The ERNCIP survey on COVID-19: Emergency & Business Continuity for fostering resilience in critical infrastructures.

Among the many repercussions of the COVID-19 emergency to be assessed, those on critical infrastructures and the associated businesses and professions are certainly important ones. In this paper, we document the conception, implementation and outcome of a survey organized by European Commission's Joint Research Centre and entitled "COVID-19: Emergency & Business Continuity". This was conducted in April-May 2020 with the participation of critical infrastructure experts (including professionals from the academia and research institutions, infrastructure operators and industry representatives, public authorities and members of security agencies), involved as stakeholders in the European Reference Network for Critical Infrastructure Protection (ERNCIP). Themes explored through this study include an assessment of the business continuity status and the evaluation of emergency management and disaster recovery aspects, as experienced from the perspective of different sectors, organization types and personal perceptions of the respondents.

Introduction

Critical infrastructures (CIs), sometimes defined as the nervous system of our societies, are not exempt from the consequences of the COVID-19 pandemic. The global escalation of the crisis forced these systems into unexplored operational conditions. Evidently, in the eye of the storm are hospitals and the healthcare sector, which in many cases are simultaneously facing high patient pressure and issues with critical supplies (Ranney et al., 2020, Emanuel et al., 2020). Broadening the perspective to the ensemble of CI sectors, many associated factors of concern need thorough consideration.

A number of studies are addressing the patterns of change in demand for critical services, see e.g. (Bahmanyar et al., 2020, Norouzi et al., 2020) (electricity and oil consumption) and (Iacus et al., 2020) (passenger air traffic). Indeed, as (Carvalhaes et al., 2020) remarks, “seemingly in the course of weeks, our demands for many basic and critical services have radically shifted”. On the other side, CIs are also facing supply and workforce-related risks, see e.g. (Groenewold et al., 2020, Poch et al., 2020). Key is the role of CI workers in response to the COVID-19 emergency. Among the recent initiatives in this direction, we can mention for instance the “Guidance on the Essential Critical Infrastructure Workforce” advisory list issued by the US Cybersecurity & Infrastructure Security Agency (CISA), which provides a catalog of those identified as categories of essential CI workers.1

Some CIs are examined as potential channels for the spread of the virus as well as a means for the implementation of response policies. In this sense, in addition to transportation which is obviously subject to risks and restrictive measures, the literature is also focusing on other sectors, such as the water and wastewater system (Nghiem et al., 2020). Moreover, the disruption of essential services is mentioned in Douglas et al. (2020) as a potential mechanism through which pandemic response is likely to affect health. Consequently, the authors indicate mitigating factors such as a “robust business continuity planning” and the actuation of prioritization and guidance measures.

Given the current circumstances, further priorities are keeping critical assets safe irrespective of non-usual working arrangements (Evangelakos, 2020), elaborating coordinated response even at the local level (Switzer et al., 2020), and ensuring preparedness for other events that may occur, such as natural hazards (Clark-Ginsberg et al., 2020). Cases of cyber-attacks on critical services such as hospitals have recently attracted widespread attention (Muthuppalaniappan and Stevenson, 2020), and similar events sometimes challenge drastically safety, security and reputation of the involved businesses and organizations.

In line with what was observed in Keenan (2020), the current situation can represent an opportunity to assess the status of resilience planning at the level of both public and private CI stakeholders. According to Koonin (2020), indeed, “preparing for a potential infectious disease pandemic from influenza or a novel corona virus is an essential component of a business continuity plan, especially for businesses that provide critical healthcare and infrastructure services”. Likewise, it is important to reflect on the nonconventional nature of this hazard and the need to upgrade our planning capabilities, also in order to better handle concurrent crises (Carvalhaes et al., 2020). To this end, we need to discern how differently the various infrastructure sectors are impacted (Jallow et al., 2020), to collect best practices (World Economic Forum, 2020) and to evaluate our policies and emergency preparedness strategies (Sowby, 2020).

The present paper aims at contributing to this research stream by documenting an empirical study we recently conducted through survey initiative “COVID-19: Emergency & Business Continuity”. This took place through the participation of a pool of CI experts, who are involved in the European Reference Network for Critical Infrastructure Protection (ERNCIP) coordinated by the European Commission’s Joint Research Centre (JRC). The mission of this network is to elaborate pre-standardization work as well as best practices and input to policymakers in the European Union (EU), so as to facilitate the development of competitive and innovative security solutions. Through the years, ERNCIP has configured as a robust community of CI professionals, whose contributions and perspectives were brought together and leveraged in the framework of the initiative here documented. The survey, prepared in the wake of the pandemic outbreak in Europe, was administered in April-May 2020 and allowed the collection of a total of 118 valid responses from actors across the EU and beyond. Given the fact that this was a targeted survey addressed to a few hundreds of experts, the turnover of answers was more than satisfying. The questionnaire, organized into five sections and including space for open comments, queried the participants on various subjects related to business continuity, emergency management and disaster recovery. The objective was, through the analysis of the contribution by the participants, to acquire a better understanding of the situation and get insights for future developments in this area.

The rest of this document is organized as follows: in Section 2 we provide background information underlying the formulation of the survey initiative; Section 3 illustrates the adopted methodology, including design and implementation aspects, and it overviews the sample group we considered; the outcomes of the survey are discussed in Section 4; in Section 5, we propose a few discussion points; finally, the paper is completed by some concluding remarks.

Background

Scientific work touching upon the themes of business continuity and disaster preparedness through surveys can be found well before the COVID-19 emergency. Some of the reference literature informing our study can be found in Cerullo and Cerullo, 2004, Karim, 2011, Azadegan et al., 2020. Naturally, the subject holds a special interest in the current context. For instance, World Economic Forum (2020) reports on an initiative conducted in March-April 2020, comprising structured interviews with 30 senior executives across industries and surveys involving more than 400 senior supply chain executives from Asia, Europe and the US. The results underline how, after the supply-side shock perceived by global multinationals in January 2020, severe demand-side disruption resulted when lockdown measures were introduced in Europe and North America. Larger companies displayed comparative advantages in terms of supply chain response, also considering investments in supply chain visibility and size advantages when negotiating for scarce supplies. Different businesses had diverse impacts, with the health sector displaying above-average adaptation via self-scoring. The same reference also contains recommendations to ensure business continuity, protect employees, accelerate recovery, improve resilience, and cope with long-term impacts.

Additionally, Veselovská (2020) gathered manager opinions and experiences across four countries (Slovak Republic, Czech Republic, Poland and Hungary), in order to gauge the impacts of both COVID-19 and the countermeasures put in place by the authorities on supply chains. Aspects covered include changes in the supply chain architecture and length, revenue, the international dimension, and measures taken. Analyzing gaps between the supply chain research literature and the industry in the light of the COVID-19 emergency, Remko (2020) provides empirical evidence collected from semi-structured interviews with supply chain executives run during March 2020. The author categorizes supply risks (including potential long-lasting aftereffects due to shipping delays in long pipelines, logistical bottlenecks and gaps in preparedness and contingency plans), demand risks (taking into account the characteristics of observed demand, including spikes and sharp reductions depending on the products), and control risks (with tendencies such as seeking priority and collaboration and passing some financial pressure to suppliers). Additional examples of COVID-19-related initiatives and studies in the same area can be found in Haren, 2020, Omar et al., 2020, Păunescu and Argatu, 2020, which the reader can refer to for further discussion.

