In the recent years, the focus has moved from critical infrastructure protection to that of resilience. But how do we know whether a critical infrastructure is resilient or not, how can it be evaluated, measured and enhanced?

Drawing on, combining and developing the ideas of the existing literature and practices, the current report develops a holistic, easy-to-use and computable methodology to evaluate critical infrastructure resilience, called Critical Infrastructure Resilience Index (CIRI). The methodology is applicable to all types of critical infrastructure, including a possibility to tailor it to the specific needs of different sectors, facilities and hazard scenarios. The proposed methodology is especially suitable for organizational and technological resilience evaluation, but permits including also elements of societal resilience indicators to the evaluations.

The methodology is based on four levels of hierarchically organized indicators. Level 1 consists of the phases well known from the so-called crisis management cycle. Under these phases, we find sets of Level 2 rather generic indicators. Thus under level 1 ‘Prevention’, for instance, we may find a Level 2 indicator such as ‘Resilient design’, further divided into Level 3 more detailed indicators such as ‘Physical robustness’, ‘Cyber robustness’, ‘Redundancy’, ‘Modularity’, and ‘Independency’. The task is to study these indicators on Level 4 in the context of concrete critical infrastructure facilities and hazard scenarios, that is, applying Level 3 indicators into concrete circumstances.

The methodology then permits to transfer quantitative, semi-quantitative and qualitative evaluations of individual sector-specific resilience indicators into uniform metrics, based on process maturity levels. This in turn makes it possible to give a specific critical infrastructure, or its part, a resilience value on the scale 0-5.

While the real resilience value becomes clear only when one engages in the analysis of several indicators, the methodology can be used also as a step-by-step measurement and development tool for resilience, without necessary immediately engaging in time-consuming total resilience analysis.

The user of this methodology is supposed to be the operator of critical infrastructure, or part of it, in the spirit of self-auditing. In case it would be implemented in a wider scale, in cooperation between the operators and authorities, it would give the authorities a holistic picture about the respective society’s critical infrastructure resilience.

In this report, we draw a concise picture of the methodology and illustrate how this methodology could be applied to a specific infrastructure and hazard scenario.