Articles | Volume 18, issue 4
Research article
27 Apr 2018
Research article |  | 27 Apr 2018

The role of minimum supply and social vulnerability assessment for governing critical infrastructure failure: current gaps and future agenda

Matthias Garschagen and Simone Sandholz

Increased attention has lately been given to the resilience of critical infrastructure in the context of natural hazards and disasters. The major focus therein is on the sensitivity of critical infrastructure technologies and their management contingencies. However, strikingly little attention has been given to assessing and mitigating social vulnerabilities towards the failure of critical infrastructure and to the development, design and implementation of minimum supply standards in situations of major infrastructure failure. Addressing this gap and contributing to a more integrative perspective on critical infrastructure resilience is the objective of this paper. It asks which role social vulnerability assessments and minimum supply considerations can, should and do – or do not – play for the management and governance of critical infrastructure failure. In its first part, the paper provides a structured review on achievements and remaining gaps in the management of critical infrastructure and the understanding of social vulnerabilities towards disaster-related infrastructure failures. Special attention is given to the current state of minimum supply concepts with a regional focus on policies in Germany and the EU. In its second part, the paper then responds to the identified gaps by developing a heuristic model on the linkages of critical infrastructure management, social vulnerability and minimum supply. This framework helps to inform a vision of a future research agenda, which is presented in the paper's third part. Overall, the analysis suggests that the assessment of socially differentiated vulnerabilities towards critical infrastructure failure needs to be undertaken more stringently to inform the scientifically and politically difficult debate about minimum supply standards and the shared responsibilities for securing them.

1 Why the integration of critical infrastructure, social vulnerability and minimum supply matters

Critical infrastructure (CI) plays a key role in shaping a society's vulnerability towards natural hazards and the resulting risk of disasters (see Grubesic and Matisziw, 2013; Sage et al., 2015; Pescaroli and Alexander, 2016). Infrastructure for electricity, water, transport, health and law enforcement, for example, plays a critical role for the day-to-day functioning of a society. The importance of such infrastructure becomes particularly evident in situations of disasters and crises, when CI is prone to fail, thereby causing wider impacts on the society. The vulnerability and/or resilience of CI itself is therefore increasingly moving into the focus of scientists, risk practitioners and political decision makers (see Critical 5, 2014, 2015; Herzog and Roth, 2014; McGee et al., 2014). This attention is further driven by the growing role of CI resulting from the rising societal dependence on technology, the ever-growing connectedness of infrastructure systems in the age of information technology and the growing global connectedness of people, production, trade and communication (Collins et al., 2011; Miles, 2015).

However, while increasing attention has lately been given to assessing the exposure and sensitivity of CIs and the crisis contingencies in their management (e.g., through so-called stress tests of nuclear power plants in the European Union following the Fukushima disaster), it remains highly questionable whether such a focus sufficiently captures the wider linkages between CI failure and social vulnerability in a society at large. Anecdotal evidence and structured expert dialogues1 suggest that risk in relation to CI failure is currently captured in rather narrow and technocratic ways, focusing largely on technical parameters of individual infrastructure branches (e.g., water supply or power generation) whilst failing to sufficiently capture the wider effects of CI failure on societal risk and risk cascades (e.g., disruption in water supply due to electricity blackouts or a standstill of public transportation due to disruptions in ICT technology). Most importantly, however, it seems that the technical discourse on CI failure does not adequately link into the domain of social vulnerabilities. It is not well understood which differential impacts CI failure may have on different parts of the society (e.g., different age groups, neighborhoods, people with special need for care) and how these differential impact patterns relate to different hazard and crisis scenarios (e.g., a power blackout during a summer heat wave, affecting the potential for air conditioning and water supply, vs. a flood-induced blackout during autumn or winter, affecting issues such as electric heating).

Social vulnerability studies provide powerful analytical lenses to approach such questions. Vulnerability thinking is, at its core, tailored to bring together (hypothetical) hazard scenarios with the societal predispositions for suffering harm when affected by such hazards (Blaikie et al., 1994). One of the core interests in vulnerability studies has therefore always been to ask whether and how hazards and crises (such as a compound flood-cum-blackout hazard) have differentiated effects on different groups within society.

For the management of CI failure, the vulnerability perspective also begs important scientific, normative and political questions with respect to the linkages between CI failure, social vulnerability and minimum supply: which levels of minimum supply (e.g., of electricity and water) are needed to avoid disastrous effects of natural-hazard-induced infrastructure failure? How are these minimum supply requirements perceived to differ between social groups (e.g., single elderly vs. family households or rich vs. poor neighborhoods) as well as between different other infrastructure elements (e.g., hospitals vs. water treatment plants vs. shopping malls)? Who ought to be responsible for securing a level of minimum supply (e.g., state authorities vs. private households)? Such debates are far from being at the core of ongoing discourses, posing serious questions about preparedness. One example is the 2016 German Civil Defence Concept (Konzeption Zivile Verteidigung, KZV) requiring Germans to stockpile private supplies for the case of widespread infrastructure failure. Instead of being taken seriously, the plan was widely ridiculed (within Germany as well as in international media coverage, such as BBC, 2016; Financial Times, 2016; Spiegel, 2016), indicating an overreliance on continuous infrastructure provision, making the German case particularly interesting to look at.

Against this background, the paper asks which role social vulnerability assessments and minimum supply considerations can, should and do – or do not – play for the management and governance of CI failure. In doing so, the paper analyzes the current scientific debate as well as the situation in terms of policies and legal provisions in different contexts, including predominantly the case of Germany. This contribution seeks to explore current gaps and inform a future research agenda on the nexus of CI failure, social vulnerability and minimum supply.

The paper is structured into six sections. The next section presents our methods and data for the literature and document analysis. Section 3 provides key results. Section 4 builds on the findings to sketch a heuristic model that helps to conceptually frame the relationships between CI failure, social vulnerability and minimum supply. Section 5 presents and debates a future agenda for science and practices. Section 6 presents key conclusions.

Figure 1Scientific publications related to critical infrastructure.


2 Data sources and methods of analysis

In order to get a more detailed understanding of how science, practice and policy have been dealing with the intersection of CI management, social vulnerability reduction and minimum supply, we conducted a systematic literature and document review. It covered three main fields of information. First, we reviewed scientific literature. A structured document search was conducted in the Scopus database in July 2017, which captures a wide range of academic literature, including most peer-reviewed journal articles, book chapters and proceedings of internationally important conferences. We applied different key word searches in order to identify relevant contributions. In a second step, we did a content analysis of the abstracts of the resulting documents in order to group the contributions into three groups: explicitly relevant (i.e., contributions that explicitly speak to the linkages between CI failure, social vulnerability and minimum supply or at least two of these elements), implicitly relevant (i.e., contributions which do not primarily target these linkages, e.g., in their titles and objectives, but nevertheless address them indirectly) and not relevant (i.e., contributions shortlisted by the keyword search but not making relevant statements about the nexus of interest here). Overall as few as 15 papers were found directly linked to the core topic of this paper, while another 79 provided implicit information.

The second body of data captured in the analysis is composed of legal, policy and practice documents, published by national or international authorities and organizations. Identified by strategic Google searches and snowball sampling, the final set of data analyzed in this group contained 73 documents. Different from the scientific literature, the focus of these documents is a more applied one, mostly aiming at regulating or defining different infrastructure standards or at disseminating information on preparedness. In terms of the legislative documents, a regional focus was put on Germany and the EU since policies could not be assessed for each country on a global scale and this research was conducted as part of the research project KIRMIN focusing on a German case study. The policy and practice documents covered publications by international, European and German organizations working in the field of disaster risk reduction and civil protection (e.g., the United Nations Office for Disaster Risk Reduction) as well as research councils, consultancies and other bodies. All documents in both streams (roughly 5500 pages in total) were then analyzed through an in-depth content analysis using MaxQDA software. The analysis was guided by the following question: how are CIs, minimum supply and social vulnerability to CI failures dealt with in terms of

  • definitions and relevant actors with their responsibilities;

  • thematic foci and context of application;

  • gaps within and between CI, minimum supply and social vulnerability?

