| 25 November 2025
The UK Government’s National Risk Register 2025 identifies 89 major risks across nine categories, from natural hazards to cyberattacks. Among these are threats to national infrastructure, where even brief disruptions can trigger serious consequences. As healthcare depends on power, water, communications, and digital systems to function safely, a single failure can quickly cascade across services, disrupting essential operations, putting patient safety at risk and intense pressure on the workforce.
Key threats to national infrastructure and their impact
Power outages pose one of the most immediate risks. The health service relies on continuous electricity for lighting, ventilation, medical equipment, refrigeration, and IT systems. During the April 2025 blackout in the Iberian Peninsula, the Portuguese National Health Service faced over eight hours without reliable power. Hospitals were forced to triage essential equipment, digital health records became inaccessible, cold storage for medicines failed, and emergency communications broke down. It showed how a single outage can ripple through the entire healthcare system.
Water supply failures bring a different set of risks. Thames Water has warned that rainfall levels in parts of the UK have dropped to less than half the seasonal average, with reservoir storage running well below normal. Hotter, drier summers are becoming more frequent, raising the likelihood of drought-related restrictions. In the future, this could mean phased limits on water use, from temporary bans on non-essential activities to longer-term supply disruptions. Without water, sanitation, infection control, catering and basic patient care all become severely compromised, making early planning essential.
Telecommunications failures add another layer of risk. A loss of phone lines or internet connectivity can leave organisations without the ability to coordinate teams, escalate emergencies or keep patients informed.
Finally, cyber threats remain highly prevalent with 43% of businesses and 30% of charities reported having experienced any kind of cyber security breach or attack in the last 12 months. A single successful attack can paralyse digital records, delay diagnostics and shut down scheduling systems.
Planning for 1 hour, 1 day, 1 week
A simple but effective way to start building preparedness is the 1 hour, 1 day, 1 week rule. This framework helps organisations explore not only the operational impact of losing critical services over different timeframes but also the workforce capacity and skills needed to respond effectively.
The principle is simple: ask what your organisation would do if a critical service, i.e. power, water, gas, communication lines or IT systems failed for one hour, one day, or one week. Each timeframe brings different challenges and thinking them through in advance helps you understand where your operations are most vulnerable.
- One hour: Would essential services keep running if a sudden outage hit? Could staff continue safely while you waited for systems to come back online?
- One day: How would you manage patient care, staff welfare and communication if key services were down for an entire working day?
- One week: What long-term alternatives would you need to keep services safe and compliant if there was no clear end to the disruption?
To turn that planning into meaningful results, our Scenario Informed Resilience Assessment takes this a step further. It’s:
- Immersive and scenario-based, so you don’t just plan on paper, you test your response in realistic disruption scenarios.
- Integrated with workforce planning insights, helping you understand the skills and capacity your teams would need in real crises.
- Designed to give you practical recommendations and a readiness rating tailored to your organisation’s context, supporting your EPRR planning and overall resilience objectives.