To formulate our study, we took into account some of the literature mentioned so far as well as previous work specific to the context of CIs. In this sense, a key reference was (OECD, 2019), which elaborates principles of good governance for CI resilience taking into account the outcomes of a cross-country survey, addressing aspects such as sectoral interdependencies and policy tools useful to foster CI resilience. Useful insights were also found in Renda and Hammerli (2010), which references survey results on topics such as sectoral vulnerabilities, and (Pescaroli, 2018), analyzing perceptions associated with interdependencies and cascading risks, mitigation strategies and training. On the subject of safety culture, we elaborated over (Choudhry et al., 2007) and references therein, notably (Grote and Künzler, 2000, Reiman and Oedewald, 2004).

Considering the nature of our initiative, we sourced founding principles and criteria for the organization and content design of our survey from the EU policy landscape on CI protection (Theocharidou et al., 2018), as well as from standards such as ISO 23001:2019 and the 2019 Edition of NFPA 1600. We also integrated notions from CI-relevant literature on business continuity management (Herbane et al., 2004, Torabi et al., 2014), business continuity measures (Zeng and Zio, 2017, Zio, 2018), service-oriented CI modeling and impact analysis (Galbusera and Giannopoulos, 2018, Galbusera et al., 2020). Particularly relevant to our developments is previous research on resilience measures and metrics, see e.g. (Hosseini et al., 2016, Han et al., 2020), and stress testing (Galbusera and Giannopoulos, 2019). Moreover, we referred to the catalog of COVID-19 risk mitigation measures compiled in Bruinen de Bruin et al. (2020) and to guidelines such as (U.S. Department of Homeland Security, 2006, Swanson et al., 2010).

Methodology

In this section, we first provide overview information on the study group targeted by survey “COVID-19: Emergency & Business Continuity”, namely the ERNCIP stakeholders. Secondly, we briefly describe the design and implementation of the questionnaire.

Sample group: ERNCIP stakeholders

The target sample group of the present study is composed of the stakeholders involved in the European Reference Network for Critical Infrastructure Protection (ERNCIP).2 This is a network of professionals and subject-matter experts working in close cooperation towards the vision “to ensure highly secure and resilient infrastructures and services for the European citizens”, accomplishing the mission “to foster the emergence of innovative, qualified, efficient and competitive security solutions (Forsberg and Kourti, 2013). The ERNCIP initiative was set up through a preparatory phase launched in 2009, when the JRC was tasked by the EU Member States with exploratory work, followed by the implementation phase triggered in 2010 (Ward et al., 2014).

As illustrated in the 2018 ERNCIP Handbook (Gattinesi, 2019), a first accomplishment since its launch was the creation of the ERNCIP Inventory of Laboratories, which represents “a searchable, central repository of information on European experimental and testing facilities with CIP-related capabilities”.3 Secondly, “the initial network of research institutions has been expanded through the creation of a series of working networks of volunteer European experts, assembled in the form of Thematic Groups” (TGs). Each TG, qualified by its area of investigation, gathers a pool of subject-matter experts working under the guidance of a coordinating organization appointed by the ENRCIP Office. Experts are generally from a diverse professional background, including for instance professionals from the academia and research institutions, infrastructure operators and industry representatives, public authorities and members of security agencies.

Under the JRC’s governance, each TG caters to results such as the preparation of terms of reference for the corresponding thematic area, the delivery of reports, the contribution to pre-standardization at EU-level, fostering the development of innovative and competitive security solutions within a trusted environment (Poustourli and Kourti, 2014, Ward et al., 2014). The currently active groups are listed in Table 1 .

Table 1

Currently active ERNCIP TGs.

TG name	webpage
Chemical and Biological Risks to Drinking Water	WATER TG
Detection of Indoor Airborne Chemical & Biological Agents	AIRBORNE TG
Early Warning Zones	EWZ TG
Industrial Automation & Control Systems Cybersecurity Certification Scheme	IACS TG
Radiological and Nuclear Threats to Critical Infrastructure	RN TG

The ERNCIP community was involved as the respondent to the survey given the multi-sectorial and multi-dimensional environment in which its members operate. The variety of private and public institutions involved and their span of action, ranging from the local to the supranational scale, represented characteristic factors that were carefully considered in setting up the survey initiative. As a consequence, we aimed at gaining a cross-cutting perspective on the ongoing situation, gathering information on actions being taken and drawing useful insights from the participants’ perceptions.

Questionnaire design and implementation

Questionnaire “COVID-19: Emergency & Business Continuity” was designed according to a multi-section, mostly multiple-answer format. Next, we summarize the contents of its five sections; the corresponding full text is reported in Appendix A, Table A.6, Table A.7.

Table A.6

Question 8 - items.

	(1)	(2)	(3)	(4)	(5)	(–)
	much worse	worse	unchanged	better	much better	I don’t know/not applicable
Demand by clients	∘	∘	∘	∘	∘	∘
Service by suppliers	∘	∘	∘	∘	∘	∘
Internal production/operation	∘	∘	∘	∘	∘	∘
Profitability	∘	∘	∘	∘	∘	∘

Table A.7

Question 11 - items.

	(1)	(2)	(3)	(4)	(5)	(–)
	not at all	to a small extent	to some extent	to a moderate extent	to a large extent	I don’t know/not applicable
Staff unavailability	∘	∘	∘	∘	∘	∘
Working hours limitations	∘	∘	∘	∘	∘	∘
Site/area isolation	∘	∘	∘	∘	∘	∘
Mobility restrictions	∘	∘	∘	∘	∘	∘
Health & hygiene protocols	∘	∘	∘	∘	∘	∘
Lack of emergency funding	∘	∘	∘	∘	∘	∘
Lack of insurance coverage	∘	∘	∘	∘	∘	∘
Technological deficiencies	∘	∘	∘	∘	∘	∘

Section1- General aspects (questions 1–5), devoted to a general categorization of the respondent’s reference organization (e.g. main country of operation, activity sectors, type of organization, number of employees, market share).

Section2- Business continuity status (questions 6–12), querying about the respondents’ assessment of the current situation from a business continuity perspective (in terms of status and trends in the organization’s core business, impacts and patterns of change in demand, supply and internal operation, as well as critical external dependencies evaluated in the context of the pandemic).

Section3- Emergency management and disaster recovery (questions 13–20), evaluating the presence of business continuity plans, cooperation mechanisms, disaster prevention and early warning tools and information channels, as well as collecting perceptions about the perspective recovery phase and the needed measures.

Section4- Professional activity (questions 21–24), providing a general framing of the professional activity of the survey respondents and gauging impacts on the daily working activities and needs.

Section5- Personal comments (two open comment fields), offering room for additional feedback by the participants.