These three categories will guide the structure of the next chapter.

3 Review results: the role of minimum supply and social vulnerability in critical infrastructure discourses

A number of general patterns and trends emerge from the analysis. The overall number of scientific publications dealing with CI in the context of disaster risk has been rapidly rising since the early 2000s (Fig. 1), indicating the growing significance of the topic. The increase can be ascribed to a mounting recognition of CI protection on national levels since the mid-1990s. During this time, the US President's Commission on Critical Infrastructure Protection (PCCIP) was created (Dahlberg et al., 2015). Over the next years several other countries followed with their own programs on infrastructure protection (Lindovsky, 2014). The review suggests that a major focus has been on CI protection in relation to terrorist attacks, natural hazards and industrial disasters (see also Rey, 2013).

3.1 Definitions and actors

Definitions of CI originate almost exclusively from policy and legal documents. Definitions and sectors of CIs vary between different countries, although most would comprise energy, water, food, transport, telecommunications, health, and banking and finance (Ridley, 2011). In the German context CI is defined as “organisational and physical structures and facilities of such vital importance to a nation's society and economy that their failure or degradation would result in sustained supply shortages, significant disruption of public safety and security, or other dramatic consequences” (BMI, 2009). A review of the academic papers suggests that defining CI is not a research topic in itself, as definitions in research documents are either taken from policy, e.g., national definitions, or adapted from these sources.

Responsibilities for CI and CI protection vary between different countries and even between federal states, as there are often differences, for instance, with regards to legal and administrative provisions. Hence actors and their roles also differ. In many countries the military or federal relief organizations play a major role in disaster relief. In the German case responsibilities for protecting CI are mainly with the Federal Ministry of the Interior and its subsidiary organizations, particularly the Federal Office for Civil Protection and Disaster Response and the Federal Office for Information Security, BSI (BSI, 2015b). The primary responsibilities for civil protection, however, are on the federal state levels (BMI, 2005a). Each federal state has its own disaster management law while there are national laws for different aspects of CI such as water (Bundesregierung, 1970) or food supply (Bundestag, 2017) and IT (BSI, 2015b; Kaschner and Jordan, 2015; Dietzsch et al., 2016). In case of a CI failure, e.g., triggered by natural hazard events such as floods, responsibilities are with governmental authorities at the affected level, depending on the scale of the event at either district, federal state or national (BBK, 2015a).

The responsibilities for CI management in disaster situations are addressed mainly in policy documents. Across most contexts and sectors, duties and responsibilities are shared between governmental authorities and private infrastructure providers, the latter of which usually take care of the supply under normal conditions. This is also the case in Germany, where estimates suggest that around 80 % of the CIs are managed by private operators or state-owned enterprises (BBK, 2010b), e.g., there are overall around 370 000 operators in the food production and wholesale sector (BSI, 2015a). While in crisis situations these food operators are still responsible for the continuous supply, government authorities assume responsibility for the distribution, including the protection of necessary CI (BMI, 2005b; BBK, 2012a, b; UP-KRITIS, 2014a,b, 2016).

In terms of minimum supply with CI services there is no universal definition, in either research or policy. If at all, minimum supply levels are given for selected infrastructures, such as drinking water. In principle, minimum supply questions are addressed predominantly by international humanitarian relief agencies (e.g., IFRC, 2011; IRP, 2010; UNISDR, 2017) or in (national) policies (e.g., Bundesregierung, 1970; Bundestag, 2017; EC, 2016b) and to a much lesser extent in scientific publications.

Interestingly, the discussion of responsibilities for securing minimum supply levels in times of major CI failure is almost entirely limited to policy documents. Actors seen as being responsible for securing minimum supply levels are mainly those who are also in charge of the regular supply with the respective CI. Policy documents from different national and international contexts mention the growing importance of involving private suppliers in CI protection strategies (e.g., Bundeskanzleramt Österreich, 2015; NATO, 2007; OECD, 2008). In addition, actors in the field of emergency response, e.g., civil defence authorities, fire brigades or actors from healthcare, are typically seen as having a shared responsibility to supply populations in need. Furthermore, most policy contexts hold the population partly responsible for their own basic supply, e.g., in the case of the German civil defence strategy (BMI, 2016).

Social vulnerability is hardly mentioned in policy documents dealing with CI failure. Further, it is typically not defined clearly. Most documents consider supply for “the population” as a whole in crisis situations instead of distinguishing between different societal groups with differentiated social vulnerabilities. If used, the notion of vulnerability is mostly applied to healthcare contexts or the analysis of previous outages and their impacts. Scientific literature, in contrast, is increasingly taking up the topic, mostly based on disaster case studies that analyze vulnerabilities of different societal groups. However, it does not yet do so in a very structured way, including the treatment of definitions.

3.2 Thematic foci and context of application

While CI in general is not a new topic, most of the research and policy on the topic was and is focussed on technical aspects of infrastructure system and questions of how to maintain and restore functionality despite hazards. The vast majority of scientific papers covered in the review are written from a rather technological point of view. They concentrate heavily on technological challenges with CI systems and their management. If challenges beyond such technological perspectives are considered, they mostly revolve around the management of CI, especially in terms of transboundary management as well as public–private constellations (see NATO, 2007; Smedts, 2010). End users – whether businesses or households – tend, if mentioned at all, to be treated as rather passive recipients of CI services and policies or as small-scale crisis responders in case of CI failure. Yet, they are typically not seen as key actors in the set-up and design of the rules that govern CI failure, let alone in minimum supply standards. Businesses are mostly mentioned in the context of economic damages in case of CI disruption, while individuals or households remain mostly generalized without referring to specific societal groups with distinct demands.

Policy documents have a strong and growing focus on resilience-based approaches for CI protection (CEPS, 2010; D-A-CH, 2013; Brasset and Vaughan-Williams, 2015; McGee et al., 2014). A growing number of countries either have adopted a resilience framing to CI over the past years, e.g., Australia (Australian Government, 2010; Giannopoulos et al., 2012), Canada and New Zealand (New Zealand Government, 2011; Critical 5, 2014), or show tendencies to integrate CI aspects into wider resilience debates, e.g., in the US (Dahlberg et al., 2015), the EU and various European countries (Brasset and Vaughan-Williams, 2015; UP KRITIS, 2014b). Here CI resilience is almost exclusively seen in a rather technological perspective with a focus on continuous provision or timely recovery of CI services even in times of hazards, crises and disasters (Collins et al., 2011; D-A-C-H, 2013; Ortenzy, 2013; Münzberg et al., 2015). Also the academic literature has a strong focus on achieving CI resilience from a technological perspective (Pye et al., 2011; Cimellaro, 2014; Liu et al., 2014; Pregnolato et al., 2016; Shafieezadeh and Burden, 2014).

Besides CI infrastructure, another focus in policy is on aspects of civil protection in case of an outage. In the German context a huge number of documents from governmental authorities are available to inform citizens about private precautionary measures, including the stockpiling of minimum supplies as preparatory measure for potential blackouts. The 2016 civil defence strategy recommends German citizens to equip themselves with food for 10 days and 2 L of potable water for a period of 5 days as well as to keep warm clothing and blankets in stock to cope with power outages (BMI, 2016). On the supply side the German water security law (Wassersicherstellungsgesetz) calculates a vital supply of 15 L of drinking water per day per capita for each citizen, but 75 L per day per bedside for hospitals and healthcare facilities and 150 L per day per bedside for surgery and infection facilities or respective departments for at least 14 days in case of crisis (Bundesregierung, 1970). Further, both documents (BMI, 2016; BBK, 2016c) recommend private stocking of necessary medical equipment and to prepare for short-term power outages. However, except for medicine there is no differentiation between societal groups. Other publications also recommend backup generators or other devices to cope with (longer) power outages (BBK, 2010a, 2015b). For some CIs there are no regulations to maintain minimum functions, e.g., for sewage where no backup generators are required in case of a power outage (BBK, 2010a).

