Defense & Strategic Security Systems

SECTION 01

Domain overview and system boundary

Strategic resilience should be framed around civilian functions whose loss would seriously constrain public wellbeing or recovery. Define minimum service, the population depending on it and the relevant time horizon. An asset is important because of what it enables, not simply because it is large or expensive. The case boundary should include essential supporting services and legitimate public responsibilities. This framing allows comparison of preparedness choices without disclosing sensitive live-system details or drifting into operational security tactics. [D10] Choose one essential function and explain the consequences of its interruption for different population groups.

This library addresses the civilian, public-interest governance of strategic dependencies and essential-service resilience. It examines continuity of water, energy, health, communications, logistics and legitimate public decision-making under severe disruption. The relevant unit is a function and its dependent population, not a list of protected assets. Analysis remains at the level of resilience, preparedness, lawful coordination and recovery; it does not provide weapons, targeting, offensive operations or tactical instructions. [D01] [D21]

Strategic importance arises when a function has few practical substitutes, supports many other services or is needed before recovery can begin. A disruption may be natural, accidental, technological or deliberate; the protection of civilians and continuity of essential services remain the common analytical concern. Hazard likelihood, service consequence and recoverability should be distinguished. An improbable disturbance can justify attention when its consequences are severe and its recovery constraints are difficult to reverse. [D04] [D07]

The educational case should define a public-service objective, affected groups, plausible initiating disturbances, lawful responsibilities and a bounded information policy. Public learning should focus on aggregate service consequences and governance choices. Sensitive details about live systems require appropriate custodianship and are unnecessary for demonstrating the central methods. Comparative case evidence supports analysis of common-cause exposure, dependencies, warning interpretation and recovery sequencing without implying that different crises have identical causes. [D03] [D12]

A domain label is not yet a case boundary. Separate the condition of a resource or asset from the function delivered to users. A nominally available installation may fail to deliver usable service, and a system-wide average can conceal localized loss. Preserve the original physical or institutional unit alongside any normalized representation. The boundary should make it possible to ask what enters, what changes, what leaves and who experiences the consequences.

Section readings [D10]

SECTION 02

Historical development and changing conditions

The resilience literature distinguishes reliability under expected conditions from the ability to maintain, adapt and recover function under disruption. These concepts developed partly because severe events exposed the limits of isolated asset protection. More redundancy does not always mean more independence, and faster recovery does not establish that the recovered state is safe or equitable. Historical analysis should identify the functional objective, conditions exceeded and adaptations observed. This creates a disciplined basis for comparing cases rather than treating resilience as an all-purpose favorable label. [D05] Compare robustness and recovery in one service and explain why each needs different evidence.

A historical baseline must be examined for changes in exposure, technology, operating practice and observation. Compare episodes using their mechanisms and evidence, rather than treating all events with a similar label as exchangeable observations. A reconstruction should show what was known at each time; later explanations should not be presented as information available to the original decision maker. Recovery and long-term change may require a separate timeline from the initiating incident.

Section readings [D05]

SECTION 03

Actors, institutions and decision responsibilities

The institutional map should distinguish operators, regulators, public authorities, service users and independent technical reviewers. Their responsibilities may overlap, but their powers and evidentiary duties differ. Coordination requires specific interfaces for warning, shared assessment, resource requests and restoration verification. No analytical framework substitutes for lawful authorization. Record who can make a decision, who can implement it and who can challenge or review it. Include affected communities because continuity priorities can distribute disruption and recovery very unevenly. [D06] Identify one decision requiring several organizations and show where final lawful responsibility lies.

Map actors by the function they perform and the responsibility they actually hold in the case. The same organization may observe a condition, supply a service and participate in a decision; those roles should remain distinguishable. Examine information access, resources, expertise, affected users and accountability together. A list of institution names is not an operating governance arrangement. Record the evidence for each responsibility and the process for resolving a disagreement or correcting a record.

Section readings [D06; C07]

SECTION 04

Primary systemic risks

Primary risks threaten the ability to maintain an essential civilian function. A single-source input, unusable backup or absent specialist can become consequential when ordinary alternatives fail. Assess each mechanism against minimum service and the time available for correction. The inventory should distinguish initiating disturbances from weaknesses in preparedness and recovery. Describing every threat as catastrophic obscures prioritization; identify the pathway, exposed population and practical margin. A risk becomes actionable when evidence can inform a defined responsibility or intervention. [D01] Distinguish a severe hazard from the dependency that converts it into prolonged service loss.