The questionnaire, in English, was elaborated to be administered online and with an estimated baseline response time of about 10 minutes. It is mostly based on single- and multiple-answer questions. In various cases, we opted for semi-open questions, also to take into account the diversity in the background of the potential participants. All answers were set as non-mandatory and we often included a ‘null’ option (e.g. I don’t know/it cannot be said, I don’t know/not applicable). A welcome message was introduced at the beginning of the questionnaire, to inform the participants on the motivation, scope and articulation of the study, the target audience and other aspects (e.g. voluntary nature of the initiative, data treatment). Prior to publication, the questionnaire was peer-reviewed and pretested by colleagues at the JRC.

Outcome of the survey

The survey was entirely run through the EUSurvey platform,4 during the period from 22/04/2020 to 31/05/2020. Invitations to contribute were dispatched through the ERNCIP stakeholders’ mailing list and participation was anonymous. Out of a total of 121 submissions, we retained valid items based on a -completion thresholding criterion. A data cleaning step was performed to compensate for minor inconsistencies, typically related to the use of semi-open response options. The resulting data pool was then analyzed both on a per-question basis and comparatively across questions and sections, as detailed below in this section.

Notation. In our discussion, we adopt the following abbreviations (and some combinations thereof) for question qualification: Q (question), SS (single-selection question), MS (multiple-selection question), Likert5 (5-levels Likert/Likert-type item), null (‘null’ response option), (semi-) open ((semi-)open question).

General aspects

The information collected in Section 1 of the questionnaire allows an overview and broad categorization of the organizations reported about. The declared country coverage, according to Q1 (“1. In which country does your organization mainly operate?”) [SS] articulates into

20 EU countries (Austria, Belgium, Bulgaria, Cyprus, Czechia, Denmark, Finland, France, Germany, Greece, Hungary, Italy, Luxembourg, Netherlands, Poland, Portugal, Romania, Slovenia, Spain and Sweden), totaling 107 answers;

Israel, Norway, the United Kingdom and the United States of America, totaling 9 answers.

In the residual cases, the reference country was left unspecified.

Q2 (“2. In which sectors does your organization operate?”) [MS, semi-open] included a list of 15 sectors, identified on the basis of reference scientific and legal literature5 and our knowledge of the target sample group, plus an open option. The mentioned sectors are: banking and financial services; chemical industry; critical manufacturing; electric utilities; food production and distribution; health sector; ICT infrastructure and services; mining and quarrying; nuclear sector; oil and gas utilities; public safety and civil protection; space and defense; transport and logistics; university and research; water utilities. The answers evidence university and research as the option selected most frequently, see Fig. 1 . Comparatively high frequencies are also found for other sectors such as water and electric utilities, public safety and civil protection and, notably, the health sector. In cases the respondents specified a single option. Occasionally, when explicitly stated throughout our discussion, we will make reference to this sample subset (denoted as single-sector-Q2); see Table 2 for details. All the remaining cases consist of multiple selections.

Fig. 1

Sorted frequencies associated with Q2 (“2. In which sectors does your organization operate?”).

Table 2

Comparative frequency tables for Q2 (top, ) and single-sector-Q2 (bottom, ). Observe that, in the second case, some sectors are not represented.

	frequency
Q2
Banking and financial services	4 (3.39%)
Chemical industry	2 (1.69%)
Critical manufacturing	3 (2.54%)
Electric utilities	15 (12.71%)
Food production and distribution	2 (1.69%)
Health sector	19 (16.1%)
ICT infrastructure and services	9 (7.63%)
Mining and quarrying	1 (0.85%)
Nuclear sector	10 (8.47%)
Oil and gas utilities	9 (7.63%)
Public safety and civil protection	15 (12.71%)
Space and defense	5 (4.24%)
Transport and logistics	13 (11.02%)
University and research	26 (22.03%)
Water utilities	25 (21.19%)
Other (please specify below)	10 (8.47%)
N/A	0 (0.0%)
total	168 (142.37%)
Single-sector-Q2
Banking and financial services	4 (4.12%)
Chemical industry	0 (0.0%)
Critical manufacturing	0 (0.0%)
Electric utilities	7 (7.22%)
Food production and distribution	1 (1.03%)
Health sector	17 (17.53%)
ICT infrastructure and services	3 (3.09%)
Mining and quarrying	0 (0.0%)
Nuclear sector	2 (2.06%)
Oil and gas utilities	1 (1.03%)
Public safety and civil protection	5 (5.15%)
Space and defense	1 (1.03%)
Transport and logistics	8 (8.25%)
University and research	18 (18.56%)
Water utilities	22 (22.68%)
Other (please specify below)	8 (8.25%)
N/A	0 (0.0%)
total	97 (100.0%)

A better understanding of the latter and further aspects was gained through Q3 (“3. What type of organization is yours?”) [SS, semi-open], including options industry or operator of essential services, consultancy, public authority, university and research institute and other. In this case, industry or operator of essential services was the prominent category, with 39 cases. The results, combined with those from Q4 (“4. Can you estimate the total number of employees in your organization?”) [SS+null] and Q5 (“5. Can you estimate your organization’s market share, countrywide?”) [SS+null], display a certain variety in the span of organizations referenced within the study; see Table B.8, Table B.9 in Appendix B for details. The breakdown of sectors by underlying organization type is illustrated in Fig. 2 . By cross-comparison, we also verified that multiple selections of sectors in Q2 were most frequently associated with Q3’s category of university and research institute (28.57%), followed by industry or operator of essential services (23.81%) and public authority (19.05%).

Table B.8

Combined frequency table for Q3 (“3. What type of organization is yours?”) and Q4 (“4. Can you estimate the total number of employees in your organization?”).

	1–20	21–50	51–100	101–500	501–1000	Over 1000	I don’t know/it cannot be said	N/A	total
Industry or operator of essential services	0 (0.0%)	2 (1.69%)	2 (1.69%)	10 (8.47%)	9 (7.63%)	16 (13.56%)	0 (0.0%)	0 (0.0%)	39 (33.05%)
Consultancy	5 (4.24%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	1 (0.85%)	0 (0.0%)	0 (0.0%)	6 (5.08%)
Public authority	1 (0.85%)	3 (2.54%)	5 (4.24%)	9 (7.63%)	5 (4.24%)	5 (4.24%)	0 (0.0%)	0 (0.0%)	28 (23.73%)
University and research institute	0 (0.0%)	0 (0.0%)	1 (0.85%)	5 (4.24%)	4 (3.39%)	16 (13.56%)	0 (0.0%)	0 (0.0%)	26 (22.03%)
Other (please specify below)	2 (1.69%)	1 (0.85%)	5 (4.24%)	5 (4.24%)	2 (1.69%)	4 (3.39%)	0 (0.0%)	0 (0.0%)	19 (16.1%)
N/A	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
total	8 (6.78%)	6 (5.08%)	13 (11.02%)	29 (24.58%)	20 (16.95%)	42 (35.59%)	0 (0.0%)	0 (0.0%)	118 (100.0%)

Table B.9

Combined frequency table for Q3 (“3. What type of organization is yours?”) and Q5 (“5. Can you estimate your organization’s market share, countrywide?”).

