Policy paper

The UK Government Resilience Framework: 2023 Implementation Update (HTML)

Published 4 December 2023

Foreword from the Deputy Prime Minister

We are living through dangerous and volatile times. The risks we face are more complex - and they are evolving faster - than ever. Over the last year, the ongoing Russian aggression in Ukraine, increased cyber-attacks, early examples of artificial intelligence being misused, and extreme weather conditions have shown us the wide-ranging and long-lasting impact such risks have across our society.

I would like to take this opportunity to express my sincere gratitude for the service and commitment of our frontline responders to these events. We depend upon our ‘resilience community’ – from our emergency services, staff at institutions like NCSC, across local resilience forum members, to wider public, private, voluntary and community sector partners – to make our people safer and our country stronger. You are our national resilience personified. Thank you.

As Deputy Prime Minister, and the Cabinet Minister with responsibility for risk and resilience, it is a privilege to provide leadership to a system that involves so many exceptional individuals and organisations. The threats they are responding to, as set out in the National Risk Register, are manifold. However, we are making substantial and rapid progress towards building a more resilient United Kingdom. In particular, we are learning the lessons of the COVID-19 pandemic. 

We are taking two key approaches:

First, we are taking a ‘whole of society’ approach to resilience. That means involving a wide range of actors who together form our resilience community. It also means ensuring we have a shared understanding of risk across partners. That is why I am proud that the government published the most transparent ever public National Risk Register this year. I have benefited greatly from discussions in the UK Resilience Forum, bringing together groups ranging from emergency responders to businesses and charities, to discuss what actions are needed to respond to our collective view of the risk landscape.

Beyond these groups, we have further developed capabilities to provide information to citizens, such as the new Emergency Alerts service, which is now fully operational. This is one of many tools the government can deploy in emergencies, allowing us to rapidly communicate with the public in situations where there is danger to life.

The second element of our approach is focusing on delivering prevention rather than cure – early analysis and action which mitigates or prevents risks from emerging in the first place. Examples from my department alone include the publication of our UK Biological Security Strategy which sets out our renewed vision, mission, outcomes and plans to protect the UK and our interests from significant biological risks regardless of how they occur, and ongoing action to drive cyber resilience across multiple sectors and society.

In August, we published updated  Lead Government Department (LGDs) emergency management responsibilities to ensure the UK is well prepared to anticipate and respond to whatever risks we might face. This established model ensures that responsibilities are led by those best placed to discharge them and that all known risks to the UK continue to be fully owned and managed. I bring together these efforts by chairing the new, dedicated resilience sub-committee of the National Security Council, which coordinates the work on resilience at the most senior levels of government.

This Implementation Update provides a summary of what has been achieved in driving resilience since we published the UK Resilience Framework in December last year. But we must not stand still. As set out in my first annual statement to Parliament today, 4 December 2023, we look forward to building further on this work in 2024. 

There is a lot more to come.

Introduction: UK Government Resilience Update 2023

In September 2022, the Cabinet Office reorganised its existing resilience functions to create separate capabilities for preparedness and risk reduction, and crisis response - the Resilience Directorate and the Cabinet Office Briefing (COBR) Unit. This separation has created more stability and capacity for both tasks. In the 12 months since the implementation of this new structure, the government has made significant progress on delivering upon our objectives to increase the UK’s resilience and preparedness for risks, and excellence in crisis management.

Further to publication of the Resilience Framework in December 2022, the Resilience Directorate, under the Head of Resilience, has continued to develop the government’s strategic approach to resilience. We have improved our own understanding of risk through improvements to our risk assessment process, including work on defining chronic risks - i.e. challenges which build incrementally - as well as acute risks, which are likely to manifest as emergencies. We have continued to strengthen our ability to identify dependencies or vulnerabilities across society and work with different partners to address them, from Critical National Infrastructure operators, to the voluntary and community sector. We have also worked with Lead Government Departments (LGDs) to drive action to prevent risks from manifesting in the first place, including where the chronic risks we face, such as climate change through to artificial intelligence, can exacerbate acute risks. We have also worked to build our understanding of which groups are most vulnerable to risks so we can take targeted action to reduce their exposure.

This year, the COBR Unit, under the Director of COBR, has responded to various crises such as extreme weather, major water outages, flooding, a breakdown of the National Air Traffic Services (NATS) Flight Planning System, and evacuations of British Nationals from several crisis-hit countries. In tandem, it has been strengthening its crisis management capabilities including through the test of the UK-wide Emergency Alert system and the launch of the Crisis Management Excellence Programme to upskill government officials on crisis response.

The Resilience Directorate and COBR Unit work closely together to bring together the disciplines of resilience, risk and crisis management, to ensure that government works together with partners to get ahead of known risks. An example of this is work undertaken throughout this year to plan for likely risks this winter, where we have focussed particularly on those vulnerable to winter conditions, resulting in clearer and better coordinated communications, improved data sharing and proactive analysis to support any response to supporting vulnerable people in an emergency situation.

In the past year the UK COVID-19 Public Inquiry has also taken evidence in writing and held oral hearings on Module 1 which covers Resilience and Preparedness. This will provide important lessons for pandemic preparedness and wider resilience, and the government looks forward to receiving the Inquiry’s report and recommendations. This annual update outlines progress in the last year and does not pre-empt that report nor suggest that it covers everything needed to improve the country’s resilience.