All of this can be considered as related to minimum supply, although the term itself is not mentioned. Besides (national) policy, international humanitarian literature gives some guidance on minimum standards, although mostly limited to water, food and healthcare. Among others the SPHERE handbook (IFRC, 2011) provides guidance on minimum supply with water, food and other things in case of disaster. However, it does not mention CIs as such, indicating a potential missing link between the views of infrastructure and humanitarian communities on minimum CI supply standards. Scientific literature in this field seems still scarce.

Some publications in the scientific and policy literature address vulnerabilities in relation to CI failures. The case studies given in the body of literature can be divided into two main groups. While cyberattacks and ICT failures are mentioned in a number of papers, there are hardly any concrete cases assessed extensively. Concrete case studies of CI failure are rather limited to disasters induced by natural hazards, mostly flooding, storms and snow storms. Also, there is a regional focus on cases from developed countries, particularly in the US. Especially the impacts of hurricanes Katrina (see Oh et al., 2010a, 2013; Grigg, 2012; Grubesic and Matisziw, 2013; Urlainins et al., 2014; Pescaroli and Kelman, 2017; Cutter, 2016) and Sandy (see Kelman et al., 2014; Pescaroli and Alexander, 2016) have been assessed in a number of scientific publications. Economic impacts make for the predominant emphasis in such assessments (e.g., Oh et al., 2010b; Chopra and Khanna, 2015; Pant et al., 2016; Critical 5, 2015) as, for example, in the case of the Fukushima event in 2011 (UNISDR, 2017; Urlainis et al., 2014; Pescaroli and Kelman, 2017). Another emphasis is put on the need for improved preparedness in these countries (e.g., Kaneberg et al., 2016). Papers on disasters in developing countries (e.g., the earthquake in Haiti) focus on humanitarian impacts from CI failure (e.g., Oh et al., 2013; Urlainis et al., 2014; Pescaroli and Kelman, 2017).

Most of the policy documents in the German context stress the vulnerability of the population at large to CI failures and stress private prevention measures (e.g., BBK, 2015a, b, 2016b). The review suggests that the only context in which differential vulnerability within the society is discussed explicitly is the health sector. In a crisis situation with limited availability of medical services, the classification and prioritization of groups of patients, based on survival rates and available resources, seems to be widely accepted across different contexts (Rosenbrock and Gerlinger, 2004; Christian et al., 2014; BSI, 2016). Differences between rural and urban communities are mentioned in case of emergency water supply, where scarcely populated rural areas pose bigger challenges for authorities to provide the statutorily determined minimum supply (BBK, 2013, 2016a).

Research literature highlights three groups and their vulnerability to long-term CI disruptions: the elderly (Urlainis et al., 2014), people in need of healthcare and low-income households (e.g., Banks et al., 2016; Cutter, 2016; Kelman et al., 2014; Pescaroli and Alexander, 2016). In addition, the place of residence matters; e.g., in a case study in Virginia, USA, Liu et al. (2015) found urban settlers more vulnerable to impacts from flood and storm surge but rural dwellers more vulnerable to CI disruptions that occurred due to the disaster events (see Liu et al., 2015). Vulnerable groups also often live in places with above-average vulnerability at large (see Liévanos and Horne, 2017). Other studies linked poverty to a lack of disaster preparedness, e.g., if healthcare is in any way weak (see study of Banks et al., 2016, in central Appalachia, USA) or if food security is not given (e.g., Cutter, 2016, in the case of Hurricane Matthew's impacts on North and South Carolina, USA).

However, the vast majority of the reviewed documents focuses on vulnerabilities of the CIs themselves rather than the social vulnerabilities to CI failure. If social vulnerability is addressed at all, it is mostly only mentioned briefly and vaguely. A significant gap therefore exists, which applies to both fields of research and application. Only a few papers are available which focus on social vulnerability and specifically to minimum supply failure. Even fewer papers exist with an analysis or debate on minimum supply requirements and concepts for CI failure.

3.3 Gaps within and between CI, minimum supply and social vulnerability

Challenges and gaps detected are hardly related to CI “hardware” but focus on lacking or insufficient policies, improving individual and state preparedness to CI disruptions and the shortcomings of a limited technological perspective on CI. Policy challenges, such as the difficulties in coordinating CI among EU countries and unclear responsibilities, are addressed in both policy documents (CEPS, 2010; EC, 2006, 2008, 2012, 2013a, 2016a) and research papers (Van Aaken and Wildhaber, 2015; Kaneberg et al., 2016; Rehak et al., 2016; Kitagawa et al., 2016), potentially resulting in murky responsibilities with unclear risk burdens and liability in crisis situations, as Van Aaken and Wildhaber (2015) describe it for the German context.

Sage et al. (2015) call for a socioecological understanding of infrastructure instead of focusing only on structural and technological stability. This is in line with Comes (2016) who claims that although communities are recognized as being at the heart of resilience, the consideration of individuals and communities as actors with agency is still surprisingly weak in the research. Empirical studies on CI resilience are still rare and “still focus on activities within the boundaries of the CI” (Labaka et al., 2014, p. 431) and much less on the “well-being of all citizens through the availability of essential goods and services” (Ridley, 2011, p. 111), underlining the demand for more studies on community or societal group level (Stewart et al., 2009).

Another gap detected in scientific and policy literature is related to the question how the demands for minimum supply differ between societal groups. Also scientific papers provided only few statements on minimum supply of local communities or distinctly vulnerable societal groups. In a study on healthcare infrastructure in Ghana, Kenya, Rwanda, Tanzania and Uganda, Hsia et al. (2012) found that less than 65 % of all hospitals have basic infrastructure components such as reliable sources of water and electricity. This is far the below the global level of coverage recommended by the World Health Organization (WHO). Miles et al. (2011) report that in case of a blackout in San Diego, USA, patients are transported to those healthcare facilities that have backup generators. Münzberg et al. (2015) discuss the importance of knowing the critical point in time at which all backup capacity is depleted.

Only a few research papers address the relationship between CI, (social) vulnerability and supply problems in past CI failures. However, there was not a single paper for which this relationship provided the major or explicit emphasis. Rather, the few documents addressing the relationship did so in a side note, e.g., mentioning risks for dialysis patients in need of healthcare facilities with energy backup systems during 2011 Hurricane Sandy (Kelman et al., 2014; Pescaroli and Alexander, 2016) and a power outage in San Diego in the same year (Miles et al., 2014). The San Diego event was particularly problematic for low-income households that could not afford backup power and faced problems with the unexpected need to facilitate the replacement of food stamp benefits (Miles et al., 2014). Reports on other events describe a general societal vulnerability to CI failures, e.g., in the case of the 1998 ice storm in Canada (CEPS, 2010; Chang et al., 2007), or the severe snow storms in 2005 in Münsterland, Germany, where affected people were not able to purchase food in local stores due to power outages (BMI, 2015; BSI, 2015a; Menski and Gardemann, 2008). Hunter et al. (2016) studied 45 local health departments in 20 US states and found certain groups to be more vulnerable to power outages, in particular the elderly, people living in high-rise buildings and persons dependent on medical devices like home ventilators.

Some papers acknowledge conceptually that social vulnerabilities interact with CI failures and are likely to amplify disaster impacts. As a consequence, CI failures with relatively minor impacts in one locality may have major ones in another place (McGee et al., 2014). These differences and the potential of individual or community preparedness for CI failures are, however, addressed by very few papers only. Grigg (2012) and Moore et al. (2007) claim a culture of citizen and community preparedness in the context of Hurricane Katrina, including preparedness to CI disruptions. During a 2013 snowstorm in Jordan, Sawalha (2014) witnessed a lack of community cooperation which could have supported the restoration of basic community services.