	0–10%	11–25%	26–50%	51–99%	Monopoly	I don’t know/not applicable	N/A	total
Industry or operator of essential services	8 (6.78%)	4 (3.39%)	1 (0.85%)	6 (5.08%)	8 (6.78%)	12 (10.17%)	0 (0.0%)	39 (33.05%)
Consultancy	5 (4.24%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	1 (0.85%)	0 (0.0%)	6 (5.08%)
Public authority	4 (3.39%)	2 (1.69%)	0 (0.0%)	2 (1.69%)	6 (5.08%)	14 (11.86%)	0 (0.0%)	28 (23.73%)
University and research institute	5 (4.24%)	4 (3.39%)	2 (1.69%)	3 (2.54%)	0 (0.0%)	12 (10.17%)	0 (0.0%)	26 (22.03%)
Other (please specify below)	4 (3.39%)	2 (1.69%)	5 (4.24%)	2 (1.69%)	0 (0.0%)	6 (5.08%)	0 (0.0%)	19 (16.1%)
N/A	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
total	26 (22.03%)	12 (10.17%)	8 (6.78%)	13 (11.02%)	14 (11.86%)	45 (38.14%)	0 (0.0%)	118 (100.0%)

Fig. 2

Breakdown of organization types represented per sector, based on the joint analysis of Q2 and Q3.

Finally, observe that some participants submitted further case-specific information through the open response fields at Q2 and Q3. Predominantly, in Q2 reference was made to particular kinds of safety/security organizations, while in Q3 health institutions and professional associations were mentioned.

Business continuity status

Emergency impacts and trends

In general, the feedback received through Q6 (“6. To the best of your knowledge, was your organization’s core business negatively affected by the COVID-19 emergency so far?”) [SS+null] confirms the importance of the shock on businesses imposed by the COVID-19 emergency, as perceived by the survey participants. At the same time, in many cases the answers to Q7 (“7. To the best of your knowledge, what is the status of your organization’s core business with respect to two weeks ago?”) [SS+null] suggest a relatively positive outlook on the evolving situation, at the time of compiling. When jointly evaluating Q6 and Q7, the peak combined frequency points toward a somehow significant impact, yet a stable situation; see Table B.10 for details.

Table B.10

Combined frequency table for questions Q6 (“6. To the best of your knowledge, was your organization’s core business negatively affected by the COVID-19 emergency so far?”) and Q7 (“7. To the best of your knowledge, what is the status of your organization’s core business with respect to two weeks ago?”).

	It is improving	It is stable	It is worsening	I don’t know/it cannot be said	N/A	total
YES, completely	2 (1.69%)	1 (0.85%)	2 (1.69%)	0 (0.0%)	0 (0.0%)	5 (4.24%)
YES, significantly	11 (9.32%)	15 (12.71%)	10 (8.47%)	0 (0.0%)	0 (0.0%)	36 (30.51%)
YES, somehow	16 (13.56%)	33 (27.97%)	2 (1.69%)	4 (3.39%)	0 (0.0%)	55 (46.61%)
NO	2 (1.69%)	17 (14.41%)	0 (0.0%)	1 (0.85%)	0 (0.0%)	20 (16.95%)
I don’t know/it cannot be said	1 (0.85%)	1 (0.85%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	2 (1.69%)
N/A	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
total	32 (27.12%)	67 (56.78%)	14 (11.86%)	5 (4.24%)	0 (0.0%)	118 (100.0%)

Moreover, making reference to the single-sector-Q2 subset, we elaborated the representation in Fig. 3 , which illustrates the relative severity and sectoral diversity of perceived impacts. We can observe, for instance, the comparative intensity of those registered in transport and logistics, public safety and civil protection and the health sector. Symmetrically, in Fig. 4 we report the sectoral breakdown relative to Q7. In relatively few cases the situation has been declared as worsening, and conversely a certain amount of respondents provided a positive perspective. Clearly, both results need to be pondered in the light of sample representativeness, which can be appreciated via Table 2 for each specific sector.

Fig. 3

Sectoral breakdown (single-sector-Q2) of percentages associated with Q6 (“6. To the best of your knowledge, was your organization’s core business negatively affected by the COVID-19 emergency so far?”).

Fig. 4

Sectoral breakdown (single-sector-Q2) of percentages associated with Q7 (“7. To the best of your knowledge, what is the status of your organization’s core business with respect to two weeks ago?”).

Demand, service, internal production/operation, profitability

The situational assessment was articulated, in Q8 (“8. In your organization, how did the following aspects change since the COVID-19 outbreak?”) [4 * (Likert5+null)], into the categories of demand by clients, service by suppliers, internal production/operation and profitability. The considered response options included values much worse (1), worse (2), unchanged (3), better (4) and much better (5), while we granted the possibility for a null response (I don’t know/not applicable (-)) or no response at all. Some associated descriptive statistics are enumerated in Table 3 ; see also Fig. 5 for an illustration. In all cases, focusing on the sub-sample of respondents who optioned within the (1)–(5) range, the mean stands below the neutral landmark (option (3)), with profitability scoring lowest (mean = 2.13) and followed by service by suppliers (mean = 2.34). Appreciable differences can also be observed in terms of other measures, notably considering the higher variance associated with the case of demand by clients.

Table 3

Descriptive statistics for Q8 (“8. In your organization, how did the following aspects change since the COVID-19 outbreak?”) computed over the sub-sample selecting options (1)–(5), per item.

	n	mean	variance	skewness	kurtosis
Demand by clients	96	2.48	1.01	0.5	−0.02
Service by suppliers	103	2.34	0.36	−0.04	−0.37
Internal production/operation	110	2.65	0.6	0.46	0.45
Profitability	86	2.13	0.61	0.38	−0.15

Fig. 5

Percentages associated with answers to Q8 (“8. In your organization, how did the following aspects change since the COVID-19 outbreak?”) in range (1)–(5).

Similarly to what done above, in Fig. 6 we offer a glimpse of the sectoral differences in the reported Q8 values, computed in relation to the single-sector-Q2 answers subset. In terms of demand by clients (79 single-sector samples in range (1)–(5) out of ), when assessing the rate of bottom-scale responses (options (1) and (2)) per sector, the most affected categories appear to be electric utilities (85.71% of cases), transport and logistics (75% with an apical 50% of (1)-level responses) and the health sector (52.94%). While in some (12) cases improvements in demand are also reported, service by suppliers (84 samples) uniformly exhibits a negative-to-neutral pattern. The feedback becomes mixed again in the case of internal production/operation and profitability. In the latter cases, while still remarking the limited size of some sectoral samples, we can observe milder impacts with positive accents on the ICT infrastructure and services, space and defense and public safety and civil protection. See also Fig. 7, Fig. 8, Fig. 9 for cross-analyses involving Q3, Q4 and Q5, considering the total population of respondents. Overall, the latter analyses can help in appreciating some asymmetries of the considered shock, both across different organizations and with respect to different facets of their operational context.

Fig. 6

Split of frequencies associated with Q8 (“8. In your organization, how did the following aspects change since the COVID-19 outbreak?”) (question items: demand by clients; service by suppliers; internal production/operation; profitability) based on for the single-sector-Q2 data subset.

