030 (2015)

• Devolved administrations frameworks

• Northern Ireland Civil Contingencies Framework (2021)

Engagement

The UK Government designed engagement to bring in different perspectives and policy ideas from across the UK and around the world, adapted the programme in light of COVID-19 to make full use of online platforms and issued a public call for evidence.

Public Engagement: On 13 July 2021, the UK Government launched a public Call for Evidence. Contributions were invited on a range of security, defence, development and foreign policy questions. The UK Government received almost 400 submissions from individuals and organisations. A wide range of individuals and organisations submitted responses, including from industry; non-governmental organisations; international organisations, academia; community groups; think tanks; local government; local resilience forums; insurance companies; business and continuity teams in critical national infrastructure companies; and fire and police organisations. The UK Government reviewed and catalogued the submissions, which were fed into the development of this framework.

Sector Engagement: During the summer of 2021 the UK Government undertook an extensive programme of engagement and evidence gathered with LRFs in England and their partners. This “Big Resilience Conversation” was extremely well supported by a wide range of partners and we are grateful for their highly positive and constructive engagement.

Experts and Practitioners: The Call for Evidence was launched publicly on 13 July 2021 via a speech given by the Paymaster General to the Royal United Services Institute. The UK Government subsequently consulted over 1000 stakeholders in a series of engagement events, including businesses, charities, academics and other experts.

Departmental & International Engagement: a wide range of government departments were consulted, as well as UK missions overseas and our international partners, all of which informed inputs into this framework. The UK Government consulted departments on their areas of policy and delivery responsibility, and also engaged with the UK Delegation to NATO to better understand the role that can be played by multilateral organisations, and held discussions with international delegations.

Devolved Administrations Engagement: the UK Government engaged with the devolved administrations and territorial offices to understand arrangements in the Devolved Nations and learn from good practice already in use. This was achieved through a series of regular contact groups and 1:1 engagements with individual administrations.

Parliamentary Engagement: the UK Government reviewed a number of parliamentary reports to ensure that relevant recommendations were recognised and reflected in this framework. This included the National Security Inquiry Report on Biosecurity and National Security, and the House of Lords Select Committee on Risk Assessment and Risk Planning Report: Preparing for Extreme Risks - Building a Resilient Society. In the process of developing this framework, officials briefed the Parliamentary Accounts Committee.

Challenge

The UK Government put in place challenge processes to test our assumptions and emerging thinking during the framework development process. This included ensuring that the analysis of the responses to the call for evidence was led by professional analysts, and having regular challenge sessions to allow the scope and key assumptions of this framework to be challenged at the development stage.