Figure 2Summary of concepts, actors and gaps in dealing with critical infrastructure, minimum supply and social vulnerabilities.


Some papers suggest that the individuals' preparedness to CI failures is eventually decisive for societal resilience at large (Petit et al., 2011). CI (minimum) supply in case of a disaster in the end is a question of ethical choices – who does receive how much and based on which reasons? Addressing these questions requires and understanding of CI systems that goes beyond the purely technical dimensions (Pye et al., 2011; Sage et al., 2015). However, aspects of fairness of CI supply and related ethical debates are addressed only in very limited terms, in a few documents of the humanitarian sector (IFRC, 2011; Moodley et al., 2013) but much less in CI policy (EC, 2016b). In research, this aspect seems to be a blind spot, calling for increased attention. In the German context, for instance, growing demand for increased hospitalization and need for home care calls for studies on the question of how long their emergency supply could be sustained (BBK, 2012b).

Apart from very few exceptions (policy documents such as D-A-CH, 2013; BMI, 2016; research papers such as Pye et al., 2011; Oh et al., 2013; Miles, 2015; Pescaroli and Alexander, 2016), there is a distinct lack of documents that discuss CI resilience, minimum supply and social vulnerability in an integrated manner – or even name the three elements in the same document. These exceptions share a non-technocratic perspective which addresses societal demands (see Lauta, 2015; Lievanos and Horne, 2017).

The detected gaps within and between CI, minimum supply and social vulnerability are summarized in Fig. 2. Particularly social vulnerabilities to CI failures are hardly dealt with in CI research and policy. Thus, a significant gap in research of the vulnerabilities of different social groups to CI outages as well as related policies was detected. In addition, potential mutual intensification or reduction of minimum supply and social vulnerabilities is greatly neglected.

To provide a reference guide to the reader, Table 1 lists the most important policy and research papers in the three fields of CI resilience, minimum supply and social vulnerability to CI failure.

Table 1List of key references per subcategory (few papers deal with more than one category; these papers are highlighted in bold).

Download Print Version | Download XLSX

Figure 3Heuristic model for capturing the relationship between critical infrastructure failure, minimum supply and social vulnerability.


4 Framing the relationships between critical infrastructure, social vulnerability and minimum supply

Building on the results of the review, Fig. 3 provides a heuristic model for capturing the relationship between CI failure, minimum supply and social vulnerability. We argue that the impacts from CI failure are modulated – i.e., amplified and/or mediated – by social vulnerability as well as minimum supply. The latter two are in turn coupled in a functional and normative relationship. In line with the use in risk and disaster research, vulnerability is understood here as the predisposition of social actors to suffer harm when exposed to a hazard (Wisner et al., 2004). The immediate hazard can in this context be the failure of CI supply such as water or electricity which, in turn, can be triggered by other hazards, for instance floods, tsunamis, storms or other non-environmental hazards such as terrorist attacks. The analysis of social vulnerability towards CI failure has the potential to inform the planning and design of minimum supply schemes – and it should be used to do so in our eyes. In return, a secured minimum supply can defuse social vulnerability and therefore buffer otherwise higher impacts. Given the modulating effects of minimum supply and social vulnerability, the resulting impacts from CI failure can therefore be higher or lower. In any case, the impacts can be expected to be differentiated socially, spatially and functionally.

5 Discussion: a future agenda for science and practice

In combining the gaps identified in the review (Sect. 3) and the conceptual framing (Sect. 4) we argue that a number of needs can be identified that can drive future science, practice and policy agendas.

The literature review revealed that considerable knowledge gaps remain with regards to the ways in which different parts of the society are vulnerable to the failure of CI services, most importantly water and electricity. While vulnerability assessment in the context of environmental hazards has made great methodological advancements over the past two decades (Birkmann, 2013), these studies have almost exclusively referred to the direct and immediate influences of environmental hazards, e.g., how vulnerable households are if affected immediately by flooding. In addition to this focus, vulnerability assessment concepts and methods also need to be applied – and adjusted – to assess the secondary effects of natural hazard impacts emerging from CI failure. This is not an easy task given that in many contexts social actors cannot draw on experiences with respective reference scenarios. Estimating one's own vulnerability, i.e., predisposition for suffering harm, in case of, for example, an extended blackout or water shortage might therefore prove difficult. CI disruptions in the course of natural-hazard-induced disasters and the (private) preparedness for outages have not been at the core of vulnerability research so far, although they are important and are life-saving issues. Not having any experiences with previous outages can exacerbate the vulnerability due to lack of preparedness, as, for example, one could see in Germany, where private preparedness and stockpiling advice in the 2016 civil defense strategy was not taken seriously because of, inter alia, the very high reliability of CI.

An additional challenge deserving attention is the potentially fine-gridded differentiation across social groups, space- and time (following up on authors like Handmer, 2003, and Barnet et al., 2008, who stressed the need for scale- and context-specific approaches for vulnerability reduction). While such differentiation is a common property of vulnerability in many contexts, it is particularly challenging in the context of minimum supply. This is because the infrastructure behind most services, e.g., electricity and water, is designed for larger system entities. For instance, the social vulnerability towards suffering impacts from a sustained blackout might differ within a single multi-apartment block, e.g., comparing an elderly and immobile person with a cardiovascular disease and dependence on electrical medical equipment to a group of young students sharing the apartment next door. Yet at the same time, the electricity grid cannot deliberately supply at such a high resolution as it functions in much larger entities, e.g., switching on or off entire neighborhoods of a city. Questions of timing complicate the situation even further, as secondary concerns such as power for food production facilities can become primary concerns over time in the case of a prolonged CI failure.

Apart from these rather technical scientific problems, very important questions emerge at the science–policy interface. These questions address normative and procedural issues of distributional justice and responsibility. The review of practical management contingencies and legal as well as policy documents (Sect. 3) suggests that practice and policy has been cautious in defining minimum supply levels for few CI sectors – however, they hardly differ for different social groups, regions, secondary infrastructure, etc. While it seems to be easier to provide numbers for certain sectors, e.g., for water supply (see above), for other sectors supply levels stay rather vague or are limited to general statements that the infrastructure provision should be restored as soon as possible after a disruption. Along the same line, practice and policy have also struggled to define the ways in which minimum supply is to be prioritized in situations of limited capabilities and resources, i.e., in crises and disaster situations. Lastly, the question of who is – and should – be responsible for the provision of minimum supply remains strikingly open in many respects and contexts. Most likely a higher resilience would demand efforts at both ends: the side of the supplier and the side of the end user. However, how the burden is – and should be – shared is of surprisingly little societal, political and academic debate.

While science can and should play a key role in tackling these questions, we argue that none of these questions can and should be resolved in a technocratic manner. Scientific knowledge of, for instance, sociospatial patterns of vulnerability does not automatically lead to “objective” prescriptions or even recommendations for necessary action, prioritization and responsibility. These aspects rather need to be tackled and resolved in a wider societal debate that addresses the social contract for risk reduction and shifts the decision-making into the political realm of wider risk governance. In that sense, the agenda ahead is one of transdisciplinary co-production and societal debate rather than of risk science and CI management alone.