The inventory is a structured set of research hypotheses. It separates a threatening condition from the mechanism of loss and from its consequences. The proposed TFP association indicates which question to investigate; it is not evidence that a particular indicator predicts the event. Risk importance depends on the defined function, exposure, duration and usable alternatives. Do not infer frequency, severity or priority from the position of a row in the table.

Section readings [D01]

SECTION 05

Amplification mechanisms and secondary risks

Amplifiers increase the consequence or duration of an initiating disturbance. Shared geography can affect both primary and backup capacity; fatigue can reduce the workforce needed for recovery; inconsistent guidance can increase avoidable demand. These interactions are conditional and should be supported by a plausible sequence. Avoid assuming that the simultaneous failure of two services proves a causal dependency between them. Common exposure and direct propagation require different remedies and different evidence. [D03] Trace one amplification loop and identify a feasible civilian measure that interrupts it without shifting harm elsewhere.

An amplifier changes the consequences of an initiating condition without necessarily causing the initiating event. Useful counterfactuals hold the threat constant and vary concentration, maintenance, access, information or response capacity. Document the mechanism and the observation that would distinguish it from an alternative explanation. Several amplifiers may share the same upstream cause; counting each one as independent evidence exaggerates confidence.

Section readings [D03]

SECTION 06

Emerging risks and research horizons

Emerging strategic dependencies often result from beneficial transitions. Electrification, cloud services and automated situational awareness can improve ordinary performance while concentrating dependence on shared systems. Evaluate changes in usable alternatives, common-cause exposure and oversight rather than treating novelty as inherently dangerous. Update the dependency inventory when a service changes its operating model. A new capability should be assessed against the public function it supports and the evidence needed to verify continuity under stress. [D13] Identify an efficiency improvement that also changes the system's failure and recovery relationships.

A research horizon is tied to the time needed to investigate, prepare or change a system. It is not a date at which an emerging threat is predicted to occur. Record the reason for concern, the strength of evidence, the exposed function and the observation that would change the priority. Distinguish a newly observed mechanism from a known mechanism whose exposure, scale or institutional context is changing.

Section readings [D13]

SECTION 07

Cascades and cross-domain dependencies

Cascade analysis follows a disruption through directional functional links. Electricity loss may interrupt communications, which can delay coordination and extend other service outages. The pathway needs timing, an enabling mechanism and evidence that the dependent function lacks a suitable alternative. Abstract network models can reveal possible systemic behavior but do not supply empirical probabilities for a particular city or service network. Preserve the difference between a conceptual cascade and a verified historical sequence. [D02] Construct a short service-loss pathway and identify the observation needed to verify each link.

Interdependence transmits service loss through physical supply, information exchange, shared geography or decision rules. These pathways require different evidence. A common storm can affect several facilities simultaneously without a causal link between them, while loss of electricity can directly disable another service. Keep those mechanisms distinct. [D01]

Criticality depends on function, time and affected population. The same asset can be substitutable during ordinary demand and indispensable during an emergency. Assess minimum service, available alternatives and the period over which substitution remains feasible. Asset counts alone do not establish strategic importance. [D10]

Common-cause disturbances can defeat nominal redundancy. Two suppliers may share a region, transport route, technology platform or parent company. Evaluate independence at the level of plausible failure mechanisms rather than assuming that different names or facilities provide separate protection. [D02]

For each directed dependency, specify the function supplied, the destination, the propagation time and the substitute. Shared-cause failure, interacting threats and cascading propagation are different structures. A directed arrow becomes an explanatory claim only when the timing and mechanism are supported. Test apparent redundancy by removing the common access route, platform, energy supply or specialist on which both alternatives depend.

Section readings [D02; C01; C02]

SECTION 08

Readiness and response protocols

Continuity protocols should define the minimum civilian function, evidence thresholds, responsible roles and review conditions. A prewritten plan is not demonstrated capability until its assumptions have been tested. Include degraded operation, accessible public communication and conditions for pausing an unsafe restart. Protocols should remain usable when ordinary staffing or communication is impaired. Public-facing material can explain these principles and aggregate outcomes without exposing sensitive configurations or details of live-system vulnerabilities. [D07] Test whether the protocol can still deliver its minimum function when one assumed supporting resource is absent.