Annex D: Acronyms and definitions

Term	Definition
Acute risk	Time-bound, discrete events, for example a major fire or a terrorist attack. Contrast with Chronic risks.
Cabinet Office Briefing Rooms (COBR)	The Cabinet Office Briefing Rooms provide the coordination mechanism through which the UK Government responds quickly to emergencies that require decisions urgently (set out in the UK Government’s concept of operations[footnote 63]). Ministers and senior officials are brought together in COBR to ensure a common appreciation of the situation and to facilitate effective and timely decision making in responding to domestic and international emergencies affecting UK interests.
Capabilities	In this context, capabilities means the organisations, tools, data, legislation or resources required to respond to risks. There are both specific capabilities, which are needed to manage specific risks, as well as generic ones which can be used to respond flexibly to multiple risks. Specific capabilities could include specialist equipment used to pump water or measure water speed during flood events. Generic capabilities include evacuation and shelter capability, and the emergency services.
Cascading risk	This term refers to the knock-on impacts of a risk that cause further physical, social or economic disruption. For example, severe weather could cause flooding, which then causes damage to electricity infrastructure, resulting in a power outage which then disrupts communications service providers (and so on).
Catastrophic risk	Those risks with the potential to cause extreme, widespread and/or prolonged impacts, including significant loss of life, and/or severe damage to the UK’s economy, security, infrastructure systems, services and/or the environment. Risks of this scale would require coordination and support from UK Government. Examples include: the widespread dispersal of a biological agent, severe flooding, or the detonation of an improvised nuclear device.
Category 1 and 2 Emergency Responder	The Civil Contingencies Act divides those with duties for emergency preparation and response at the local level into two groups (Category 1 and Category 2 responders), each with different duties. Category 1 responders are those at the core of most emergencies and include: the emergency services, local authorities, some NHS bodies.   Category 2 responders are representatives of organisations less likely to be at the heart of emergency planning but who are required to co-operate and share information with other responders to ensure that they are well integrated within wider emergency planning frameworks. They will also be heavily involved in incidents affecting their sector. Category 2 organisations include: the Health and Safety Executive, Highways Agency, transport and utility companies.
Chronic risk	Continuous challenges which gradually erode our economy, community, way of life and/or national security (e.g. money laundering; antimicrobial resistance). Contrast with Acute risks.
Civil contingencies	Planning and preparation for events or incidents with the potential to impact ordinary citizens and their interests.
Civil Contingencies Act (CCA) 2004	The framework for civil protection in the UK. The CCA identifies and establishes a clear set of roles and responsibilities for those involved in emergency preparation and response at the local level. It also allows for the making of temporary special legislation (emergency regulations) to help deal with the most serious of emergencies.
Civil Contingencies Group (Northern Ireland)	The Civil Contingencies Group (Northern Ireland) is the strategic-level multi-agency forum for the development, discussion and agreement of civil contingencies, preparedness and resilience policy for the Northern Ireland public sector.
Compound risk	When two or more events coincide (either in the same place, or at the same time) causing impacts greater than the sum of the individual risks. An example could be flooding impacting an area that is already experiencing a power outage.
Crisis	An event or series of events that represents a critical threat to the health, safety, security, or well-being of a community or other large group of people usually over a wider area.
Critical National Infrastructure (CNI)	National Infrastructure is those facilities, systems, sites, information, people, networks and processes, necessary for a country to function and upon which daily life depends. It also includes some functions, sites and organisations which are not critical to the maintenance of essential services, but which need protection due to the potential danger to the public (civil nuclear and chemical sites for example). Critical National Infrastructure is a subset of National Infrastructure which, if damaged, would have major impacts on a national scale.
Emergency	An emergency is defined as: - An event or situation which threatens serious damage to human welfare, or to the environment; or - War, or terrorism, which threatens serious damage to security
Hazard	Hazards are non-malicious risks such as extreme weather events, accidents or the natural outbreak of disease. Contrast with Threat.
Local Resilience Forum (LRF)	LRFs are multi-agency partnerships made up of representatives from local public services, including the emergency services, local authorities, the NHS, the Environment Agency and other organisations involved in emergency preparedness. These agencies are known as Category 1 and 2 Responders (except in Northern Ireland), as defined by the Civil Contingencies Act. The CCA and the Regulations provide that responders, through the Local Resilience Forum, have a collective responsibility to plan, prepare and communicate in a multi-agency environment.
Local Responder, Local authorities and responder agencies	Local responders and local responder agencies include both category 1 and category 2 responders as defined in the Civil Contingencies Act 2004. In the context of the devolved administrations, this can also refer to national agencies such as the Police Service of Northern Ireland, the Welsh Ambulance Service and the Scottish Fire and Rescue Service.