Fig. 7

Split of frequencies associated with Q8 by Q3 categories.

Fig. 8

Split of frequencies associated with Q8 by Q4 categories.

Fig. 9

Split of frequencies associated with Q8 by Q5 categories.

Demand and supply patterns, critical internal factors

In Q9 (“9. Did you observe any of the following in clients’ demand?”) [MS+null, semi-open], category irregular patterns (e.g. peaks and valleys) ranked first, being selected by 29.66% of the participants, and was followed by no significant changes (27.12%) and steep demand decline (22.03%). A steep demand surge was reported only in 11.86% of the cases. Market-share sensitivity was equally evaluated via Q5, suggesting a mixed situation in terms of the kind of impact on demand per level of market share; see Table B.11 for more detail.

Table B.11

Combined frequency table for Q5 (“5. Can you estimate your organization’s market share, countrywide?”) and Q9 (“9. Did you observe any of the following in clients’ demand?”).

	Steep demand decline	Steep demand surge	Irregular patterns (e.g. peaks and valleys)	No significant changes	I don’t know/not applicable	Other (please specify below)	N/A	total
0–10%	6 (5.08%)	1 (0.85%)	8 (6.78%)	8 (6.78%)	3 (2.54%)	0 (0.0%)	1 (0.85%)	27 (22.88%)
11–25%	4 (3.39%)	2 (1.69%)	3 (2.54%)	4 (3.39%)	1 (0.85%)	0 (0.0%)	0 (0.0%)	14 (11.86%)
26–50%	1 (0.85%)	3 (2.54%)	1 (0.85%)	2 (1.69%)	0 (0.0%)	1 (0.85%)	0 (0.0%)	8 (6.78%)
51–99%	1 (0.85%)	3 (2.54%)	5 (4.24%)	2 (1.69%)	4 (3.39%)	0 (0.0%)	0 (0.0%)	15 (12.71%)
Monopoly	7 (5.93%)	3 (2.54%)	3 (2.54%)	4 (3.39%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	17 (14.41%)
I don’t know/not applicable	7 (5.93%)	2 (1.69%)	15 (12.71%)	12 (10.17%)	11 (9.32%)	2 (1.69%)	0 (0.0%)	49 (41.53%)
N/A	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
total	26 (22.03%)	14 (11.86%)	35 (29.66%)	32 (27.12%)	19 (16.1%)	3 (2.54%)	1 (0.85%)	130 (110.17%)

As far as Q10 (“10. Did you observe any of the following in your organization’s suppliers?”) [MS+null, semi-open] is concerned, the two problems manifested more often were transport/logistic issues (e.g. travel bans, border closures) (20.0%) and long delivery times (19.18%), followed by shortage of raw materials and shortage of personnel (13.42% in both cases). Options significant changes in prices and we were forced to switch to different suppliers were selected considerably often in the case of the health sector.

For both Q9 and Q10, some participants provided additional insights through the open response option. In the case of Q9, most observations referred to dual or patchy effects (e.g. decline in demand by industrial activities and increase of demand by households or, in the case of hospitals, decline in demand for surgical interventions and increase of demand for COVID-19 care services). For Q10, reported issues included the provision of essential materials and personal protective equipment, as well as problems in the area of transportation.

Next, we let the participants evaluate a list of concerns that, according to recent analyses and widespread debate, may significantly affect the organizations studied. In particular, we pinpointed the following aspects: staff unavailability; working hours limitations; site/area isolation; mobility restrictions; health & hygiene protocols; lack of emergency funding, lack of insurance coverage; technological deficiencies. Feedback on these topics was collected via Q11 (“11. How did the following internally affect your organization’s own production/operation?”) [8 * (Likert5+null)], see Table 4 for the associated descriptive statistics. Top concerns seem to include mobility restrictions and health & hygiene protocols, albeit with considerable differences in the structure of the distributions. On the opposite side, the number of (1)–(5) responses received for lack of insurance coverage was sensibly lower and displays a comparatively low mean value, followed by lack of emergency funding. A graphical illustration of the feedback received through this question is provided in Fig. 10 .

Table 4

Descriptive statistics for Q11 (“11. How did the following internally affect your organization’s own production/operation?”) computed over the sub-sample selecting options (1)–(5), per item.

	n	mean	variance	skewness	kurtosis
Staff unavailability	113	2.43	1.44	0.33	−0.85
Working hours limitations	113	2.38	1.68	0.55	−0.78
Site/area isolation	116	2.83	1.9	0.13	−1.18
Mobility restrictions	117	3.33	1.67	−0.3	−0.88
Health & hygiene protocols	115	3.31	2.13	−0.3	−1.33
Lack of emergency funding	95	2.14	1.76	0.88	−0.47
Lack of insurance coverage	75	1.69	1.62	1.7	1.45
Technological deficiencies	106	2.06	1.23	0.81	−0.24

Fig. 10

Percentages associated with answers to Q11 (“11. How did the following internally affect your organization’s own production/operation?”) in range (1)–(5).

Assessment of critical dependencies

It is finally interesting to evaluate the participants’ assessment of the most critical input dependencies as observed through Q12 (“12. In the context of the ongoing pandemic, what are the most critical external dependencies for your organization?”) [MS, semi-open], where we made reference to the same list of sectors we proposed in Q2. Herein, as illustrated in Table 5 , a cumulative amount of 351 options were selected, thus averaging 2.97 items per participant. 47.46% of the participants indicated as a critical external dependency ICT infrastructure and services, which stands in the top tier followed by transport and logistics (42.37%) and electric utilities (38.14%). Another important cluster of dependencies is represented by public safety and civil protection (31.36%) and the health sector (27.12%). We received particularly abundant feedback from respondents operating in the water sector, followed by those in university and research, public safety and civil protection, health sector and electric utilities. In Fig. 11 , we report a diagram representation of the dependencies resulting when jointly considering the single-sector-Q2 sub-sample. Further critical dependencies indicated through the open response field include, for instance, those related to products and goods manufactured in specific countries, as well as the supply of personal protective equipment, chemical and medicinal products.

Table 5

Frequency table for Q12 (“12. In the context of the ongoing pandemic, what are the most critical external dependencies for your organization?”).

	frequency
Banking and financial services	19 (16.1%)
Chemical industry	16 (13.56%)
Critical manufacturing	19 (16.1%)
Electric utilities	45 (38.14%)
Food production and distribution	7 (5.93%)
Health sector	32 (27.12%)
ICT infrastructure and services	56 (47.46%)
Mining and quarrying	0 (0.0%)
Nuclear sector	7 (5.93%)
Oil and gas utilities	12 (10.17%)
Public safety and civil protection	37 (31.36%)
Space and defense	5 (4.24%)
Transport and logistics	50 (42.37%)
University and research	19 (16.1%)
Water utilities	16 (13.56%)
Other (please specify below)	10 (8.47%)
N/A	1 (0.85%)
total	351 (297.46%)

Fig. 11

Chord diagram representation of reported dependencies according to Q12 (“12. In the context of the ongoing pandemic, what are the most critical external dependencies for your organization?”) subject to single-sector-Q2 sub-sample filtering. For each sector, it is possible to appreciate the total number of input and output dependencies (associated circular arc) as well as the inbound (different-color edges) and outbound (same-color edges) dependencies. Observe the presence of self-loops. (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this article.)

