Critical Infrastructure Resilience and Civil Preparedness: EU and NATO approaches

Abstract

Following three subsequent attacks against EU Member States’ critical infrastructures (CIs) in the Baltic Sea in late 2024, NATO urged its member countries to think about conflict preparedness. In early 2025, while debating the risks and consequences of attacks against EU CIs, the European Parliament urged Member States to consider how to prepare for the worst-case scenario, considering the rising geopolitical tensions and Russia’s hybrid attacks against EU CIs. In absence of its own defence capabilities, the EU depends heavily on NATO for military defence. While the military Alliance considers civil preparedness a central pillar of its members’ resilience in the face of conflict and an enabler for collective defence, EU Member States’ degree of civil preparedness has been evaluated as inadequate. Yet, former Finnish President considers civil preparedness as a citizens’ right and Sweden has already distributed booklets, across the country’s households, on what to do in case of war. This paper compares the civil preparedness policy frameworks and capabilities of the EU and NATO, in case of CI failure during conflict. It identifies points of convergence, divergence, complementarities and synergies to assess the degree to which the EU is adequately equipped to respond and recover from cyber-attacks against CIs and mitigate their impacts on the civilian population. The discussion focuses on the current weaknesses of the EU’s framework and capacities and provides guidance on how to integrate the governance of CI resilience within civil preparedness and crisis management frameworks.