The National Risk Register is a strategic planning tool, not a ready-made site risk assessment. For public sector leaders, the practical task is to translate national risk scenarios into decisions about people, buildings, technology, suppliers and essential services at each location. That means identifying which risks could interrupt priority outcomes, testing the dependencies that make those outcomes possible and assigning clear action before an incident occurs.
The need for this translation is urgent. The UK risk landscape is increasingly interconnected: a cyber incident can disrupt access control, communications and clinical or civic services; severe weather can cause simultaneous failures in power, transport and staffing; and a malicious act can create operational, welfare and reputational consequences at the same time. A national assessment provides the horizon. Site-level leadership turns that horizon into preparedness.
In brief: use the National Risk Register to challenge local assumptions, select plausible scenarios and expose dependencies. Then document controls, decision triggers, accountable owners, exercising arrangements and recovery priorities for each site.
The National Risk Register 2026 is the public-facing version of the National Security Risk Assessment. It sets out the government’s assessment of the most serious risks facing the UK, including their likelihood and potential impact. Each risk is considered through a reasonable worst-case scenario over a two-to-five-year assessment period.
The 2026 edition reflects a changing risk environment. It introduces new risks connected with cyber attacks on data, water and policing systems, digital resilience failure and interference in democratic processes. It also reinforces a central lesson for public services: disruption rarely respects organisational boundaries. Risks spread through shared systems, infrastructure, supply chains and public confidence.
The National Risk Register is designed to support planning, but it is not a prediction and should not be copied directly into a corporate or site risk register. A national reasonable worst-case scenario describes what could happen at UK scale. A local authority office, hospital, university, transport site or public venue still needs to determine how the scenario would present locally, who would be affected and which services would become unsafe or unavailable.
The government’s 2026 Resilience Action Plan implementation report places practical delivery, vulnerable people and a whole-of-society approach at the centre of resilience. For public sector leaders, this means moving beyond the existence of plans and asking whether the organisation can actually absorb disruption, make timely decisions and maintain priority services.
Two sites within the same organisation may face the same national hazard but have very different exposure, vulnerability and consequences. One building may have resilient power, dual network routes and 24-hour security. Another may depend on a single substation, one communications provider and a small duty team. A generic score can conceal these differences.
Site-level assessment should account for five factors:
Local exposure: proximity to flood zones, transport hubs, crowded places, industrial neighbours, protest locations or other sources of risk.
Service criticality: the consequences if a function is unavailable for two hours, one day, three days or longer.
People and vulnerability: patients, residents, pupils, visitors, lone workers, people with mobility or communication needs and anyone who may become vulnerable during prolonged disruption.
Dependencies: power, water, telecommunications, digital platforms, specialist suppliers, transport, fuel and key personnel.
Control reliability: whether safeguards are maintained, understood, available out of hours and proven through testing.
The result should be a local picture of consequence and capability. It should show not only the likelihood of an incident, but how quickly harm could develop, which thresholds require escalation and how long the organisation can continue operating safely.
Identify the services that must be maintained, restored quickly or stopped safely. These may include urgent care, safeguarding, emergency accommodation, public communications, democratic functions, statutory records, building security or access to essential payments. Define a minimum acceptable level for each outcome and the maximum tolerable period of disruption.
This creates a practical test for every scenario: can the site continue to deliver what matters most, and for how long?
Review the National Risk Register by risk family rather than treating every entry as a separate planning project. Useful families include severe weather, utilities failure, cyber and digital disruption, public health, malicious threats, supply chain interruption and transport disruption.
For each family, ask whether the site is directly exposed, dependent on affected infrastructure or likely to experience secondary consequences. Record why a risk has been prioritised, monitored or screened out. This audit trail helps leaders demonstrate a reasoned approach rather than a subjective shortlist.
Translate national scenarios into operational conditions. Instead of “loss of power”, consider a 48-hour outage affecting normal and backup supply during winter, with mobile networks degraded and staff unable to travel. Instead of “cyber attack”, consider the loss of identity systems, email, building access data and a critical case-management platform at the same time.
Scenarios should be demanding but credible. Include the time of day, duration, warning period, occupied areas, vulnerable groups, concurrent pressures and assumptions about external assistance. Avoid plans that depend on emergency services or suppliers arriving immediately unless that response has been agreed.
For every priority service, identify the people, premises, systems, information, utilities and suppliers it requires. Then look for shared dependencies. A single network connection may support phones, alarms, access control and operational systems. One contractor may maintain generators across several sites. One member of staff may hold the only current contact list or manual workaround.
Dependency mapping should extend beyond tier-one suppliers. Ask what your supplier depends on, how quickly stock or capacity can be replaced and whether contractual service levels remain realistic during a regional emergency.
Document preventive, protective, response and recovery controls, then test whether they are suitable and functioning. A written procedure is not a reliable control if staff cannot find it, understand it or use it when systems are unavailable. Evidence may include maintenance records, inspection results, competency records, supplier assurance, exercise reports and corrective actions.
Use a consistent methodology across safety, security and continuity risks. Our guide to a health and safety risk assessment explains the core principles of identifying hazards, evaluating controls and recording proportionate action.
A balanced treatment plan should cover:
Prevention: reducing the probability of disruption where possible.
Protection: limiting harm to people, information, assets and services.
Preparedness: building capability through plans, training, resources and mutual aid.