Emergency management and disaster recovery

Business continuity planning

In Q13 (“13. Does your organization have a Business Continuity Plan to face emergency?”) [SS+null], the vast majority of survey participants declared that a Business Continuity Plan (BCP) is in place, either at the organization level (53.39%) or for specific departments or functions (29.66%), while 11.86% of responses indicated that it does not exist and the rest specified the null option. Combining this piece of information with the responses to Q3, we can observe that organization-level BCPs prevail within the categories of public authorities (64.29% of cases) and industries or operators of essential services (53.85%), while they are more limited in the case of universities and research institutes (34.62%), and drop in the case of consultancies (16.67%). The situation reverts when the absence of a BCP has been declared, with consultancies topping the list (50% of cases) and followed by universities and research institutes (23.08%). See also Table B.12 for further details.

Table B.12

Combined frequency table for Q3 (“3. What type of organization is yours?”) and Q13 (“13. Does your organization have a Business Continuity Plan to face emergency?”).

	YES, at the organization level	YES, for specific departments or functions	NO, it does not exist	I don’t know/not applicable	N/A	total
Industry or operator of essential services	21 (17.8%)	16 (13.56%)	2 (1.69%)	0 (0.0%)	0 (0.0%)	39 (33.05%)
Consultancy	1 (0.85%)	2 (1.69%)	3 (2.54%)	0 (0.0%)	0 (0.0%)	6 (5.08%)
Public authority	18 (15.25%)	6 (5.08%)	3 (2.54%)	1 (0.85%)	0 (0.0%)	28 (23.73%)
University and research institute	9 (7.63%)	7 (5.93%)	6 (5.08%)	4 (3.39%)	0 (0.0%)	26 (22.03%)
Other (please specify below)	14 (11.86%)	4 (3.39%)	0 (0.0%)	1 (0.85%)	0 (0.0%)	19 (16.1%)
N/A	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
total	63 (53.39%)	35 (29.66%)	14 (11.86%)	6 (5.08%)	0 (0.0%)	118 (100.0%)

Another insight of interest comes from cross-checking the responses to Q13 with those to Q6. To this end, ruling out Q6’s null option, we qualified Q6’s options NO and YES, somehow as indicators of a situation perceived as milder. Then, we observed how, overall, such milder perceptions were more common in the presence of an organizational level BCP or department/function-specific BCP than under no BCP. Similar considerations can be done with respect to the most optimistic options from Q7 (it is improving, it is stable). The comparison between Q13 and Q7 confirms a stable situation during the previous two weeks for companies who have implemented a BCP (62% at the organization level, 54% for specific departments or functions), while the absence of a BCP is associated with worse perceptions about the evolving situation. This suggests how BCPs may have had a significant role in mitigating service supply disruptions and keeping businesses running over time.

Collaboration mechanisms, emergency management and disaster recovery tools

We then addressed collaboration mechanisms, through the semi-open categorization proposed in Q14 (“14. Is your organization implementing any of the following collaboration mechanisms?”) [MS+null, semi-open]. Here, support to public services (e.g. priority service to healthcare facilities and emergency services) tops the list (50.0%), followed by support from public services (e.g. civil protection, emergency medical services, fire, police) (33.9%) and business to business coordination (e.g. staff sharing, flexible contracts, solidarity initiatives) (32.2%). Some additional mechanisms were also indicated through the open response option, especially in the area of water supply (cooperation between different water suppliers, mechanisms for ensuring affordability of the water services for users). An interesting observation comes from the comparison of Q14 and Q13; here, over half of respondents whose organization does not implement a BCP at all chose option I do not know/ it cannot be said, which is substantially higher than in the other cases.

In Q15 (“15. Which tools does your organization use for disaster prevention and early warning?”) [MS+null, semi-open], official guidelines and recommendations were selected by 77.12% of respondents, resulting well above all other listed tools; see Fig. 12 for further information. Open responses indicate cases of organizations exploiting internal data and models or, in the case of public bodies, relying on the general governmental disaster prevention framework or even contributing to the design of state-level CI plans.

Fig. 12

Sorted frequencies associated with Q15 (“15. Which tools does your organization use for disaster prevention and early warning?”).

Emergency monitoring, as per Q16 (“16. Which channels does your organization follow for emergency monitoring?”) [MS+null, semi-open], is most often performed through internal/inter-institutional/sectoral monitoring mechanisms (76.27%) and country-level public media releases (71.19%), while to a minor extent on the basis of notifications by international agencies or bodies (56.78%). On the other side, from Q17 (“17. Is your organization implementing any of the following communication mechanisms to cope with emergency?”) [MS+null, semi-open] we measured how 85.59% of the participants indicated internal COVID-19 communication plan (e.g. health guidelines and posters for personnel), while 70.34% communication with authorities (e.g. status updates to emergency and healthcare services) and 56.78% external COVID-19 communication plan (e.g. emails and FAQs for clients and suppliers). Combined with Q13, Q17 indicates that the three mentioned communication mechanisms were accessed in a balanced manner by the respondents who declared an organizational-level BCP; category External COVID-19 communication plan (e.g. emails and FAQs for clients and suppliers), instead, dropped comparatively in the case of department- or function-level BCPs and zeroed in the case with no BCP in place. Once again, in the latter case a considerable percentage of responses (37.5%) consisted of the null option.

Sustainability of emergency restrictions and recovery

In Q18 (“18. In your opinion, can your organization sustain the current regulatory emergency restrictions?”) [SS+null], the majority of participants declared the ongoing regulatory emergency restrictions as sustainable at least for a few months (68.64%), while 27.12% of the participants reported sustainability but only in the short term and a limited 1.69% chose the NO option. A more detailed screening highlights how for some of Q2’s sectors (including the health sector and transport and logistics) the two former options get closer to a balance, suggesting reduced longer-term sustainability.

As a complement, we queried the participants on their expected back-to-normal recovery time, via Q19 (“19. If relevant, can you estimate how long your organization would take to get back to business-as-usual, after the COVID-19 emergency phase?”) [MS+null, semi-open]. The majority of respondent indicated, in this case, days to a few weeks (55.93%), followed by longer time horizons (e.g. months) (28.81%) and I don’t know/it cannot be said (10.17%). Free-field answers included other interesting insights on how recovery would be expected to be (ranging from not needed or immediate to taking years or being dependent on people’s behavior). Relating Q19 and Q18, we also noticed how 61.73% of those who declared sustainability at least for a few months also indicated an expected recovery time of days to a few weeks, which is considerably higher than the 43.75% of those who reported sustainability only in the short term.