Preparedness connects a signal to a responsible actor, an available measure and a condition of completion. This learning architecture does not grant emergency command or operational authority to the c-ECO Institute or a course participant. A useful protocol distinguishes checking the signal, protecting exposed functions and verifying recovery. A paper plan contributes to usable capacity only when its relevant assumptions have been tested.

Section readings [D07]

SECTION 09

Scientific review and decision records

Escalation should occur when consequences or recovery needs exceed the authority or capability available at the current level. Specify the information transferred, the lawful receiving role and the continuing responsibilities of the originating operator. Technical review should challenge assumptions and verify restoration claims without silently acquiring operational command. Record material disagreements and interim safeguards. The process must be proportionate to the public consequences and preserve civilian rights, especially when emergency measures restrict ordinary access or movement. [D21] Identify the evidence that justifies escalation and the condition under which responsibility returns to ordinary arrangements.

A review record separates observation, inference and decision. Record the data version, methods, alternative explanations, relevant expertise, conflicts of interest and unresolved disagreement. Review should be matched to the question and its consequences. Scientific analysis can inform a competent actor without replacing that actor’s mandate. No membership size, quorum or institutional power is established by this teaching library.

Section readings [D21; C05; C07]

SECTION 10

Communication and observation continuity

Communication supports protective action only when people can receive, understand and use the guidance. Shared operational information and public messages have different purposes and access requirements. Keep time, geographic scope, uncertainty and required action clear. Contradictory versions should be corrected visibly. Include channels that remain accessible during digital or electricity disruption, and test their reach with affected communities. Message volume is a poor proxy for effective communication when people lack feasible means to comply. [D06] Evaluate a continuity message from the perspective of someone without reliable internet access or private transport.

Continuity of observation should be tested alongside continuity of the function itself. Losing data may increase uncertainty before the physical process visibly changes. Redundancy must be demonstrated against common causes, including power, location, communications, credentials and specialist availability. During disconnected operation, preserve the last reliable observation, record the uncertainty that follows and reconcile timestamps and authorship when information paths return.

Section readings [D06; C01]

SECTION 11

International instruments and technical references

International frameworks can guide civilian preparedness and cooperation without granting powers to an educational project. The Sendai Framework emphasizes understanding risk, strengthening governance, investing in resilience and improving preparedness and recovery. Its use should be linked to the case's actual institutional arrangements and applicable law. Cross-border essential-service dependencies require attention to information sharing, mutual assistance and public consequences. Distinguish binding commitments from policy guidance and voluntary technical practice before deriving operational implications. [D21] Map one relevant international instrument to a concrete civilian responsibility while preserving its legal status.

Classify each instrument before using it. A scholarly article supports an inference, a technical guide describes a method, a standard has a defined scope, and a legal instrument may create obligations only where applicable. The case record should identify the specific provision or method, its version and the activity to which it relates. A source’s institutional reputation cannot by itself establish applicability or demonstrate compliance.

Section readings [D21]

SECTION 12

Jurisdiction-specific responsibilities and requirements

Domestic arrangements define responsibilities for essential services, emergency coordination, public information and protection of rights. These vary by jurisdiction and sector. An asset operator's duty, a regulator's oversight role and an emergency authority's powers should not be conflated. The case should identify current authoritative sources and seek qualified interpretation where necessary. Scientific analysis can compare consequence and recovery options, but the selected action must remain within lawful responsibility and review procedures. [D16] Compare who owns the infrastructure, who operates the service and who can authorize an extraordinary measure.

The register should cover the actual activity and location, including interfaces between organizations and jurisdictions. Separate responsibility for observing, supervising, deciding and executing. Retain the official source, version consulted and evidence needed to assess a condition. Conflicting definitions and overlapping mandates are analytical findings to investigate. A general library cannot create a universal legal threshold for all settings.

Section readings [D16]

SECTION 13

Causation, accountability and cascading consequences

Accountability continues during severe disruption. Urgency may justify defined temporary arrangements, but their purpose, legal basis, duration and review should remain clear. Distinguish the immediate restoration decision from later investigation, remedy and institutional learning. Records should support reconstruction without exposing unnecessary sensitive information. A successful continuity claim requires evidence of service delivery and residual limitations, not only a declaration by the responsible institution. Affected people need accessible routes to report unmet needs and challenge errors. [D19] Identify one emergency decision whose consequences should be independently reviewed after minimum service is restored.