Chapter 1 of this document sets out the government’s current understanding of the immediate risk landscape. But we cannot predict all crises, which is why it is vital to continue to focus our attention and effort on building resilience across the risk landscape, as well as our capabilities to manage crises when they do happen. Chapter 2 examines the progress made in this work in the past year.

Chapter 1: The risk landscape in 2023 - a snapshot

How the UK assesses risk

The UK faces a broad and diverse range of risks, including threats to lives, health, society, critical infrastructure, and economy. Risks may be non-malicious, such as accidents or natural hazards, or they may be malicious threats from malign actors who seek to do us harm. These risks are assessed through the classified, internal National Security Risk Assessment (NSRA). The latest external version of the NSRA, the National Risk Register (PDF, 2.5MB) (NRR), was published on GOV.UK on 3 August 2023. 

The NSRA is produced using a rigorous and well-tested methodology, based on international best practice. It draws on input and challenge from government departments, devolved administrations (DAs), the government scientific community, intelligence and security agencies, and independent experts. The process is evidence-led with 25,000 pieces of data used in the latest full assessment. As per the Lead Government Department (LGD) model, risks are owned by departments or other government organisations, who are responsible for assessing the impact and likelihood of their risks.

Risks in the NSRA and NRR are assessed using ‘reasonable worst-case scenarios’. These scenarios represent the worst plausible manifestation of that particular risk (once highly unlikely variations have been discounted) to enable relevant bodies to undertake proportionate planning. The scenarios for each risk were produced in consultation with experts and data was collected from a wide range of sources. The aim is not to capture every risk that the UK could face. Instead, the government aims to identify a range of risks that are representative of the risk landscape and can serve as a cause agnostic basis for planning for the common consequences of risks.

Looking back - risks in 2023

Against the backdrop of the NSRA and NRR assessments, the UK Government’s COBR Unit continuously monitors the risk landscape over the six months ahead and identifies risks to prioritise in the short-term.  This includes policy and operational interventions to mitigate or prevent risks, and responding or convening LGDs as needed.

Over the last year, the government has responded to a number of different incidents:

• Between December 2022 and January 2023, we stood up cross-government responses to prolonged extreme cold and major water outages due to freeze-thaw;
• During April and May we stood up cross-government crisis response structures in response to an evacuation of over 2,000 people from Sudan to the UK following an escalation in violence;
• In June, departments dealt with a technical fault which limited the public’s ability to access emergency services through the 999 system;
• In August there was a failure of the National Air Traffic Services (NATS) Flight Planning System which caused significant delays and cancellations to flights to and from the UK;
• Over the summer we utilised new impact-based Heat Health Alerts in response to extreme temperatures in parts of the country;
• In October and November we responded to severe winter storms and associated flooding across the country;
• We enacted contingency plans to deal with widespread disruption from industrial action, impacting a range of key services from transport, to education, to healthcare and beyond; and
• This year the National Cyber Security Centre (NCSC) received 2,005 incident reports, an increase of almost 64% from last year’s 1,226.

This has all taken place against a volatile global backdrop, where international incidents have the potential to impact the UK at home and abroad. The unprovoked and premeditated invasion of Ukraine continues to dominate the geopolitical landscape, with significant cross-cutting impacts, which include migration in the region, a wider energy crisis driving up costs and inflation around the world and food shortages. More recently, the terrorist attacks in Israel carried out by Hamas and the acute humanitarian crisis that is unfolding in the Occupied Palestinian Territories, which are already having serious knock-on implications in a number of areas.

Snapshot of risks 2023 and beyond

The government’s ability to build UK resilience and respond to challenges relies on our ability to continuously monitor emerging risks, and to integrate this alongside a timely and accurate assessment of the risks the UK faces in the longer term.

As we transition into the winter period, we will focus on the prospect of further severe weather and flooding, likely further spread of the ongoing avian influenza outbreak, and further industrial action. In healthcare, NHS resilience and performance has improved on average compared to last year, likely due to a decrease in COVID-19, better discharge processes, and new beds amongst other important work. Nevertheless, the picture remains challenging with the NHS facing significant pressures. 

On energy security, the situation has slightly improved since last winter due to greater confidence in the market and positive gas storage levels. We, and the respective energy system operators, expect the UK to be able to ensure the security of supply needs in all likely scenarios this winter. However, the UK, like many other countries, remains vulnerable to international events and to risks such as an unseasonable prolonged cold winter.

Looking forward to summer 2024, we know that due to a changing climate we can expect heatwaves, wildfires and potential pockets of drought or water shortages, as we have in previous years. The government has well-developed plans for any extremes the summer may bring, as do the Home Office and Defra as the LGDs for fire and water risks, respectively. 

Domestic impacts from international crises are also likely to continue into 2024. In addition to the crises set out above there is a risk of:

• Further conflicts and wider violent instability in Africa – as demonstrated by recent coups in Gabon and Niger and the ongoing war in Sudan – which could have negative implications for regional stability, migration, and humanitarian needs, as well as;
• El Niño and other weather events which could also drive an increase in the severity and scale of food security and other humanitarian needs in countries such as Afghanistan, Ethiopia, the Sahel, Somalia, Haiti and Pakistan.