In Q20 (“20. Is your organization implementing any of the following measures to prepare recovery?”) [MS+null, semi-open] we received an extensive feedback with a cumulative amount of 505 options selected, see Fig. 13 for a frequency ranking. By far, those indicated more frequently were change in working conditions (e.g. work shifts, use of smart working) (80.51%) and use of personal protective equipment (79.66%), followed by a second cluster of measures including the deployment of physical barriers (54.24%) and activity delocalization (51.69%). In a non-negligible number of cases, the range of initiatives expanded considerably, including for instance the appointment of emergency/pandemic coordinators (e.g. task force) (39.83%), the support to the well-being of personnel (e.g. leave policies, health insurances) (38.14%), health checks/immunity passports (27.97%) and workforce training initiatives (27.12%). More modest were, instead, the reported uses of workforce contact-tracing apps/technologies (12.71%) and activity outsourcing (8.47%). Extra items mentioned by the participants via the open response option include measures related to remote meeting tools and health condition control.

Fig. 13

Sorted frequencies associated with Q20 (“20. Is your organization implementing any of the following measures to prepare recovery?”).

Professional activity

Finally, we asked survey participants baseline information on their professional activity and the impacts of the emergency on their daily work. In Q21 (“21. In your organization, what is your main activity?”) [SS, semi-open], the larger portion of survey participants declared themselves as employees or managers (38.14% each), while consultants accounted for 11.86% of the respondents and the rest autonomously specified their role. According to Q22 (“22. How was your daily work most affected by the emergency?”) [MS, semi-open], the most commonly observed impacts were about a different work arrangement (e.g. smart working) (45.5%) or a different workload (32.28%), followed by a change in responsibility/role (13.23%) and no significant changes (6.35%). Some such considerations hold vertically with respect to professional categories, see Table B.13 for further information.

Table B.13

Combined frequency table for Q21 (“21. In your organization, what is your main activity?”) and Q22 (“22. How was your daily work most affected by the emergency?”).

	Change in responsibility/role	Different workload	Different work arrangement (e.g. smart working)	No significant changes	Other (please specify below)	N/A	total
Employee	14 (11.86%)	24 (20.34%)	36 (30.51%)	5 (4.24%)	0 (0.0%)	0 (0.0%)	79 (66.95%)
Manager	5 (4.24%)	23 (19.49%)	33 (27.97%)	2 (1.69%)	3 (2.54%)	0 (0.0%)	66 (55.93%)
Consultant	4 (3.39%)	6 (5.08%)	10 (8.47%)	2 (1.69%)	2 (1.69%)	0 (0.0%)	24 (20.34%)
Other (please specify below)	2 (1.69%)	8 (6.78%)	7 (5.93%)	3 (2.54%)	0 (0.0%)	0 (0.0%)	20 (16.95%)
N/A	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)	0 (0.0%)
total	25 (21.19%)	61 (51.69%)	86 (72.88%)	12 (10.17%)	5 (4.24%)	0 (0.0%)	189 (160.17%)

Complementary, open comments touched upon topics such as the impact of reduced contact, travel restrictions, remote working, and availability hours.

Personal comments

A set of very interesting comments and reflections were provided by the survey contributors throughout the last section of the questionnaire. We focus, in particular, on the complementary comments, where we asked participants to optionally indicate any further actions taken, insights and recommendations based on their personal/their organization’s experience gained during the emergency. Next, we report a selection of texts:

“1. Insight: There seems to be a disconnect between processes that generate innovative ideas as exit-strategies on the one hand, versus processes that determine ethical and legal guidelines. This leads to a state of paralysis. 2. Insight: Critical infrastructure is critical because it provides essential services. The pandemic forces a reevaluation of what is essential, e.g. child care services for staff with children. 3. Insight: Life as we knew it has virtually stopped. Apparently we have a significant gap in the architecture of our “critical” infrastructure, otherwise it would not have come so far. What is that gap exactly (e.g. large scale testing)? And how can existing infrastructure help fill that gap in the short term? What type of architectural changes are required in the longer term?”

“Staff created volunteer network for supporting the needs of public hospitals and services.”

“Increased small scale funding opportunities are even more important now to keep SMEs and the self-employed in business.”

“We perceive COVID-19 as a strong driver for digital innovation and are sure that new 'business as usual' will differ from the past and will include more working from home.”

“Splitting of personal and the possibility to decentralise the SCADA system was very important for the safety and stability of the water supply.”

“The elaboration of Business continuity and crisis management plans allow organizations to respond more quickly and in a more organized way. The definition of pandemic management offices, at the different levels and businesses of the company, has allowed an alignment of the actions taken. Communication plays a fundamental role in supporting top management decision making.”

“During the last months, I consider that the majority of the public organisations such as universities, research centres and administration realised the importance of the Business Continuity Planning (BCP), and its introduction in their Management Systems and Strategic Planning. That will be as much successful as the daily inclusion (in a form of the PDCA cycle) of core activities (and culture), namely of risk management, emergency management, disaster prevention and recovery at all the levels of their services (curriculum/education, administrative, technical support and IT infrastructures). BCP could be established as part of the HE accreditation framework or of their quality performance assessment [...]. Moreover, after the lessons learned from the COVID-19 lockdown and crisis, organisations could systematically be engaged in (but not limited to): a. Promoting common ground for cross-organizational collaboration in crisis management b. Noticing fragility c. Communicating strategies for interacting with the public (students and their families, suppliers, stakeholders in general) d. Introducing and applying design thinking principles and/or self-awareness, situational awareness. […]”

“We implemented measures that proved to be very productive, work from home, delivery of medicines to senior citizens and citizens at risk […]. Due to the lack of manpower, we shortened the working hours of pharmacies. In the future, we see an advantage in online sales, drive-in dispensaries in pharmacies and virtual shelves in pharmacies, where patients choose their own products and have minimal contact with the pharmacist.”

Discussion and perspectives

During the last months, due to the COVID-19 pandemic, Europe has faced several challenges. In CIs, these include those related to human resources, technologies and the availability of essential equipment. Additionally, businesses were affected by radical supply disruptions, delivery delays and shortages. Some interesting observations can be made from the results of survey “COVID-19: Emergency & Business Continuity”, which gathers the perspectives of professionals operating in the domain of CIs at large.

Specific sectors have been hit more severely with respect to the rest, such as in the case of transport and logistics. This is in line with mainstream perceptions concerning the impact of the COVID-19 crisis. What is even more interesting is to expand the reflection on impacts by considering their different dimensions, as illustrated for instance in Section 4.2.2. In this sense, we can observe how demand by clients and service by suppliers have both been considerably affected, yet with appreciable distributional differences. Also, when these dimensions are related to internal production/operation, they confirm the importance of interdependencies between industries and infrastructures providing essential services. A possible follow-up survey could help to better understand if and how similar interdependency aspects were already part of the existing emergency management and disaster recovery plans.

As discussed in Section 4.2.3, our survey also allowed us to better explore the dynamic dimension of interdependencies and to rank factors affecting internal production and operation. In the latter sense, the prominent concerns included mobility restrictions as well as hygiene and hygiene protocols. Similar rankings can be the seed for further investigation, notably to relate different safety and security protocols with their implementation in lean and highly optimized operational contexts. The responses might also implicitly reflect the discontent of operators/owners who have to bear the costs of implementing such protocols or struggle to ensure flexibility with respect to a rapidly evolving situation.