Response: making decisions, communicating and coordinating under pressure.
Recovery: restoring services, supporting affected people and capturing lessons.
Controls should be specific. “Improve communications” is not an action. “Issue offline contact cards to duty managers, test the cascade quarterly and maintain a satellite phone at the fallback location” is measurable and assignable.
Plans need clear activation criteria. Specify who can declare an incident, close a site, move services, request mutual aid or approve public messaging. Establish alternatives if the designated decision-maker is unavailable.
Decision triggers may include loss of a critical system beyond a set period, falling staffing levels, unsafe internal temperatures, failure of backup power, a credible threat warning or the loss of two independent communications channels. Connect these triggers to escalation routes and practical protective actions. Where a security incident may require different movement strategies, leaders should understand the distinction between evacuation, invacuation and lockdown in public buildings.
Exercise the decisions and dependencies most likely to fail, not only the parts teams already perform well. Tabletop exercises can test leadership judgement and information flow. Functional exercises can test call-out, relocation, manual procedures or backup equipment. Live exercises may be appropriate where risks and safeguards permit.
Record observations, assign actions and set deadlines. Lessons are only valuable when they change plans, training, resources or governance. Reassess after significant incidents, exercises, organisational change, refurbishment, new technology, supplier changes or updated national and local risk information.
Public sector boards, executives and site leaders should be able to answer the following questions with evidence:
Do not treat cyber risk as an IT-only issue. Test how operational teams would work without email, shared drives, cloud platforms, telephony, identity services or electronic access control. Decide which manual processes are safe, how information will be recorded and reconciled, and when degraded operation becomes unacceptable. Keep critical contact and response information available offline, with appropriate security.
Confirm what backup systems actually support, their fuel or battery duration and the conditions under which they have been tested. Identify equipment that may not restart automatically. Consider sanitation, heating, cooling, lifts, fire systems, food safety, medical devices, security and remote workers. Plan for degraded mobile coverage and high demand on suppliers during a widespread outage.
Assess the combined effects of heat, flooding, storms, drought and cold weather on buildings, staffing, transport and vulnerable people. Set thresholds for service changes and building closure. Check whether fallback sites share the same flood catchment, transport route, power supply or telecommunications infrastructure, otherwise the apparent alternative may fail at the same time.
Integrate protective security with business continuity, health and safety and safeguarding. Review hostile reconnaissance, suspicious activity reporting, access control, mail handling, public events, protest, violence and communications. Staff need simple, role-relevant instructions and confidence to escalate concerns. Protective measures should be proportionate, inclusive and compatible with normal public access wherever possible.
Under the Civil Contingencies Act 2004, Category 1 responders have duties that include assessing risk, maintaining emergency plans and business continuity arrangements, cooperating, sharing information and warning and informing the public. Category 1 responders include emergency services, local authorities and specified NHS bodies. Category 2 responders, including many utilities and transport organisations, have important cooperation and information-sharing duties.
The precise legal and operational position varies by organisation and nation within the UK. Leaders should align site plans with corporate arrangements, Local Resilience Forum or equivalent structures, sector guidance and relevant regulators. Plans should identify where local action connects to multi-agency command, mutual aid and public communications.
Compliance should not be reduced to possession of documents. Senior leaders need assurance that arrangements are current, resourced and usable. Legal duties create a baseline. Operational resilience depends on capability.
A useful resilience report is concise, evidence-led and decision-focused. It should show the most material scenarios, essential services at risk, control effectiveness, residual exposure, overdue actions and decisions requiring senior support. It should also identify assumptions that depend on partners, suppliers or government assistance.
Boards and executive teams should ask for trends, not a one-off score. Are exercise actions closing on time? Has backup duration improved? Are more teams able to operate without core systems? Have incidents revealed repeated weaknesses? Can the organisation protect people who may become vulnerable during a prolonged emergency?
The strongest assurance comes from triangulation: documented plans, physical inspection, staff interviews, technical tests, supplier evidence and exercises. If these sources tell different stories, the discrepancy is itself a risk.
Copying national risk descriptions without localisation: this produces broad statements but few operational decisions.
Assessing hazards in isolation: real incidents often create cascading failures across systems and services.
Focusing only on response: recovery, welfare, backlog and public confidence may require longer-term resources.
Assuming plans equal capability: untested plans and unfamiliar equipment provide weak assurance.
Ignoring out-of-hours conditions: fewer staff, locked areas and unavailable specialists can alter the risk substantially.
Overlooking vulnerable people: vulnerability can change as power, transport, medication, communication or support becomes unavailable.
Leaving actions without owners or deadlines: accepted risk must be explicit, authorised and reviewed.
The National Risk Register gives public sector leaders a shared view of serious risks. Its value is realised when organisations use that view to improve local decisions, controls and capability. Start with essential outcomes, build credible site scenarios, expose dependencies, agree activation thresholds and test the arrangements with the people who will use them.
Effective resilience is not a separate document or an annual compliance exercise. It is a management discipline that connects risk, safety, security, continuity, estates, digital services, communications and leadership. When those functions work from the same scenarios and evidence, public services are better placed to protect people and continue delivering what communities rely on.
This guide provides general information and is not legal advice. Organisations should obtain competent advice for their circumstances and consider applicable legislation, regulatory requirements and local multi-agency arrangements.