Longer term challenges facing the UK

The risk landscape is ever-changing and shifting. Whilst the NSRA focuses on the  acute, time-limited risks, the UK also faces a range of chronic risks which are longer-term challenges that, if left unchecked, can erode our economy, community, way of life and/or national security. These risks can make acute risks more likely or more serious. Looking ahead, it is important to consider the risk landscape within the context of these longer-term challenges.

As outlined in the Integrated Review Refresh, the government is establishing a new analysis to identify and assess these continuous challenges. This work on chronic risks is critical as the world that the UK faces in the next few years could - for example - see serious impacts from environmental challenges such as climate change, the changing nature of serious and organised crime, as well as threats posed by artificial intelligence systems and their capabilities, or the increasing risk of antimicrobial resistance. Further detail on the analysis of these more continuous challenges will follow in 2024.

Chapter 2: Update on the Implementation of the UK Government Resilience Framework

1. The Resilience Framework, published in December 2022, set out the UK Government’s plan to strengthen the systems, structures and capabilities which underpin our national resilience.

2. The snapshot of the risk landscape set out in Chapter 1 illustrates that the risks we face are more complex than ever and evolving at a faster pace. Our efforts to sustain and strengthen our national resilience needs to keep pace. The Framework was a first step towards addressing that ongoing challenge, on which the government continues to build.

3. The Framework set out three core principles to underpin a strategic approach to resilience - which still hold. These are:

• A developed and shared understanding of the civil contingencies risks we face is fundamental;
• Prevention rather than cure wherever possible: a greater emphasis on preparation and prevention; and
• Resilience is a ‘whole of society’ endeavour, so we must be more transparent and empower everyone to make a contribution.

4. The measures in the Framework broaden and strengthen the resilience system and centre on six themes: risk, responsibility and accountability, partnership, community, investment and skills. 

5. The focus of the Framework was on the totality of the activity, people and systems which make up the UK’s resilience. From a government architecture perspective, in order to provide the building blocks to progress across the three principles, we have: 

• Overhauled our resilience and emergency response structures in the Cabinet Office, establishing the COBR Unit and the Resilience Directorate; 
• Appointed a new Head of Resilience, to drive collaboration and coordination of a wide community of actors in resilience, both inside and outside of government; 
• Established a new sub-Committee of the National Security Council on Resilience to oversee the government’s programme to ensure preparations are being made for risks on the horizon, and to make decisions on strategic choices to prevent, mitigate, or absorb those shocks and risks; and
• Continued to use our understanding of risk and other insights to better inform spending decisions, working towards our stated aim of a more coordinated and prioritised approach to investment in resilience within the government by 2030.

6. Since the publication of the Framework, the government has already delivered a number of public milestones, including through: 

• Publishing the most transparent ever National Risk Register to provide businesses, risk practitioners and the voluntary and community sector with as much information as possible about the risks they face, to support their own planning, preparation and response; 
• Publishing a revised Lead Government Department list, which makes clear risk ownership across the UK Government and devolved administrations (DAs) to ensure that all civil contingencies risks are appropriately and effectively managed and funded through all parts of the risk cycle;
• Introducing and testing the Emergency Alerts system which is now fully operational, providing a fast and versatile way to communicate with the public in life-threatening situations; and 
• Publishing three Lessons Digests which synthesise lessons identified from major exercises and emergencies. These are accompanied by webinars which promote and encourage lesson-learning within the resilience community.

7. The remainder of this document provides a comprehensive summary of our implementation progress in delivering commitments in the Framework. The tables below set out the progress against the three principles under the six themes in the Framework - noting that there are close interrelationships between each section. Together, this work demonstrates tangible delivery and improvement to resilience as a whole. We will continue to build, learn and improve as we go - learning lessons from events, exercises and Inquiries, including the COVID-19 Inquiry, to ensure we are taking the most appropriate approach.

8. The Framework outlines action for England and the UK Government in areas where responsibilities are reserved. However, all four nations of the United Kingdom share the same goal – to protect our citizens from the impacts of crises – and resilience encompasses both reserved and devolved matters. Where elements of the resilience system are overseen by the UK Government, we are committed to working in partnership with the DAs. Significant elements of resilience are wholly the responsibilities of the DAs. In implementing the Framework, the UK Government will continue to focus on drawing together the many actors and programmes across the resilience system.

Implementation update

Developing a shared understanding of risk

9. The risks that impact our prosperity and stability are complex and ever-changing, and they can pose profound structural and societal questions. We therefore need a developed and shared understanding of the civil contingencies risks we face in order to ensure we can adapt the resilience system to face them and incentivise risk-based decision making around our new understanding. This is fundamental to the work the government is undertaking to anticipate, prepare for, and recover from crises. 

10. In order to build that shared understanding of the risks we face, the government is working to:

• Ensure that the full range of actors with a role in our national resilience are aware of and able to act on the risks we face. This includes everyone from individuals and communities, through to local partners and responders, businesses, and the wider public sector; 
• Develop an increasingly sophisticated and dynamic understanding of the risk landscape, which reflects not just the acute risks that manifest in a particular event or emergency, but also how chronic risks can erode our society and way of life over time. It also means more effectively assessing and articulating how different risks are interconnected, how multiple risks  compound with each other, and how they change over time; and
• Create clear accountability and systems for managing risk, underpinned by a shared understanding of risk tolerance, including for complex, interconnected risks.