In terms of dependencies between sectors, there is practically no surprise from the abundance of the answers confirming the dependency of the modern economy - including CIs - on ICT, logistics/transport and electric utilities; see Section 4.2.4. Interestingly, one out of four answers indicated health services as an important dependency. Further study is needed in order to identify whether this aspect was thoroughly addressed in emergency management and disaster recovery plans, in particular in the private sector. Moreover, in some cases dependencies on some fundamental sectors may have been omitted by the respondents because obvious or maybe less evident.

In Section 4.3.1, we collected statistics on the implementation of business continuity plans and observed its correlation with criticality perceptions, both in terms of the current situation at the time of compiling and in perspective. Moreover, in Section 4.3.2 we assessed and ranked the use of different collaboration mechanisms, emergency management and disaster recovery tools. Such information, which also accounts for innovative solutions (e.g. workforce contact-tracing apps/technologies), may serve to detect gaps in current practices and areas of improvement.

Finally, one of the most interesting sections of the questionnaire refers to the sustainability of restrictions and to recovery. The answers elaborated in Section 4.3.3 indicate an important majority of organizations as able to sustain restrictions for relatively long periods and also recover quickly after the crisis. To deepen such resilience-oriented analysis of the CI sectors, future research and data collections could help to better understand the role of the absorptive, adaptive and restorative capacity in coping with the COVID-19 emergency.

To conclude our discussion, next we propose some reflections and perspectives resulting from the survey initiative discussed so far.

Emerging challenges

As observed in OECD (2003), “business continuity throughout society depends to a large extent on the ability to avoid disruption to vital systems such as the health system, water and energy supplies, administration and public security, transportation, communication, etc.”. The effectiveness of measures taken within the CI businesses is, therefore, able to affect business continuity at large.

Overall, the results of survey “COVID-19: Emergency & Business Continuity” are encouraging, in the sense that many organizations reported about have taken appropriate measures to address the COVID-19 crisis. At the same time, several concerns that emerged during the last months may affect emergency and business continuity management in CIs.

Beyond the change in demand/supply patterns and internal workforce availability of each organization, it is worth considering the ongoing discussion on our reliance on global supply chains and the opportunity for reshoring. The pandemic has revealed, indeed, several gaps including

disruption to labor across supply chains;

disruption or delays in the movement of goods and raw materials, resulting from instance from workforce unavailability or travel restrictions.

This also connects with the theme of interdependencies and interdependence-mediated shock transmission addressed in our survey. Beyond supply chain transformation, these observations may have important implications on the need for investments in areas such as systemic stress testing (e.g. to better understand the implications of third-party vulnerabilities and failures) and supply chain visibility (e.g. to better monitor long and complex production chains).

Another challenge faced by CIs during the COVID-19 pandemic is about simultaneously keeping awareness and preparedness for other kinds of hazards, such as natural hazards (Clark-Ginsberg et al., 2020). Notably, over the last few months, several actors took advantage of CI cybersecurity vulnerabilities. Among the most affected there was the healthcare sector, which faced several cyber-attacks and security incidents worldwide. 6, 7 See for instance (Lallie et al., 2020) for a report on healthcare cyber-threats that emerged during the pandemic. Also, in the emergency context CIs may be affected by hybrid threats (Bordin et al., 2019) aiming at objectives such as undermining public trust in governments and other institutions.

Development of resilience metrics and indicators

It is in the interest of the community to identify vulnerabilities and other key factors affecting CI resilience with respect to adverse events. In recent years, the scientific community is especially focusing on systemic variables able to describe complex infrastructures in terms of resilience metrics and indicators. Such an approach can be important in many phases of emergency management, including for instance resource allocation, real-time monitoring and decision making.

The level to which countries and CI-related organizations are exposed to the COVID-19 shock also depends on a plethora of structural features, market and operational conditions. Naturally, this complicates the development of the mentioned kind of indicators. A recent contribution in this sense is (Jovanović et al., 2020), which proposes resilience indicators mainly deriving from current practices for assessing critical healthcare infrastructure resilience to COVID-19.

Similarly, our survey was elaborated taking into account some key resilience metrics and indicators from the literature. Symmetrically, the data collected can help to assess the significance of such indicators as perceived by the respondents as well as a means towards the advancement of this research stream. To this end, also the open comments received from the participants represent valuable insights, often grounded on practices and actions actually implemented during the first months of the COVID-19 crisis.

Role of Public-Private Partnerships

The role of public-private partnerships (PPPs) for critical infrastructure protection (CIP) has been a focal point in recent years, both in policy initiatives and as a research subject. (Dunn-Cavelty and Suter, 2009) examines PPPs as one of the tools enabling a better balancing between the negative and positive effects of liberalization, privatization and globalization of infrastructure. The authors elaborate on the role of shared responsibility in interdependent infrastructures, whose shared risks can only be prevented through joint risk management and information sharing between actors (see also (President's Commission on Critical Infrastructure Protection, 1997)). The authors also propose a broader concept of public-private cooperation, reflecting on some key difficulties sometimes registered in CIP-related collaborative initiatives. This moves towards a network governance approach, resulting from progressive specialization, which extends beyond the mere concept of partnership. Further discussion can be found in Abele-Wigert, 2006, Gopalan, 2016, including different stakeholder perspectives and reports on experiences gained on the field.

During the COVID-19 emergency, priority care channels and service lines have been established by several suppliers, especially for healthcare facilities and other essential services, offering in many cases free supplies and technical assistance. Resource sharing has been promoted worldwide by multinational technological companies, for instance providing communication tools to medical services on the frontline. Also, knowledge-sharing initiatives through open-access platforms have been set up in CI networks, leading to a broader exchange of risk management practices and mitigation measures implemented while dealing with COVID-19 crisis. Therefore, based on various COVID-19-related collective experiences, PPPs and affine initiatives have represented a relevant strength element to foster CIP towards better governance and mutual support, especially in times of emergency.

In itself, the survey initiative this document reports about can be considered as the result of a collaborative effort, wherein the ERNCIP community has assessed the ongoing situation and contributed data significant for future developments in many areas related to emergency and business continuity.

Concluding remarks

It is still early to determine how the ‘new normal’ will be like and how the COVID-19 pandemic will change the CI landscape in the long run. To better track and comprehend such transition, in this study we tried to identify the overall response of CIs across the spectrum of sectors represented in the ERNCIP community while focusing on a specific phase of the COVID-19 crisis.

Our study, tailored for that community, is cross-sectoral and some of the sectors have limited representativeness. At the same time, our results allow a screening of comparative differences in perceptions inside quite an extensive community of CI professionals. Beyond registering the perceived situation, our analysis has a forward-looking scope. Indeed, the results of this study can help towards a deeper understanding of emerging approaches, needs and gaps as manifested by different organizations.

It is of paramount importance for the scientific community to draw lessons from this crisis by collecting, analyzing and making sense out of data. As it is often quoted, never waste a good crisis; the COVID-19 crisis is simply too costly, destructive and transformative to be wasted.

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.