Critical infrastructure resilience and civil preparedness: EU and NATO approaches

Abstract

Following three subsequent attacks against EU Member States’ critical infrastructures in the Baltic Sea in the late 2024, NATO urged its member countries to think about conflict preparedness. Early this year (2025), while debating on the risks and consequences of attacks against EU critical infrastructures (CIs), a European Parliament’s plenary urged its members to consider how to prepare for the worse-case scenario, considering the rising geopolitical tensions and Russia’s hybrid attacks against EU CIs. In absence of its own defense capabilities, the EU depends heavily on NATO for military defense. While the military Alliance considers civil preparedness a central pillar of its members’ resilience in face of conflict and an enabler for collective defense, EU Member States’ degree of civil preparedness has been evaluated as inadequate. Yet, the former Finnish President considers civil preparedness as a citizens’ right and Sweden has already distributed booklets, across the country’s households, on what to do in case of war. This paper compares the civil preparedness policy frameworks and capabilities of the EU and NATO, in case of critical infrastructure failure during conflict. It identifies points of convergence, divergence, complementarities and synergies to assess the degree to which the EU is adequately equipped to respond and recover from cyberattacks against critical infrastructure and mitigate the impacts of conflict on the civilian
population. The discussion focuses on the current weaknesses of the European Union’s framework and capacities and provides guidance on how to integrate the governance of critical infrastructure resilience within civil preparedness and crisis management
frameworks.