Key progress over the period December 2022 - December 2023 to develop a shared understanding of risk:

Risk analysis

• The government has implemented the transition of the National Security Risk Assessment (NSRA), the government’s assessment of the most serious acute risks facing the UK, to a dynamic risk assessment process. This means  risk assessments will be updated more frequently if required.   These changes will ensure that planners, practitioners and policymakers now have access to high-quality risk information, to fundamentally improve the ability to plan, prepare and mitigate risks in an effective way.

• The government has established a new process for identifying and assessing more continuous and enduring challenges - ‘chronic risks’ - that erode elements of our economy, society, way of life and/or national security (examples include antimicrobial resistance, climate change, and serious and organised crime). This complements the government’s assessments of acute risks via the NSRA and National Risk Register (NRR). Developed in consultation with government departments, Chief Scientific Advisors, external academics and experts, a number of key chronic risks have been identified and this work will support the government to enhance a shared view of the longer-term challenges facing the UK. More detail will be available on this work in 2024.
• The National Situation Centre (SitCen) has continued its multi-phase, multi-year programme to identify and map all crisis-related data across government. Over 500 data sources have now either been mapped or ingested into SitCen, with risk and impact data identified for two thirds of the NSRA risks. This knowledge base of pre-identified data has already improved the speed of situational reporting during major crisis responses, including severe weather events and international conflicts.
• In recognition of the critical role that data plays in developing a shared understanding of preparation and response to a crisis situation, the Office for National Statistics (ONS) in partnership with SitCen has developed and published new cross-government Crisis Data Sharing Guidance to collate existing guidance, best practice and principles into one accessible document.
• As part of its analysis work, the government has also increased work to assess preparedness to respond to the risks being identified through the NSRA, by conducting an assessment of government’s ‘cross-cutting capabilities’. These are the capabilities that are used to respond to the common consequences of NSRA risks, enabling the government to respond flexibly in a crisis. They include capabilities to manage fatalities and casualties, contaminated environments, and disruption to a range of critical services. All capabilities are owned by a Lead Government Department (LGD). The government is using this work to test its overall preparedness and to identify priorities for making improvements across the full spectrum of risks in the NSRA.
• The government has established a Catastrophic Impact Programme to review our processes and preparedness for the highest impact risks in the NSRA. The Programme will clarify ownership of complex and catastrophic risks and will sharpen the governance structures which underpin these responsibilities to ensure accountability. - Preparedness work for these risks continues across government: for example, the government continues to prepare for a range of pandemic and emerging infectious disease scenarios, in line with our revised assessment of the pandemic risk. This includes preparing for all five routes of disease transmission: respiratory, vector (mosquitoes, ticks, sandflies, etc.), contact/touch, oral (food/water), and sexual/blood.

Responsibilities and Accountability

• The government has appointed a Head of Resilience in the Cabinet Office who guides best practice, encourages adherence to standards, and sets guidance. 
• The government has updated Lead Government Department (LGD) emergency management responsibilities, to ensure that responsibilities are led by those best placed to discharge them. This provides clarity around LGD accountability, by setting out broad types of emergencies and confirming which government department, or other public body, should lead across each phase of the emergency management cycle (in England). It also confirms in which situations the devolved administrations will lead if responsibility is devolved.
• In recognition of the changing risk landscape, particularly in relation to our industrial legacy and expected changes in the UK’s weather and climate, the government laid a Statutory Instrument in February 2023 making the Meteorological Office and the Coal Authority Category 2 responders under the Civil Contingencies Act^{[footnote 1]}.

Partnerships

• The government has published the most transparent ever National Risk Register, which is based directly on the classified National Security Risk Assessment, with only a small amount of information not included for national security or commercial reasons. The government has updated the methodology, which now includes new and updated impact measures based on lessons learned from COVID-19. We have also added a new indicator - the government’s ability to deliver services - and updated other indicators, such as disruption to education and child services. Our approach to transparency on risk means that everyone, from risk practitioners to academics, can now see directly how the government identifies and assess risks. 
• Early next year, the government will launch a systematic expert advisory programme to ensure that the NSRA continues to be robust and well-informed as it transitions to a dynamic process. This will enable departments to seek constructive challenge on their risk assessments and ensure that the government’s understanding of the risk landscape is informed by the widest possible pool of external expertise.    
• In March, the Government Office for Science completed a development programme (PDF, 2.5MB) for the Scientific Advisory Group for Emergencies (SAGE), which addressed many recommendations that arose during the COVID-19 response. A new SAGE Continuous Improvement Process now ensures that lessons continue to be learned from any future SAGE activation, exercise or review. This includes improvements on the transparency of SAGE, its ways of working, and the recruitment, induction, diversity and support of SAGE experts.

Communities

• The government is preparing to conduct the first annual survey of public perceptions of risk, resilience and preparedness. The survey will gather information from a representative sample of the population in the UK to inform how the government best engages with individuals about risk and preparedness. The results will be made publicly available in 2024.