Military Aid to the Civil Authorities (MACA)	Military operations conducted in the UK and Crown Dependencies involving the employment of Defence resources as requested by a government department or civil authority. This is subject to Defence ministerial approval, either prior to, or at the time of an event.[footnote 64]
Malicious risk	Risks characterised by deliberate human intent to cause harm or disruption. These risks can come from individuals, groups or States. Examples include: terrorism; serious and organised crime; and hostile activity by foreign states.
National Security Risk Assessment (NSRA)	The NSRA assesses, compares and prioritises the top national level risks facing the UK, focusing on both likelihood of the risk occurring and the impact it would have, were it to happen. It is the main tool for assessing the most serious civil contingencies risks facing the UK.
National Risk Register (NRR)	The NRR is the publicly available counterpart of the NSRA, aimed at providing detailed information for those with formal contingency planning responsibilities at a national and local level.
Non-malicious risk	Risks characterised by natural or accidental causes. Examples include: industrial accidents; extreme weather; and human and animal disease.
Northern Ireland Emergency Preparedness Group	The Northern Ireland Emergency Preparedness Group, is a SubGroup of Civil Contingencies Group (NI) and oversees the work of the three Emergency Preparedness Groups at the local level and acts as a conduit to escalate issues to the strategic level.
Recovery Coordinating Group (RCG)	It is recommended that the Recovery Coordinating Group (RCG) is set up on the first day of the emergency and run in parallel with the Strategic Coordinating Group (SCG). Activation of the Recovery Coordinating Group (RCG) is initiated by the local authority, usually following a request by / agreement with the Strategic Coordinating Group (SCG). The RCG reports into the SCG until the SCG stands down.
Regional Resilience Partnership (in Scotland)	Resilience in Scotland is delivered through three Regional Resilience Partnerships which are established by regulation. They work with twelve Local Resilience Forums.
Resilience	The UK’s ability to anticipate, assess, prevent, mitigate, respond to, and recover from natural hazards, deliberate attacks, geopolitical instability, disease outbreaks, and other disruptive events, civil emergencies or threats to our way of life.
Risk	An event, person or object which could cause loss of life or injury, damage to infrastructure, social and economic disruption or environment degradation. The severity of a risk is assessed as a combination of its potential impact and its likelihood. The Government subdivides risks into: hazards and threats.
Risk appetite	The amount of risk an individual, business, organisation or government is willing to tolerate.
Risk-agnostic	Describes the ability of a capability, process or response to address ‘common’ impacts of risks (i.e. those impacts that occur across multiple scenarios). For example, major fires, terrorist incidents and flooding are all likely to produce mass casualties; developing capabilities to handle mass casualties is, therefore, a risk-agnostic approach.
Risk life cycle	A conceptual model that breaks the management of a risk down into stages at which different preparatory actions can be taken. The UK Government is using six stages: anticipation, assessment, prevention, preparation, response and recovery.
Scottish Resilience Partnership (SRP)	The Scottish Resilience Partnership (SRP) is a core group of the most senior statutory responders and key resilience partners. The SRP acts as a strategic policy forum for resilience issues. It provides collective assurance to Scottish Ministers, statutory responders and key partners. It also gives advice to the resilience community on how best to ensure that Scotland is prepared to respond effectively to major emergencies.
Strategic Coordinating Groups (SCGs)	Some disruptive events or emergencies require strategic multi-agency coordination at the local level (e.g. a major flood event). This is carried out by a Strategic Coordinating Group (SCG) in England, which can be activated by any responder organisation represented on the LRF. The SCG takes overall responsibility for the multi-agency management of the incident and establishes a strategic framework within which lower levels of command and coordinating groups will work. SCGs are usually chaired by the Police.
Subsidiarity	The principle whereby decisions are taken at the lowest appropriate level, with coordination at the highest necessary level. In practice this means that most incidents are handled within the capabilities of local agencies and responders, without central involvement.
Systemic vulnerability	Economic, societal, environmental and infrastructural factors that make a system more prone or vulnerable to the impacts of hazards or threats.
Threat	Malicious risks such as acts of terrorism, hostile state activity and cyber crime. Contrast with Hazard.
Upstream risk	Risks occurring in or affecting other countries, or in ungoverned spaces (including the oceans, space and cyberspace), which may then evolve to affect the UK.
Vulnerability	The quality or state of being more prone or exposed to the impacts of hazards or threats. Vulnerabilities could affect individuals, communities, assets or a whole system and may be caused by physical, social, economic and environmental factors or processes.
Wales Resilience Forum (WRF)	In Wales, strategic issues of emergency preparedness are considered at the Wales Resilience Forum (WRF) Chaired by the First Minister. The WRF provides a national forum for multi-agency strategic discussion and assurance for Welsh Ministers on civil protection and emergency planning.