6 Conclusions

The analysis presented in this paper has shown that scientists, risk practitioners and policy makers are increasingly concerned about the links between CI and disasters. Scientific literature, policy documents, legal frameworks and guidance documents for risk reduction practices therefore engage evermore with the topic of CI resilience and its management in crises and disaster situations. However, the links drawn to minimum supply contingencies or the assessment of socially differentiated vulnerability towards CI failure remain strikingly weak, if not absent in many contexts. The existing gap between these perspectives is a grave shortcoming as it inhibits a comprehensive understanding of the risks related to CI failure and successful disaster risk reduction policies and practices. The paper therefore put forward a heuristic model that helps to decipher the linkages between CI resilience, minimum supply and social vulnerability in an inclusive manner, thereby providing guidance for future research agendas and policy as well as practice. However, the analysis also strongly shows that the main challenges might not lie within the technological or managerial questions to be solved, but in the normative, ethical and political questions around the responsibility for and prioritization of minimum supply at the fuzzy interface of state organs, private-sector CI utilities, civil society and affected individuals themselves; the latter of which are more often than not amongst the weakest, most vulnerable and resource-poor parts of society. Moving the discourse on the responsibility for minimum supply and preventive risk reduction to a stage of more explicit political and societal debate is therefore urgently needed, particularly in view of the increasing levels of disaster risk to be expected in the future.

Data availability

No data sets were used in this article.

Competing interests

The authors declare that they have no conflict of interest.


This work was supported by the German Federal Ministry of Research and Education BMBF as part of the research project KIRMIN (Critical Infrastructures Resilience as a Minimum Supply Concept), subproject “Resilience concepts, international and inter-organisational cooperation patterns and resilience analysis from an end user perspective” (grant number 13N13990). Edited by: Sven Fuchs
Reviewed by: two anonymous referees


Australian Government: Critical Infrastructure Resilience Strategy, Commonwealth of Australia, Barton, (last access: 19 April 2018), 2010. 

Banks, L. H., Davenport, L. A., Hayes, M. H., McArthur, M. A., and Toro, S. N., King, C. E., and Vazirani, H. M.: Disaster impact on impoverished area of US: an inter-professional mixed method study, Prehospit. Disast. Med., 31, 583–592, 2016. 

Barnett, J., Lambert, S., and Fry, I.: The hazards of indicators: insights from the environmental vulnerability index, Ann. Assoc. Am. Geogr., 98, 102–119, 2008. 

BBC: Germans told to stockpile food and water for civil defence, available at: (last access: 9 February 2018), 2016. 

BBK: Schutz Kritischer Infrastruktur: Risikomanagement im Krankenhaus Leitfaden zur Identifikation und Reduzierung von Ausfallrisiken in Kritischen Infrastrukturen des Gesundheitswesens, BBK, Bonn, 2008. 

BBK: Krisenmanagement Stromausfall – Kurzfassung: Krisenmanagement bei einer großflächigen Unterbrechung der Stromversorgung am Beispiel Baden-Württemberg, BKK, Bonn, 2010a. 

BBK: Schutz kritischer Infrastrukturen, BBK, Bonn, 2010b. 

BBK: Schutz Kritischer Infrastrukturen: Studie zur Versorgungssicherheit mit Lebensmitteln, BBK, Bonn, 2011. 

BBK: Schutzkonzepte Kritischer Infrastrukturen im Bevölkerungsschutz: Ziele, Zielgruppen, Bestandteile und Umsetzung im BBK, Wissenschaftsforum, Band 11, BBK, Bonn, 2012a. 

BBK: Schutz Kritischer Infrastrukturen, Studie zur Versorgungssicherheit mit Lebensmitteln, BBK, Bonn, 2012b. 

BBK: Trinkwassernotbrunnen – Wasserversorgung in Extremsituationen, BBK, Bonn, 2013. 

BBK: Die unterschätzten Risiken “Starkregen” und “Sturzfluten”. Ein Handbuch für Bürger und Kommunen, BBK, Bonn, 2015a. 

BBK: Stromausfall – Vorsorge und Selbsthilfe, BBK, Bonn, 2015b. 

BBK: Trinkwassernotbrunnen. Wasserversorgung in Extremsituationen, BBK, Bonn, 2015c. 

BBK: Tagungsband Lükex 2015. 2. Thementag: Ausfall von Kritischen Infrastrukturen, BBK, Bonn, 2015d. 

BBK: Sicherheit der Trinkwasserversorgung – Teil 1: Risikoanalyse, BBK, Bonn, 2016a. 

BBK: Trinkwassernotversorgung, BBK, Bonn, 2016b. 

BBK: Ratgeber für Notfallvorsorge und richtiges Handeln in Notsituationen, BBK, Bonn, 2016c. 

BBK: Kapazitäten der Bevölkerung bei einem Stromausfall. Empirische Untersuchung für das Bezugsgebiet Deutschland, BKK, Bonn, 2016d. 

BBK: Trinkwassernotversorgung, BKK, Bonn, 2016e. 

Betts, J. and Sezer, S.: Ethics and privacy in national security and critical infrastructure protection, in: IEEE International Symposium on Ethics in Engineering, Science, and Technology (ETHICS), 23–24 May 2014, Chicago, 1–7,, 2014. 

Birkmann, J.: Measuring Vulnerability to Natural Hazards: Towards Disaster Resilient Societies, 2nd Edn., UNU Press, Tokyo, 2013. 

Blaikie, P., Cannon, T., Davis, I., and Wisner, B.: At Risk: Natural Hazards, People's Vulnerability and Disasters, Routledge, London, 1994. 

BMI: Nationaler Plan zum Schutz der Informationsinfrastrukturen (NPSI), BMI, Berlin, 2005a. 

BMI: Schutz kritischer Infrastrukturen – Basisschutzkonzept. Empfehlungen für Unternehmen, BMI, Berlin, 2005b. 

BMI: Nationale Strategie zum Schutz Kritischer Infrastrukturen (KRITIS-Strategie), BMI, Berlin, 2009. 

BMI: Schutz Kritischer Infrastrukturen – Risiko- und Krisenmanagement. Leitfaden für Unternehmen und Behörden, BMI, Berlin, 2011. 

BMI: Verordnung zur Bestimmung Kritischer Infrastrukturen nach dem BSIGesetz (BSI-Kritisverordnung – BSI-KritisV), BMI, Berlin, 2015. 

BMI: Konzeption Zivile Verteidigung (KZV), BMI, Berlin, 2016. 

BMJ: Erste Wassersicherstellungsverordnung (1. WasSV), BMJ, Bonn, 1970. 

BMJ: Gesetz zur Sicherung der Energieversorgung (Energiesicherungsgesetz 1975), BMJ, Bonn, 1975. 

BMJ: Gesetz über die Sicherstellung der Grundversorgung mit Lebensmitteln in einer Versorgungskrise und Maßnahmen zur Vorsorge für eine Versorgungskrise (Ernährungssicherstellungs- und -vorsorgegesetz – ESVG), BMJ, Berlin, 2017. 

Brassett, J. and Vaughan-Williams, N.: Security and the performative politics of resilience: critical infrastructure protection and humanitarian emergency preparedness, Secur. Dialogue, 46, 32–50, 2015. 

BSI: Critical Infrastructure Protection: Survey of World-Wide Activities, BSI, Bonn, 2004. 

BSI: KRITIS-Sektorstudie Ernährung und Wasser, BSI, Bonn, 2015a. 

BSI: KRITIS-Sektorstudie Informationstechnik und Telekommunikation (IKT), BSI, Bonn, 2015b. 

BSI: KRITIS-Sektorstudie Energie, BSI, Bonn, 2015c. 

BSI: KRITIS-Sektorstudie Logistik, BSI, Bonn, 2015d. 

BSI: KRITIS-Sektorstudie Transport und Verkehr, BSI, Bonn, 2015e. 

BSI: KRITIS-Sektorstudie Gesundheit, BSI, Bonn, 2016. 

Bundeskanzleramt Österreich: Österreichisches Programm zum Schutz kritischer Infrastrukturen (APCIP), Masterplan 2014, Bundesministerium für Inneres, Wien, 2015. 

Bundesregierung: Erste Wassersicherstellungsverordnung vom 31. März 1970 (Bundesgesetzblatt I S. 357), Bonn, 1970. 