Skills

• The National Exercising Programme (NEP) has been restarted to test our readiness to respond to risks set out in the National Security Risk Assessment (NSRA), coordinating a wide range of exercising across government. This builds on two successful major exercises this year to test preparedness for a national power outage, and terrorist attack. These were national exercises, conducted across the country and with participants from inside and outside of government. Work continues to implement lessons identified.
• Through the Emergency Planning College, the government has delivered three publications of the Lessons Digest this year. This summarises lessons from crises, inquiries and exercises from a wide range of relevant sources to share insights consistently across government and wider partners. It coordinates knowledge to promote continual improvement in UK resilience training, exercising, doctrine, standards and good practice.  
• The government also continues to take its own action in learning lessons and implementing improvements following emergencies or Inquiry recommendations. For example:
  • Following the tragic fire at Grenfell Tower in June 2017, the government has been improving building and fire safety. This has included new fire safety legislation and guidance, additional funding for fire and rescue service capability, and capacity building programmes in protection and in support of the new Building Safety Regulator for high-rise residential buildings.
  • Following the terrorist attack at Manchester Arena in May 2017, the government published a draft Bill, on 2 May 2023, which if passed, will implement Martyn’s Law. This will keep people safe by introducing proportionate new security requirements for certain public venues to ensure preparedness for, and protection from, terrorist attacks.
  • The Manchester Arena Inquiry formally closed on 1 August 2023, with 170 recommendations for the government and Emergency Services. The Home Office are leading an assurance programme to oversee delivery of recommendations for the government.

Prevention rather than cure

11. The government’s work on resilience is grounded in the principle of prevention rather than cure wherever possible. The work on resilience therefore covers the whole risk cycle, with a focus on what can be done before crises happen. It is more cost effective to invest in risk prevention and building resilient systems that can withstand crises rather than relying solely on having one of the world’s best crisis response systems.

12. Accomplishing this means putting resilience at the heart of our decision making and investment, well beyond areas that are explicitly focused on emergencies or have been traditionally seen through the lens of crisis management. 

13. In order to achieve this, the government is working to:

• Embed a focus on resilience throughout government policy-making, ensuring that prevention is built into decisions by design;
• Further develop upstream interventions to mitigate risk impacts or prevent them from emerging where possible. Early analysis is guiding government action across issues including Artificial Intelligence, economic security, climate adaptation and sectoral resilience to energy shocks;
• Focus in particular on the resilience of and dependencies within our critical national infrastructure and supply chains, in order to build system-wide resilience; and
• Consider the downstream impacts to mitigate the impacts of compounding risks.

Key progress over the period December 2022 -  December 2023 on ‘prevention rather than cure’:

Risk analysis

• The government is using its analysis of acute and chronic risks, as well as the broad ‘strategic vulnerabilities’ identified in the Integrated Review Refresh, to deliver world-leading strategy and policy development that tackles the risks described. Using its understanding of risk, this year the government has delivered the following major strategic interventions:
  • In January, the Department for Environment, Food and Rural Affairs (Defra), the Forestry Commission, The Scottish Government and The Welsh Government published a new Plant Biosecurity Strategy for Great Britain, setting out key actions including how we will grow stronger outbreak response capabilities, continue to build a society that values plant health, create more biosecure plant supply chains, incentivise biosecure practices, and enhance plant health research. 
  • In March, the government published the Integrated Review Refresh 2023, updating the government’s security, defence, development, and foreign policy priorities to reflect changes in the global context since the Integrated Review 2021. The IRR confirmed resilience as one of four pillars of the government’s approach, with a focus on strengthening the strategic vulnerabilities that leave the UK exposed to coercion or global crises.
  • In March, the Critical Minerals Refresh set out how government is seeking to improve the resilience of critical mineral supply chains. The Department for Business and Trade (DBT) also launched an Independent Task and Finish Group on Critical Mineral Resilience for UK industry, to investigate the UK’s critical mineral dependencies and vulnerabilities, as well as opportunities for industry to promote resilience in their supply chains. In February 2023 a £15m Circular Critical Materials Supply Chains (CLIMATES) fund was announced. 
  • In May, Defra published the Plant Health R&D Plan setting out how the government will maximise the impact of our future investments with a focus across a range of themes including risk assessment, outbreak management and resilience and adaptation.
  • In May, the Department of Science, Innovation and Technology (DSIT) published the National Semiconductor Strategy, setting out collaboration with industry and academia on the core objectives of growing the domestic sector, mitigating the risk of supply chain disruptions, and protecting our national security. 
  • In June, the Cabinet Office published the updated Biological Security Strategy with the vision that by 2030, the UK is resilient to a spectrum of biological threats, and a world leader in responsible innovation. As part of this, SitCen is developing a Biothreats radar which will provide near real-time monitoring of emerging biological threats that may impact the UK which is due to be fully operational by 2025.
  • In July, the Home Office published an updated version of CONTEST - the UK’s Strategy for Countering Terrorism. The aim of CONTEST is to reduce the risk from terrorism to the UK, its citizens and interests overseas, so that people can go about their lives freely and with confidence.
  • In July, Defra published the Third National Adaptation Programme (NAP3), setting out the actions that the government and external bodies will take to adapt to the impacts of climate change in the UK over the next five years (2023-2028). This marks a step-change in the government’s approach to climate adaptation, setting out for the first time a high-level vision for a country that effectively plans for and is fully adapted to the changing climate.
  • In November, the UK hosted the first Artificial Intelligence (AI) Safety Summit bringing together leading AI nations, technology companies and researchers, to drive targeted, rapid international action to inform national and international policy making at the frontier of AI development. The attendees signed the Bletchley Declaration.