Annex E: A (brief) history of Resilience

Resilience is a concept that has evolved over the last 100 years. During this time the UK has gradually moved from civil defence (a focus on war risks, with some spillover benefits) to Integrated Emergency Management (IEM, an all-hazards approach driven by risk assessment) to Resilience (preparedness for effects across networked systems). And in each case, embedding change has taken years.

Modern emergency powers have their roots in the post-WWI desire to be able to tackle any threat to the state, and to recognise broader civil contingency risks beyond the war. In the period running up to WWII, this early concept of emergency planning remained focussed on security, but did include consideration of critical supply chains and risks to national infrastructure. The expansion of this to include civil contingency risks, and to give local responders official responsibilities came just before the outbreak of WWII, and naturally focussed on protecting local communities from the impacts of war.

After the war, civil defence continued to develop to include smaller scale civil crises, including the widespread disruption caused by strikes in the 1970s. But as the risks facing the UK evolved and adapted in the post-war period, so did our approach to tackling them. It would not be until the 1980s that a new concept of IEM emerged, taking a broader risk-based approach to the whole range of hazards that faced the UK. This was adapted further in the early 2000s into a new Resilience approach, partly driven by the 9/11 attacks.

Now, IEM and Resilience are systems that are employed across the world. IEM forms the basis of work in most developed countries. The UK was an outlier when it adopted Resilience in the 2000s, but it is now common practice internationally. But the key deficiency with each of these approaches has been the inability to get ahead of problems - to tackle them at source.

The UK cannot and should not abandon IEM and Resilience. But expanding the concept of resilience means that instead of simply recognising that emergencies run across networks and systems, we reduce the risks in those systems in the first place.

This will take a huge shift and this framework is only the start. But just as the UK’s drive on Resilience transformed preparedness two decades ago by shifting engagement and focus, this framework provides a starting point to refocus and extend the civil protection system and beyond towards reducing the UK’s risk profile and building resilience.

1. Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy ↩ ↩²

2. Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy ↩

3. The ten point plan for a green industrial revolution - GOV.UK ↩

4. Net Zero Strategy: Build Back Greener - GOV.UK ↩

5. British energy security strategy - GOV.UK ↩

6. UK Climate Change Risk Assessment 2022 - GOV.UK ↩

7. Climate change: second national adaptation programme (2018 to 2023) - GOV.UK ↩

8. Supply chain resilience - GOV.UK ↩

9. National Cyber Strategy 2022 ↩

10. This framework specifically focuses on civil contingencies risk and the HM Treasury Orange Book (pdf, 1,070 KB) supports the UK Government to identify and manage a very broad range of risks, including, but not limited to technological, economic, legal and reputational risks. ↩

11. The Orange Book (pdf, 1,070 KB) ↩

12. Resilience to long-term trends and transitions to 2050 - GOV.UK ↩

13. Trend Deck Spring 2021 - GOV.UK ↩

14. Futures toolkit for policy-makers and analysts - GOV.UK ↩

15. Horizon Scanning: A Practitioner’s Guide (pdf, 653 KB) ↩

16. Emergency planning and response for education, childcare, and children’s social care settings - GOV.UK ↩

17. Ready Scotland ↩

18. Civil Contingencies Act 2004: post implementation review report (2022) - GOV.UK ↩

19. Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy ↩

20. The central government’s concept of operations - GOV.UK ↩

21. Category 1 responders are organisations such as the Local Authorities, the Police Force, Fire and Rescue Service, Ambulance Service, some NHS bodies, Environment Agency and Maritime and Coastguard Agency. Category 2 responders are organisations such as Electricity and Gas Network Operators, water and sewerage undertakers, telephone service providers, railway, port and airport operators and the Health and Safety Executive. ↩