A technical chain of consequences is not automatically a legal allocation of liability. Separate evidence of causation from the duties, control and decisions relevant to each actor. A case may contain direct damage, dependent service interruption and persistent environmental or social consequences on different timescales. The analysis should show which links are documented and which need further investigation, without presuming an institutional restoration fund, mandatory levy or insurance mechanism.

Section readings [D19]

SECTION 14

Cross-boundary coordination

Transboundary dependencies can connect service users to suppliers and infrastructure outside their government's direct control. Cooperation may require agreed information, compatible assistance procedures and lawful arrangements for resource transfer. Geographic distance alone does not establish independence when suppliers share technology or upstream production. Evaluate how restrictions, transport interruptions or regional hazards could affect civilian service continuity. Public analysis should describe the dependency at the functional and aggregate level necessary for governance decisions, avoiding sensitive operational detail. [D13] Compare an apparent alternative supplier with the original and determine whether both share a critical upstream source.

Processes and dependencies often cross administrative, organizational or national boundaries. Coordination requires compatible definitions, useful timing, authorized exchange and an identifiable decision interface. Sharing data does not by itself resolve disagreements over objectives, risk allocation or resources. An exercise should expose which decision can be coordinated under existing arrangements and which would require an additional agreement or competent determination.

Section readings [D13; C07]

SECTION 15

Position (P): candidate observations

P should represent a defined margin to an unacceptable essential-service condition. Examples include usable water supply relative to minimum demand or staffed healthcare capacity relative to urgent need. Retain the units, affected population and service-quality requirement. Nominal capacity can overstate the margin when supporting electricity, personnel or access is absent. The chosen threshold should be identified as a service obligation, technical criterion or explicit scenario assumption. It is not established by the framework's terminology alone. [D10] Compare installed capacity with usable capacity under the stated disturbance and explain the practical difference.

P represents position relative to a specified loss of function. The raw observation, reference condition, direction of deterioration and boundary of failure must remain explicit. A candidate monotone transformation can help compare states within a defined case, but it does not establish the threshold or validate an aggregate index. Capacity, delivered performance and exposure may require different indicators even when they concern the same installation.

A didactic monotone transformation for an indicator that worsens as it rises is p = clip[(x − x_ref)/(x_failure − x_ref), 0, 1]. Reverse the direction for a reserve that deteriorates as it falls. The expression makes the reference points visible; it does not choose those points, prove comparability or establish an operational aggregate. Retain x in its original unit and justify the function separately for each case.

Section readings [D10]

SECTION 16

Velocity (ΔV): rates and trajectory

ΔV concerns how quickly the service margin is changing. Supply can decline while emergency demand accelerates, creating deterioration faster than either trend suggests alone. Estimate change over a window suited to the process and preserve noise and uncertainty. A restoration curve can include setbacks and unequal progress across groups, so a single average recovery rate may mislead. Connect velocity to a realistic action and mobilization time rather than treating a steep trend as self-explanatory evidence of imminent collapse. [D11] Compare the estimated time to minimum-service loss with the earliest feasible protective response.

ΔV describes direction and rate of change over a declared interval. Two systems at the same apparent position may have different reaction times because their trajectories differ. Compare rates using consistent units, observation windows and reference systems. Check seasonality, missing periods, reporting changes and process acceleration before extrapolating. A time-to-boundary calculation is conditional on its trajectory assumption; it is not a general forecast.

Section readings [D11]

SECTION 17

Uncertainty (σ): evidence and model limits

Uncertainty in strategic resilience includes incomplete dependency maps, limited disturbance data and uncertain human adaptation. These cannot all be represented by independent component-failure probabilities. Shared exposure and policy responses can dominate outcomes. Use scenario alternatives and sensitivity analysis to identify assumptions that change the decision. Acknowledge where empirical evidence is insufficient for a numerical likelihood. Decision quality depends on a transparent account of consequence, capability and uncertainty, not simply on the precision of a modeled risk score. [D09] Identify the uncertain assumption that most changes the priority among two continuity investments.