Partnerships

• Critical National Infrastructure (CNI) owners and operators are essential partners in building resilience to a wide range of risks and vulnerabilities in the UK. Working towards the overall commitment in the Resilience Framework to create common but flexible resilience standards across CNI, and do more on the assurance of CNI preparedness, this year the government has:
  • Undertaken an assurance self-assessment with Lead Government Departments responsible for CNI sectors to analyse baseline security and resilience in each sector, which will lead to a holistic appraisal of priorities; and
  • Driven the ‘Criticalities Process’ across government, a methodology that maps CNI assets and functions, to build the CNI Knowledge Base. This is a new tool to capture and visualise data on CNI, allowing the government to interrogate interdependencies between CNI systems.
• As well as this overall mapping, the government is taking ongoing action to support and strengthen resilience in CNI sectors including: water, food, transport and health this year, through:
  • Working with water companies and water regulators to develop strategic water resources options to improve England’s long-term water supply resilience using the £469m made available by Water Services Regulation Authority (Ofwat) in the current Price Review period running from 2019 to 2024. 
  • Holding the first Farm to Fork Summit on 16 May 2023, where the Prime Minister and Environment Secretary hosted 70 businesses, experts and representative organisations from across the UK supply chain. Announcements included a further £12.5 million to support research projects on environmental sustainability and resilience on farms in a changing climate. 
  • The Department for Transport (DfT) commissioned research into the impact on aviation from volcanic gases and aerosols to improve understanding about the potential impacts from volcanic gases in the international and UK aviation community. Findings were assessed through a combination of subject matter expert interviews and a multidisciplinary literature review. DfT ran a tabletop exercise with attendees from NATS (who provide traffic control services to flights within the UK and North Atlantic), the Civil Aviation Authority, airports and airlines. 
  • In December 2022, the government and Moderna entered a strategic partnership to set up mRNA research and development, and manufacturing facilities in the UK. Under the partnership, Moderna will build a new Innovation and Technology Centre in the UK, which will create more than 150 highly skilled jobs and have capacity to produce up to 250 million vaccines per year, in the event of a pandemic.
  • In February, the Department of Health and Social Care (DHSC) published its Medical Technologies Strategy with supply resilience and continuity of supply identified as one of four priority areas.  Work is focussed on strengthening contractual requirements, improving interoperability, increasing UK MedTECH manufacturing capability and capacity, and addressing resource security and efficiency. 
  • In November, DHSC re-procured the Express Freight Service (EFS), part of the National Supply Chain Disruption Response. Operational since December 2020, the EFS is an end-to-end (factory to patient) emergency global logistics service for any medical product subject to acute disruption or critical shortage.
  • DSIT published a Government Policy Framework for Greater Position, Navigation and Timing (PNT) Resilience. PNT services are largely provided through Global Navigation Satellite Systems, like the US GPS system, and are used by all thirteen of the UK’s CNI sectors. This Policy Framework sets out a range of actions to improve resilience and boost economic opportunity for the UK. For example: developing the case for a National Timing Centre run by the National Physical Laboratory; developing a proposal for a terrestrial, rather than space-based, navigation system; and establishing a National PNT Office, hosted by DSIT, to coordinate cross-government PNT work. The Policy Framework meets the commitment in the 2021 Integrated Review to strengthen the resilience of the PNT services on which our CNI and economy depend, and reduce the PNT risk identified in the National Risk Register.

Communities

• Identification of individuals who are particularly vulnerable to different risks enables preventative activity, and preparation to reduce the impact of emergencies if they do occur. The government continues to develop its approach to identifying and supporting vulnerable people across all risks and has also used the Framework’s principles to target planning for specific, likely, risks. An example of this is the government’s work to ensure those who are most vulnerable this winter are supported should any risks materialise. Government has driven activity to ensure:
  • Clearer and coordinated communications to vulnerable people across government systems, to amplify messaging and improve clarity and coordination;
  • Improved data sharing between utility providers of their priority user lists, and data provision nationally on the location of vulnerable persons. The majority of water companies and gas and electricity distribution network operators now share their Priority Services Register in this way. This ensures that any outages can be mapped across to data on potentially affected vulnerable people, to provide situational awareness during some  emergencies; and
  • Proactive development of a data strategy through the National Situation Centre (SitCen), to provide population level analysis of vulnerable groups that may be affected by winter-related risks such as power outages and extreme weather events.
• Building on the work undertaken for this winter, it was announced in the Autumn Statement that the government will consult on strengthening the economic regulation of the energy, water and telecommunications sectors - with proposals that include a universal, tell us once, priority services register so that vulnerable people can be confident their status is recognised by all their utilities providers and support will be provided when needed.
• The government is investing £5.2 billion in the Flood and Coastal Erosion Risk Management Capital Programme running from 2021 to 2027. The Environment Agency (EA) estimated that in the first two years of this programme approximately £1.5 billion of this funding has been invested, with around 60,000 properties better protected through over 200 completed schemes.
• An additional £200 million is being invested in the Flood and Coastal Innovation Programme running from 2021 to 2027. As part of this, from September 2023, a further three communities in the south west of England have been included in the ;Coastal Transition Accelerator Programme (CTAP), alongside North Norfolk and East Riding of Yorkshire.

Investment

• The government announced at the Autumn Statement that it will provide up to £10 million funding over 2024-25 and 2025-26 to finance research on risks to the economy and public finances, including the understanding of risk impacts, their potential mitigations and response preparations.