Bundestag: Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme (IT-Sicherheitsgesetz), Bundesgesetzblatt Jahrgang 2015 Teil I Nr. 31, Bonn, 2015. 

Bundestag: Gesetz über die Sicherstellung der Grundversorgung mit Lebensmitteln in einer Versorgungskrise und Maßnahmen zur Vorsorge für eine Versorgungskrise (Ernährungssicherstellungs und -vorsorgegesetz – ESVG) Ernährungssicherstellungs- und -vorsorgegesetz vom 4. April 2017 (BGBl. I S. 772), Bonn, 2017. 

CEPS: Protecting Critical Infrastructure in the EU, CEPS Task Force Report, CEPS, Brussels, 2010. 

Chang, S. E., McDaniels, T. L., Mikawoz, J., and Peterson, K.: Infrastructure failure interdependencies in extreme events: power outage consequences in the 1998 ice storm, Nat. Hazards, 41, 337–358, 2007. 

Chopra, S. S. and Khanna, V.: Interconnectedness and interdependencies of critical infrastructures in the US economy: implications for resilience, Physica A, 436, 865–877, 2015. 

Chopra, S. S., Dillon, T., Bilec, M. M., and Khanna, V.: A network-based framework for assessing infrastructure resilience: a case study of the London metro system, J. R. Soc. Interface, 13, 20160113,, 2016. 

Christian, M. D., Sprung, C. L., King, M. A., Dichter, J. R., Kisson, N., Devereaux, A. V., and Gomersall, C. D.: Triage: Care of the critically ill and injured during pandemics and disasters: CHEST consensus statement, Chest, 146, e61–74,, 2014. 

Cimellaro, G. P.,. Solari, D., and Bruneau, M.: Physical infrastructure interdependency and regional resilience index after the 2011 Tohoku Earthquake in Japan, Earthq. Eng. Struct. D., 43, 1763–1784,, 2014. 

Collins, M., Carlson, J., and Petit, F.: Community resilience: measuring a community's ability to withstand, WIT Trans. Built Env., 2, 111–123,, 2011. 

Comes, T.: Designing for networked community resilience, Procedia Eng., 159, 6–11,, 2016. 

Commission of the European Communities: Communication from the Commission on a European Programme for Infrastructure Protection, COM(2006) 786 final, EC, Brussels, 2006. 

Cretikos, M. A., Merritt, T. D., Main, K., Eastwood, K., Winn, L., Moran, L., and Durrheim, D. N.: Mitigating the health impacts of a natural disaster – the June 2007 long-weekend storm in the Hunter region of New South Wales, Med. J. Australia, 187, 670–673, 2007. 

Critical 5: Forging a Common Understanding for Critical Infrastructure, Shared Narrative, March 2014, available at: (last access: 24 July 2017), 2014. 

Critical 5: Role of Critical Infrastructure in National Prosperity, Shared Narrative, October 2015, available at: (last access: 24 July 2017), 2015. 

Cutter, S.: The perilous nature of food supplies: natural hazards , social vulnerability, and disaster resilience, Environ.: Sci. Policy Sustain. Dev., 59, 4–15, 2016. 

D-A-C-H: CSS Tagungsbericht Dritter D-A-C-H Workshop – Schutz Kritischer Infrastrukturen, Center for Security Studies (CSS), Zürich, 2013. 

Dahlberg, R., Johannessen-Henry, C. T., Raju, E., and Tulsiani, S.: Resilience in disaster research: three versions, Civ. Eng. Environ. Syst., 32, 44–54, 2015. 

Dietzsch, F., Feldhaus, J., Fricke, D., and Wagner, J. W.: Neue Gesetze und Regelungen für kritische Infrastrukturen, DVGW energie|wasser-praxis, 4/2016, 44–53, 2016. 

EC: Council Regulation (EC) No 1257/96 of 20 June 1996 Concerning Humanitarian Aid, Official Journal of the European Union, European Union, Brussels, L 163, 02/07/1996, 1996. 

EC: Grünbuch über ein europäisches Programm für den Schutz kritischer Infrastrukturen, Kommission der Europäischen Gemeinschaften, Brüssel, KOM(2005) 576, 2005. 

EC: Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection, Official Journal of the European Union, Official Journal of the European Union, European Union, Brussels, 345, 2008. 

EC: Council conclusions on the development of the external dimension of the European Programme for Critical Infrastructure Protection, 3096th JUSTICE and HOME AFFAIRS Council meeting, 9 and 10 June 2011, Luxembourg, 2011. 

EC: Commission staff working document on the review of the European Programme for Critical Infrastructure Protection (EPCIP), SWD (2012) 190 final, EC, Brussels, 2012. 

EC: Commission staff working document on a new approach to the European Programme for Critical Infrastructure Protection Making European Critical Infrastructure more secure, SWD (2013) 318 final, EC, Brussels, 2013a. 

EC: Decision No 1313/2013/EU of the European Parliament and of the Council of 17 December 2013 on a Union Civil Protection Mechanism, Official Journal of the European Union, European Union, Brussels, 2013b. 

EC: Commission implementing Decision of 16 October 2014 laying down rules for the implementation of Decision No 1313/2013/EU of the European Parliament and of the Council on a Union Civil Protection Mechanism and repealing Commission Decisions 2004/277/EC, Euratom and 2007/606/EC, Euratom (notified under document C(2014) 7489), Official Journal of the European Union, European Union, Brussels, 2014. 

EC: The European Reference Network for Critical Infrastructure Protection, Project first phase (2011–2014): from concept to implementation, Publications Office of the European Union, Luxembourg, 2016a. 

EC: Council Regulation (EU) 2016/369 of 15 March 2016 on the provision of emergency support within the Union, EC, Brussels, 2016b. 

Eidgenössisches Departement für Verteidigung, Bevölkerungsschutz und Sport VBS, Bundesamt für Bevölkerungsschutz BABS: Leitfaden Schutz kritischer Infrastrukturen, Bundesamt für Bevölkerungsschutz, Bern, 2015. 

Eidgenössisches Departement für Verteidigung, Bevölkerungsschutz und Sport VBS, Bundesamt für Bevölkerungsschutz BABS: Umsetzung Strategie Bevölkerungsschutz und Zivilschutz 2015+, Eidgenössisches Departement für Verteidigung, Bevölkerungsschutz und Sport VBS, Bundesamt für Bevölkerungsschutz BABS, Bern, 2016. 

Financial Times: Germans ridicule food stockpiling idea in new civil defence plan, available at: (last access: 9 February 2018), 2016. 

Fu, G., Dawson, R., Khoury, M., and Bullock, S.: Interdependent networks: vulnerability analysis and strategies to limit cascading failure, Eur. Phys. J. B, 87, 148,, 2014. 

Ganin, A. A., Massaro, E., Gutfraind, A., Stehen, N., Keisler, J. M., Kott, A., Mangoubi, R., and Linkov, I.: Operational resilience: concepts, design and analysis, Sci. Rep.-UK, 6, 19540,, 2015. 

Giannopoulos, G., Filippini, R., and Schimmer, M.: Risk Assessment Methodologies for Critical Infrastructure Protection, Part I: A State of the Art, EUR 25286 EN, Publications Office of the European Union, Luxembourg, 2012. 

Grigg, N. S.: Large-scale disasters: leadership and management lessons, Leadership Manage. Eng., 12, 97–100, 2012. 

Grubesic, T. H. and Matisziw, T. C.: A typological framework for categorizing infrastructure vulnerability, GeoJournal, 78, 287–301, 2013. 

Handmer, J.: We are all vulnerable, Austr. J. Emerg. Manage., 18, 55–60, 2003. 

Havlin, S., Kenett, D. Y., Bashan, A., Gao, J., and Stanley, H. E.: Vulnerability of network of networks, Eur. Phys. J. Spec. Top., 223, 2087–2106, 2014. 