Uncertainty should be recorded by object and source. Measurement uncertainty, sampling limitations, parameter uncertainty, model structure, future scenarios and institutional ambiguity cannot be replaced by one unsupported percentage. More simulation samples can reduce numerical sampling error without resolving a missing mechanism. Identify which uncertainty changes the decision and which further observation, comparison or test could reduce it.

Section readings [D09; C06]

SECTION 18

Reversibility liquidity (Lr): usable recovery resources

Lr describes the constraints on recovering a minimum function after disruption. Specialist staff, compatible components, safe access, lawful authority and trustworthy records may all be necessary. Recovery is limited by the slowest required dependency, and several sectors may compete for the same resource. Different population groups can face different restoration times even when an aggregate service indicator improves. Report the sequence, usable alternatives and residual exclusions. Reopening an asset does not by itself demonstrate restoration of the civilian function. [D04] Identify one recovery resource whose absence would delay every other planned restoration activity.

Lr examines resources that can preserve, contain or recover the defined function within the relevant time. A resource listed in an inventory is different from a resource that is accessible, compatible, staffed and mobilizable. Record capacity, useful arrival time, duration, dependencies and evidence of testing. Avoid averaging away an essential bottleneck. Recovery of a service does not necessarily restore ecological condition, accumulated losses or public trust.

Section readings [D04]

SECTION 19

Stress scenarios and comparative strategies

Scenarios should compare meaningful combinations of disturbance and capability. Begin with a bounded service objective, then vary common-cause exposure, demand surge and the availability of alternatives. Include a scenario in which mutual assistance is constrained because neighboring regions are also affected. The purpose is to test decisions across plausible conditions, not to predict every possible crisis. A useful comparison reveals which assumptions drive performance and which measures preserve minimum function despite uncertainty. [D07] Identify a preparedness choice that remains beneficial across the scenarios and one that depends on favorable assumptions.

A stress scenario states the initiating condition, prior state, time sequence, exposed function, shared dependencies and feasible responses. Its purpose is to reveal when a strategy loses usefulness and why. Compare alternatives across several conditions, including absent substitutes and simultaneous demand. Scenarios should lead to observations, tests and resource questions; assigning a precise event probability requires a separate justified model and evidence.

Section readings [D07]

SECTION 20

Reproducible simulation and sensitivity analysis

Simulation should represent the service process needed for the question. A network model may show dependency structure, while a flow or queue model may better capture capacity and demand. State boundaries, time steps, resource constraints and correlations. Compare outputs against observed behavior or independent technical expectations where possible. Synthetic parameters remain exercise assumptions even when the computational result is reproducible. Numerical complexity should not conceal a missing physical or institutional mechanism essential to the civilian consequence. [D09] Explain why the selected model can answer the stated question and identify one question it cannot answer.

Simulation is an explicit transformation of assumptions. Input distributions, dependencies, parameter estimation, output definition and testing must be documented. Numerical convergence does not establish model validity. Examine sensitivity to the function used, the weights selected, dependence assumptions and conditions outside the fitting data. The reproducible laboratory below is a synthetic exercise, separated from SPS and from any claim about real-event frequency.

The factor loadings define association on the latent scale. Correlations after the nonlinear transform should be estimated from the simulated samples. Q is a teaching index and is not SPS. Its exceedance fraction concerns the generated sample under these assumptions; it is not the probability of a real event or a forecast over a stated number of years. A temporal forecast would require a separately specified process and observation model.

from random import Random
from math import log, exp, sqrt
from statistics import mean
rng = Random(1631332263)
m = [.72, .62, .40, .38]
s = [.40, .45, .30, .40]
a = [.65, .55, .35, -.45]
q = []
for _ in range(10000):
    g = rng.gauss(0, 1)
    x = []
    for mj, sj, aj in zip(m, s, a):
        z = aj*g + sqrt(1-aj*aj)*rng.gauss(0, 1)
        x.append(1/(1+exp(-(log(mj/(1-mj))+sj*z))))
    p, v, u, lr = x
    q.append(.35*p+.25*v+.15*u+.25*(1-lr))
q.sort()
print(mean(q), q[499], (q[4999]+q[5000])/2, q[9499])
print(sum(x >= .70 for x in q)/len(q))

Sensitivity exercise: remove the common factor, vary one dispersion, change the weight of recovery resources, and compare the ranking of the selected strategies. Then state which domain observations would be needed to replace each illustrative assumption. Use a suitable estimator when inputs are dependent; the common-factor experiment is a dependence check, not a claim that a particular Sobol estimator applies unchanged.