A ‘whole of society’ approach

14. The government only holds some of the levers needed to bolster our national resilience. We need to mobilise a more diverse set of groups and partners across the full risk landscape in order to prepare for and respond to emergencies on a whole of system and ‘whole of society’ scale. This includes strengthening those who already consider themselves part of our national and local ‘resilience community’. But it also means connecting with wider audiences, including individuals, businesses and communities.

15. By being more transparent we can empower everyone to make a contribution to resilience. This means organising society in a coherent, resilience-focused way, but also having a broader view, and understanding, of resilience. This includes how we structure the government’s resilience work, and what we expect of businesses, the local tier, voluntary organisations, community groups, and the public.

16. In order to achieve this, the government is working to:

• Be more transparent than ever about the risk landscape we face;
• Significantly strengthen Local Resilience Forums (LRFs) in England, in order to empower LRFs, local partners and local leaders better to build more resilient communities and places;
• Increase business engagement across government across the risk landscape and in particular, on emerging and priority areas for our resilience, such as cyber resilience, and our critical infrastructure and supply chains; 
• Engage more effectively across the public, private and voluntary sectors on risk, preparedness, crisis response and recovery, including through the new UK Resilience Forum; and
• Provide leadership across the resilience profession, by developing trusted sources of information, common standards, guidance, and training. The new UK Resilience Academy will set the standards and provide leadership across: traditional emergency planning, crisis management, organisational resilience, exercising capabilities, strategic prevention, personal resilience capabilities, and citizen preparedness. The Academy will expand on the existing offer from the Emergency Planning College, whilst continuing to provide a top class emergency planning curriculum.

Key progress over the period December 2022 - December 2023 on a ‘whole of society’ approach:

Risk

• The government launched the Emergency Alerts service to help save lives in emergency situations by issuing alerts to compatible smartphones. Emergency Alerts are a fast and versatile way to communicate with the public in life-threatening situations. Alerts will only be sent when there is an imminent threat to life. The capability can target a chosen geographical area and alerts must include specific actions that the public can take to save lives. The system is now ready to use where lives are at risk.
• The Deputy Prime Minister will give the first Annual Statement to Parliament on civil contingencies risk and our performance on resilience this year. This statement will include the government’s understanding of the current risk picture, performance on resilience and current state of preparedness. It represents a shift in our transparency on risk and will complement the more technical risk information provided to practitioners. It will also provide a baseline for work on civil contingencies across the public and private sectors.
• The most transparent ever National Risk Register published this year is also a significant milestone in demonstrating a commitment to transparency as part of the whole of society approach.

Responsibilities and Accountabilities

• The Strengthening Local Resilience Forums (LRFs) Programme will significantly strengthen and empower LRFs, broadening their mission to place an increased emphasis on the active building of resilience in their areas and communities, alongside their risk-based planning and operational activity. The Department for Levelling Up, Housing and Communities (DLUHC) has now confirmed eight pilot areas that capture the breadth and diversity of the sector, and is working with these LRFs to develop their fuller pilot plans. The eight LRFs selected to take forward a pilot are: West Mercia, Suffolk, Gloucestershire, Cumbria, Greater Manchester, Northumbria, Thames Valley, and London.