22. Civil Contingencies Act 2004: post implementation review report (2022) - GOV.UK ↩

23. Civil Contingencies Act 2004: post implementation review report (2022) - GOV.UK ↩

24. In Northern Ireland the CCA currently only applies to the PSNI and MCA as Category 1 responders and certain telecommunications operators as Category 2 responders. ↩

25. Civil Contingencies Act - Category 2 Responders: overview of sectors and emergency planning arrangements ↩

26.   As defined in the Joint Doctrine Publication 02. (pdf, 4.1 MB) ↩

27. National Resilience Standards for Local Resilience Forums ↩

28. National Recovery Guidance - GOV.UK ↩

29. Flood recovery framework: guidance for local authorities in England - GOV.UK ↩

30. There are currently 13 sectors formally designated as CNI: Communications (sub sectors: Post, Telecommunications and Broadcast), Transport, Civil Nuclear, Chemicals, Defence, Energy, Water, Food, Emergency Services (sub sectors: Police, FRS, Ambulance and Maritime Coastguard), Health, Finance, Government and Space. ↩

31. 2020 Resilience Report ↩

32. 2020 Resilience Report ↩

33. This review focussed on public interest entities across the UK. ↩

34. The quality and effectiveness of audit: independent review - GOV.UK ↩

35. UK Vaccine Taskforce 2020 Achievements and Future Strategy (pdf, 932 KB) ↩

36. 100 Days Mission to respond to future pandemic threats (pdf, 1,114 KB) ↩

37. About Cyber Essentials - NCSC.GOV.UK ↩

38. The Report of the Iraq Inquiry ↩

39. Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy ↩

40. Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy ↩

41. Global Economic Resilience (pdf, 1,203 KB) ↩

42. CARBIS BAY G7 SUMMIT COMMUNIQUE ↩

43. UK supports new international drive to prevent and prepare for future pandemics ↩

44. Definition of ‘communities’ informed by the work of: Shaw D and Jordan R (2022) The Renewal of Community Resilience: A new local and national resilience capability? In:The Manchester Briefing on Covid-19 ↩

45. Cabinet Office Community Resilience Development Framework (pdf, 635 KB) ↩

46. Energy Emergencies Executive Committee Storm Arwen Review - Final Report (pdf, 539 KB) ↩

47. Provided by the Environment Agency as part of the Call for Evidence. ↩

48. National Risk Register (pdf, 3.6 MB) ↩

49. PWC Global Crisis Survey 2021 ↩

50. After Record Year, Supply Chain Funding Shows No Signs of Breaking Down 2022 ↩

51. DfT, Transport Resilience Review: A Review of the Resilience of the Transport Network to Extreme Weather Events 2014 (pdf, 5.9 MB) ↩

52. GREAT, The Business of Resilience: Summary Report 2022 (pdf, 1,698 KB) ↩

53. DCMS Cyber Security Breaches Survey 2022 ↩

54. NCSC, Annual Review 2021 (pdf, 9.7 MB) ↩

55. Better Training, Knowledge and Networks: the New Curriculum and Campus for Government Skills (pdf, 3.6 MB) ↩

56. Lessons Digest ↩

57. For example, a Hostile State attacking UK communications infrastructure in support of a military or political objective ↩

58. For example, a Hostile State using cyber to disrupt emergency services operations, or malicious communications to reduce public cooperation with emergency services and authorities in a crisis. ↩

59. Global Britain in a Competitive Age: the Integrated Review of Security, Defence, Development and Foreign Policy ↩

60. Findings of the Boardman review into pandemic procurement ↩

61. The central government’s concept of operations - GOV.UK ↩

62. JDP 02 (pdf, 4.1 MB) ↩