Herzog, M. and Roth, F.: Dritter Trilateraler Workshop D-A-CH – Schutz Kritischer Infrastrukturen, CSS Tagungsbericht, January 2014, Center for Security Studies (CSS), ETH Zürich, 2014. 

Hsia, R. Y., Mbembati, N. A, MacFarlane, S., and Kruk, M. E.: Access to emergency and surgical care in sub-Saharan Africa: the infrastructure gap, Health Policy Plan., 27, 234–244, 2012. 

Hu, X., Yeung, C. H., Yang, S., Wang, W., and Zeng, A.: Recovery of infrastructure networks after localised attacks, Sci. Rep.-UK, 6, 24522,, 2016. 

Hunter, M. D., Hunter, J. C., Yang, J. E., Crawley, A. W., and Aragón, T. J.: Public health system response to extreme weather events, J. Public Health Man., 22, E1–E10, 2016. 

IFRC: Humanitarian Charter and Minimum Standards in Humanitarian Response, Sphere Project, Geneva, 2011. 

IRP: Guidance Note on Recovery – Infrastructure, International Recovery Platform Secretariat, Kobe, 2010. 

Janev, M. H. and Jovanovski, V.: The concept of resilience and protection of critical infrastructure against natural and man-made disasters in Republic of Macedonia, Collegium Antropol., 38, 143–153, 2014. 

Johansson, J., Hassel, H., and Svegrup, L.: The Effect of Including Societal Consequences for Decisions on Critical Infrastructure Vulnerability Reductions, Probabilistic Safety Assessment and Management (PSAM), PSAM12, 22–27 June 2014. 

Kaneberg, E., Hertz, S., and Jensen, L.-M.: Emergency preparedness planning in developed countries: the Swedish case, J. Human. Log. Supply Chain Manage., 6, 145–172, 2016. 

Kaschner, H. and Jordan, T.: Resilience and legislation: will IT security legislation boost critical infrastructure resilience in Germany?, J. Business Contin. Emergency Plan., 9, 164–176, 2015. 

Kelman, J., Finne, K., Bogdanov, A., Worral, C., Margolis, G., Rising, K., MaCurdy, T. E., and Lurie, N.: Dialysis care and death following Hurricane Sandy, Am. J. Kidney Dis., 65, 109–115,, 2014. 

Kitagawa, K., Preston, J., and Chadderton, C.: Preparing for disaster: a comparative analysis of education for critical infrastructure collapse, J. Risk Res., 20, 1450–1465,, 2016. 

Kleb, U., Kath, N., Schinagl, C., and Angermann, A.: Risiko- und Krisenmanagement für die Ernährungsvorsorge in Österreich (EV-A), Johanneum Research, Graz, 2015. 

Labaka, L., Hernantes, J., Comes, T., and Sarriegi, J. M.: Defining policies to improve critical infrastructure resilience, in: ISCRAM 2014 Conference – Proceedings of the 11th International ISCRAM Conference, University Park, Pennsylvania, USA, May 2014. 

Lauta, K.: Regulating a moving nerve: on legally defining critical infrastructure, Eur. J.Risk Regul., 6, 176–184, 2015. 

Liévanos, R. S. and Horne, C.: Unequal resilience: the duration of electricity outages, Energ. Policy, 108, 201–211, 2017. 

Lindovsky, M.: Analysis of crisis management water supply system, Inzynieria Mineralna, 15, 89–94, 2014. 

Liu, C., Li, D., Zio, E., and Kang, R.: A modeling framework for system restoration from cascading failures, PLoS ONE, 9, e112363,, 2014. 

Liu, H., Behr, J. G., and Diaz, R.: Population vulnerability to storm surge flooding in coastal Virginia, USA, Integr. Environ. Assess., 12, 500–509, 2015. 

López-Silva, J., Bañuls, V. A., and Turoff, M.: Scenario Based Risks Analysis in Critical Infrastructures Scenario Based Approach for Risks Analysis in Critical Infrastructures, Short Paper – Analytical Modeling and Simulation Proceedings of the ISCRAM 2015 Conference, 9, 24–27 May 2015, Kristiansand, 2015. 

Luiijf, E. A. M. and Klaver, M. H. A.: Critical Infrastructure Awareness Required by Civil Emergency Planning, in: Proceedings of the 2005 First IEEE International Workshop on Critical Infrastructure Protection (IWCIP'05), 3–4 November 2005, Darmstadt, Germany,, 2005. 

McGee, S., Frittman, J. Ahn, S. J., and Murray, S.: Risk Relationships and Cascading Effects in Critical Infrastructures: Implications for the Hyogo Framework, Input Paper Prepared for the Global Assessment Report on Disaster Risk Reduction 2015, UNISDR, available at: et al., 2014.pdf (last access: 17 April 2018), 2014. 

Menski, U. and Gardemann, J.: Auswirkungen des Ausfalls Kritischer Infrastrukturen auf den Ernährungssektor am Beispiel des Stromausfalls im Münsterland im Herbst 2005: Empirische Untersuchung im Auftrag der Bundesanstalt für Landwirtschaft und Ernährung (BLE), 2008, available at: (last access: 9 February 2018), 2008. 

Miao, C. and Ding, M.: Social vulnerability assessment of geological hazards based on entropy method in Lushan earthquake-stricken area, Arab. J. Geosci., 8, 10241–10253, 2015. 

Miles, S. B.: Foundations of community disaster resilience: well-being, identity, services, and capitals, Environ. Hazards, 14, 103–121,, 2015. 

Miles, S. B., Gallagher, H., and Huxford, C. J.: Restoration and impacts from the September 8, 2011, San Diego power outage, J. Infrastruct. Syst., 20, 05014002,, 2014. 

Milliken, J. and Linton, D.: Prioritisation of citizen-centric information for disaster response, Disasters, 40, 476–493, 2016. 

Moodley, K., Hardie, K., Selgelid, M. J., Waldman, R. J., Strebel, P., Rees, H., and Durrheim, D. N.: Ethical considerations for vaccination programmes in acute humanitarian emergencies, B. World Health Organ., 91, 290–297, 2013. 

Moore, D. A. and Kellogg, D. A.: Infrastructure impacts and facility siting issues during hurricanes, Process Saf. Prog., 26, 108–113, 2007. 

Münzberg, T., Wiens, M., and Schultmann, F.: The effect of coping capacity depletion on critical infrastructure resilience, in: Proceedings of the ISCRAM 2015 Conference, 24–27 May 2015, Kristiansand, 2015. 

Murray, A. T. and Grubesic, T. H.: Critical infrastructure protection: the vulnerability conundrum, Telemat. Inform., 29, 56–65,, 2012. 

NATO: The Protection of Critical Infrastructures, 162 CDS 07 E REV 1, NATO Parliamentary Assembly Special Rapport by Lord Jopling, available at: (last access: 17 April 2018), 2007. 

New Zealand Government: National Infrastructure Plan 2011, available at:, last access: 12 January 2017. 

OECD: Protection of “Critical Infrastructure” and the Role of Investment Policies Relating to National Security, OECD, Paris, 2008. 

Oh, E. H., Deshmukh, A., and Hastak, M.: Disaster impact analysis based on inter-relationship of critical infrastructure and associated industries: a winter flood disaster event, Int. J. Disast. Resil. Built Environ., 1, 25–49, 2010a. 

Oh, E. H., Deshmukh, A., and Hastak, M.: Vulnerability Assessment of Critical Infrastructure, Associated Industries, and Communities during Extreme Events, edited by: Oh, E. H., Deshmukh, A., and Hastak, M., Construction Research Congress 2010: Innovation for Reshaping Construction Practice,, 2010b. 

Oh, E. H., Deshmukh, A., and Hastak, M.: Criticality assessment of lifeline infrastructure for enhancing disaster response, Nat. Hazards Rev., 14, 98–107, 2013. 