Partnerships

• The UK Resilience Forum (UKRF) provides a formal forum for cross-sectoral communication and collaboration on risk and emergency preparedness by bringing together national, regional and local government, private and voluntary sectors - for example CNI operator representatives and charities like Citizens Advice and the British Red Cross - and other interested parties. The Deputy Prime Minister has chaired two UKRF meetings this year, providing challenge and insight to the government on the strategic resilience programme and aligning emergency preparedness activities, for example for winter pressures.
• The UK continues to show international leadership and cooperation on resilience issues and build multilateral and bilateral discussions. Senior officials have contributed to multilateral partnerships on National Resilience Goals with NATO, on CNI with Five Eyes partners and the OECD High-Level Forum on risk. Ministers and officials also continue to develop bilateral relationships, recognising the risks we face are part of an interconnected world. The UK also hosted the world’s first AI Safety Summit bringing together multiple nations to discuss the risks presented by Frontier AI.
• All four nations of the United Kingdom share the same goal - to protect our citizens from the impacts of crises - and resilience encompasses both reserved and devolved matters. The UK Government has run a regular formal programme of meetings at ministerial and official level with the devolved administrations on resilience matters - including the implementation of the Resilience Framework, key short-term priorities, and on sharing best practice. This sits alongside day-to-day work between UK Government departments and devolved administrations to build resilience in their specific policy areas and sectors.
• To further enable collaboration and information sharing across multi-agency boundaries for the full cycle of emergency preparedness, Cabinet Office has started the modernisation of our online ResilienceDirect Service. ResilienceDirect is a unique digital online private ‘network’, which enables practitioners to work together across geographical and organisational boundaries during the preparation, response and recovery phases of an event or emergency. The service already has over 114,000 registered users across the UK, Crown Dependencies and Overseas Territories.
• Business and industry have a vital role to play throughout our national preparedness and resilience, including across many essential services such as transport, health and food. The government continues to build its approach to working in active partnership with businesses to further our national resilience, including through:
• Publishing a Critical Imports and Supply Chain Strategy, informed by a survey and a series of round table discussions with businesses, to set a clear vision for the actions that government and businesses will jointly take to improve UK supply chain resilience. This will be led by the Department for Business and Trade (DBT);
• Establishing the Economic Security Private-Public Sector Forum, chaired by the Deputy Prime Minister, to better engage business leaders from strategically important sectors and to develop solutions to shared national security challenges. The Forum will meet in December 2023 for the first time; and
• Establishing the National Protective Security Authority (NPSA), which provides intelligence-led advice to businesses and institutions in sensitive sectors of the economy, including CNI, emerging technology and academia.
• Ensuring our critical national infrastructure is prepared for and resilient to cyber threats is extremely important. Through the National Cyber Strategy, government is delivering a collaborative approach to improving UK cyber resilience working with a range of partners, with progress summarised in the Annual Progress Report published in August this year. The government has been working across various CNI sectors such as health and energy to increase cyber resilience through:
  • Launching the government’s new cyber assurance scheme, GovAssure in April 2023, to review the cyber health of all central government departments through new, more robust criteria;
  • Strengthening the resilience of critical national infrastructure operators to cyber threats, including by setting new, more specific ambitions, alongside plans to bring all private sector businesses working in critical national infrastructure within the scope of cyber resilience regulations, as announced at the CYBERUK 2023 conference;  
  • Publishing the Department for Health and Social Care (DHSC) ‘A cyber resilient health and adult social care system in England: cyber security strategy to 2030’, in March 2023. It sets out the threats facing the health and care system and their planned response. The strategy outlines how DHSC will adopt the Cyber Assessment Framework, developed by the National Cyber Security Centre (NCSC), to help manage cyber risk across the system. This outcomes-based approach will encourage local organisations to own their cyber risk, but will be bolstered by a limited number of mandatory requirements from the centre; 
  • Announcing DHSC’s first directive policy, in August 2023, which mandates the implementation of multi-factor authentication for businesses. Significant progress has been made in improving Adult Social Care (ASC) cyber security, including work to increase compliance with the Data Security and Protection Toolkit (DSPT); and 
  • Developing the Department for Energy Security and Net Zero’s (DESNZ) regulatory framework for energy cyber security to increase the resilience of future smart and flexible energy systems to cyber threats. In line with the commitments set out in the Smart Systems and Flexibility Plan 2021 and the consultation on Delivering a Smart and Secure Electricity System 2022, DESNZ is setting regulatory requirements for Energy Smart Appliances, and developing a new licensing framework for the organisations who control these devices, including new cyber security requirements.

Communities

• The Cabinet Office has established the Voluntary and Community Sector Strategic Discussion Forum to bring together senior leaders from the voluntary sector partners of the UKRF, DLUHC and Department of Culture, Media and Sport (DCMS) to strengthen and deepen relationships, and seek a shared understanding of relevant activities that contribute to national resilience. The forum, which has met three times this year, meets every six months in the intervening periods of the UKRF, providing an additional space for government to meet with sector representatives.
• Government has taken forward work to offer better guidance and support to LRFs for working with vulnerable persons in their communities. This includes a review and update of current guidance to support identification of vulnerable persons during an emergency, and the development of an off-the-shelf exercise for LRFs to support local responders’ planning for vulnerable persons.
• In November, the government announced that victims of major disasters would be better supported as they rebuild their lives with a new and permanent Independent Public Advocate. This will ensure that survivors of major incidents like Hillsborough, the Manchester Arena bombing and the Grenfell Tower fire will be able to quickly receive the help and advice they need, when they need it. The amendments are being made to the Victims and Prisoners Bill as it returns to Parliament.

Skills

• The UK Resilience Academy (UKRA) will be core to the ‘whole of society’ approach, ensuring that all those who work on resilience have the capability and knowledge they need to play their part. This includes government departments and arm’s length bodies (ALBs), local resilience forums and partnerships, emergency responders, the voluntary and community sector, CNI, businesses, as well as tools for households and individuals. In line with the Framework’s commitment to establish the UKRA by 2025, the government is undertaking a stakeholder roadshow to test seven proposed pillars for the UKRA: emergency planning, crisis management, exercising, personal resilience, strategic prevention, organisational resilience, and citizen preparedness - with a wide range of groups across the country.
• Progress has been made to develop relevant training and skills pathways to provide immediate opportunities in upskilling those who need capabilities and to support the development of the UKRA.     
• The government launched its Crisis Management Excellence Programme (CMEP) in May 2023 to professionalise crisis management in government through a combination of formal training, informal knowledge sharing, exercising, and a cross-government community of like-minded professionals. This is a long-term programme of upskilling, challenging, collaborating and growing across the community, to achieve world-leading crisis management and real culture change. Since its launch we have provided training to 245 Civil Servants in the foundations of crisis response. By the end of the financial year 2023-24, the final number of Civil Servants attending the Foundation Pathway will be 690.
• A UK Resilience Learning Needs Analysis was launched in October 2023 to capture the resilience learning and leadership requirements from the resilience community, including government departments, devolved administrations, LRFs, the CNI sectors, and the voluntary and community sector. 
• The Emergency Planning College is developing good practice guidance for exercising and managing lessons from incidents and exercises, to sit alongside the current learning offer and guidance. 

1. Category 2 responders are likely to be heavily involved in some emergencies: The duties placed on Category 2 responders relate primarily to cooperating and sharing information with other responders. ↩