Ortenzi, M., Petrini, F., and Bontempi, F.: RISE: a method for the design of resilient infrastructures and structures against emergencies. Safety, reliability, risk and life-cycle performance of structures and infrastructures, in: Proceedings of the 11th International Conference on Structural Safety and Reliability, ICOSSAR 2013, 16–20 June 2013, New York, USA, 2013. 

Palliyaguru, R., Amaratunga, D., and Haigh, R.: Developing an approach to assess the influence of integrating disaster risk reduction practices into infrastructure reconstruction on socio economic development, Disaster Prev. Manag., 22, 160–171, 2013. 

Pant, R., Hall, J. W., and Blainey, S. P.: Vulnerability assessment framework for interdependent critical infrastructures: case-study for Great Britain's rail network, Eur. J. Transp. Infrast., 16, 174–194, 2016. 

Petit, F., Fisher, R., Yaeger, J., and, Collins, M.: Capturing community influence on public preparedness, in: Transactions on the Built Environment – Reducing Risk, Improving Outcomes, WIT, Southampton, 183–194, 2011. 

Pescaroli, G. and Alexander, D.: Critical infrastructure, panarchies and the vulnerability paths of cascading disasters, Nat. Hazards, 82, 175–192, 2016. 

Pescaroli, G. and Kelman, I.: How critical infrastructure orients international relief in cascading disasters, J. Conting. Crisis Man., 25, 56–67, 2017. 

Pregnolato, M., Ford, A., Robson, C., Glenis, V., Barr, S., and Dawson, R.: Assessing urban strategies for reducing the impacts of extreme weather on infrastructure networks, Roy. Soc. Open Sci., 3, 160023,, 2016. 

Pye, G., Warren, M., and Hutchinson, W.: Critical infrastructure protection: an ethical choice, in: ICT ethics and security in the 21st century: new developments and applications, IGI Global, edited by: Quigley, M., Hershey Pa., 214–230,, 2011. 

Rehak, D., Hromada, M., and Novotny, P.: European critical infrastructure risk and safety management: directive implementation in practice, Chem. Engineer. Trans., 48, 943–948, 2016. 

Rey, B., Tixier, J., Bony-Dandrieux, A., Dusserre, G., Munier, L., and Lapebie, E.: Interdependencies between industrial infrastructures: territorial vulnerability assessment, Chem. Engineer. Trans., 31, 61–66, 2013. 

Ridley, G.: National security as a corporate social responsibility: critical infrastructure resilience, J. Bus. Ethics, 103, 111–125, 2011. 

Rosenbrock, R. and Gerlinger, T.: Gesundheitspolitik, Huber Verlag, Bern, 2004. 

Sage, D., Sircar, I., Dainty, A., Fussey, P., and Goodier, C.: Understanding and enhancing future infrastructure resiliency: a socio-ecological approach, Disasters, 39, 407–426, 2015. 

Sawalha, I. H.: Collaboration in crisis and emergency management: identifying the gaps in the case of storm “Alexa”, J. Business Contin. Emerg. Plan., 7, 312–323, 2014. 

Schweizer, R. J.: State duties to protect. A Swiss constitutional law perspective, Eur. J. Risk Regul., 6, 219–228, 2015. 

Shafieezadeh, A. and Ivey Burden, L.: Scenario-based resilience assessment framework for critical infrastructure systems: case study for seismic resilience of seaports, Reliab. Eng. Syst. Safe., 132, 207–219, 2014. 

Smedts, B.: Critical Infrastructure Protection Policy in the EU: State of the Art and Evolution in the (Near) Future, Royal High Institute of Defence – Center for Security and Defence Studies, Brussels, 2010. 

Spiegel Online: Bundesregierung will Bevölkerung zu Hamsterkäufen raten, available at: (last access: 9 February 2018), 2016. 

Shuang, Q., Zhang, M., and Yuan, Y.: Performance and reliability analysis of water distribution systems under cascading failures and the identification of crucial pipes, PLoS ONE, 9, e88445,, 2004. 

Stewart, G. T., Kolluru, R., and Smith, M.: Leveraging public-private partnerships to improve community resilience in times of disaster, Int. J. Phys. Distr. Log., 39, 343–364,, 2009. 

Timashev, S. A.: Infrastructure resilience: definition, calculation, application, in: 2015 IEEE International Conference on Interactive Collaborative Learning (ICL), 20–24 September 2015, Florence, Italy 1075–1078,, 2015. 

Uekusa, S. and Matthewman, S.: Vulnerable and resilient? Immigrants and refugees in the 2010–2011 Canterbury and Tohoku disasters, Int. J. Disast. Risk. Re., 22, 355–361, 2017. 

UNISDR: Disaster Resilience Scorecard for Cities, Detailed level assessment, United Nations Office for Disaster Risk Reduction (UNISDR), resilience scorecard for cities_Detailed.pdf (last access: 19 April 2018) 2017. 

UP-KRITIS: IT-Notfall- und Krisenübungen in Kritischen Infrastrukturen, Geschäftsstelle des UP KRITIS, Bundesamt für Sicherheit in der Informationstechnik, Bonn, 2014a. 

UP-KRITIS: Öffentlich-Private Partnerschaft zum Schutz Kritischer Infrastrukturen, Geschäftsstelle des UP KRITIS, Bundesamt für Sicherheit in der Informationstechnik, Bonn, 2014b. 

UP-KRITIS: Best-Practice-Empfehlungen für Anforderungen an Lieferanten zur Gewährleistung der Informationssicherheit in Kritischen Infrastrukturen, Geschäftsstelle des UP KRITIS, Bundesamt für Sicherheit in der Informationstechnik, Bonn, 2016. 

Urlainis, A., Shohet, I. M., Levy, R., Ornai, D., and Vilnay, O.: Damage in critical infrastructures due to natural and man-made extreme events – A critical review, Procedia Eng., 85, 529–535,, 2014.  

Van Aaken, A. and Wildhaber, I.: State liability and critical infrastructure: a comparative and functional analysis, Eur. J. Risk Regul., 6, 244–254, 2015. 

Van der Bruggen, K.: Critical infrastructures and responsibility: a conceptual exploration, Safety Sci., 46, 1137–1148, 2008. 

Wang, S., Hong, L., Ouyang, M., Zhang, J., and Chen, X.: Vulnerability analysis of interdependent infrastructure systems under edge attack strategies, Safety Science, 51, 328–337,, 2013 

Wang, Y., Fan, H., Lin, W., Lai, Y.-C., and Wang, X.: Growth, collapse, and self-organized criticality in complex networks, Sci. Rep.-UK, 6, 24445,, 2016. 

Wisner, B.: At Risk: Natural Hazards, People's Vulnerability and Disasters, Routledge, London, 2004. 

Zhang, Y. and Yağan, O.: Optimizing the robustness of electrical power systems against cascading failures, Sci. Rep.-UK, 6, 27625,, 2016. 

Zhao, D., Wang, L., Zhi, Y., and Wang, Z.: The robustness of multiplex networks under layer node-based attack, Sci. Rep.-UK, 6, 24304,, 2016. 


For example within the expert round-table discussion on “Integrated Research for Enhancing the Resilience of Critical Infrastructures through Strategic Assessments and Innovative Planning Approaches”, sponsored by the German Research Foundation and hosted by the University of Stuttgart on 26–27 October 2016 (, or within the expert meetings during the design phase of the KIRMIN (Critical Infrastructures Resilience as a Minimum Supply Concept) project (, now sponsored by the German Federal Ministry for Science and Education.

Short summary
Despite the increased attention given to critical infrastructure resilience in the context of natural hazards and disasters discussions on the role of social vulnerability assessments and minimum supply considerations for governing critical infrastructure failures remain scarce. Based on a structured literature review the paper responds to the identified gaps by developing a heuristic model on the linkages between the three topics and sketches out recommendations for a future research agenda.
Final-revised paper