Section readings [D09; C03; C06]

SECTION 21

Restoration and performance verification

Recovery simulation should retain resource competition, prerequisites and service distribution. Restoring the largest asset first may not restore the most urgent civilian function. Compare strategies against the same minimum-service objective and realistic capability constraints. Track partial service, repeated interruption and the time until affected groups can actually use the service. Independent verification should test safety and integrity before declaring success. The modeled sequence informs review; lawful operators and authorities remain responsible for actual restoration decisions. [D10] Compare two restoration sequences and explain the tradeoff between aggregate speed and access for vulnerable groups.

Restoration follows prerequisites and verification conditions rather than a universal fixed clock. Tasks may proceed in parallel only where they do not compete for the same people, access, equipment or information. Protect essential functions while the critical path is addressed. Define what is measured before returning service, who can make that determination and which effects require continued observation after a technical restart.

Section readings [D10]

SECTION 22

Recovery provider capability

Qualification should follow the civilian task and its consequence. Infrastructure expertise, continuity planning, community access and public-law interpretation require complementary knowledge. Ask contributors to demonstrate relevant methods, explain limits and disclose material interests. An organization that supplies a recovery resource may provide useful evidence without being an independent evaluator of its own performance. Preserve a separate route for challenge and verification. Public educational casework should use appropriate aggregate or historical information rather than depend on access to sensitive live configurations. [D12] Identify the expertise needed to verify minimum service and the expertise needed to assess unequal consequences.

Capability assessment must be specific to the task, place and stress conditions. A training certificate cannot demonstrate that a team can mobilize and deliver the required function. Inspect competence, safety, compatibility, relevant experience and actual availability. Define the verification method and limits of recognition. This teaching library does not establish a c-ECO provider certification scheme or substitute for professional or regulatory requirements.

Section readings [D12]

SECTION 23

Recovery sequencing and time constraints

Recovery sequencing starts with safe conditions and trustworthy information about the disruption. Stabilize enabling functions, establish accessible minimum services, verify integrity and then expand toward ordinary performance. Some tasks can proceed in parallel, but their shared resource constraints should be explicit. A temporary workaround may create later correction or maintenance needs; include those in the assessment. Durable recovery addresses the assumptions that failed, rather than returning without change to the same exposure and dependency structure. [D05] Distinguish what is necessary for safe restart from what is necessary for long-term restoration and improvement.

A recovery time objective is a decision criterion to test against real capacity. Distinguish mobilization, work, verification and decision time, and identify dependencies between tasks. Shared resources can prevent apparently parallel activities from proceeding together. Repeating the sequence with unavailable access, a specialist or a verification service reveals where a target relies on an untested assumption.

Section readings [D05]

SECTION 24

Equipment, inputs and replenishment

A continuity inventory should record function, usability, custodian, maintenance condition and deployment time. Counts alone can exaggerate readiness when resources share fuel, staff or access routes. Verify whether assistance is available under the same regional disturbance, and check compatibility before relying on replacement equipment or services. The inventory should be reviewed after exercises and material system changes. Public reporting can summarize readiness and limitations without disclosing sensitive quantities or configurations that are unnecessary for accountability. [D13] Identify two inventory entries that compete for the same underlying resource and correct the apparent capacity.

Inventory analysis connects each item to a protected function. Use condition, compatibility, accessibility and consumption under stress rather than a nominal stock count alone. Replenishment time must include procurement, transport, installation and verification where relevant. A substitute that depends on the same supplier or platform may disappear in the same event. Keep the last inspection date and the evidence supporting usable availability.

Section readings [D13]

SECTION 25

Mutual aid and cooperation arrangements

Mutual assistance works through clear requests, compatible capabilities and agreed responsibility. The receiving institution must be able to integrate support while protecting data and preserving lawful authority. Test not only deployment but also handback, record correction and the assisting organization's continuing obligations to its own population. Regional hazards can reduce availability simultaneously across partners. A robust case includes an alternative when expected assistance cannot arrive, with an honest account of the resulting minimum service and remaining needs. [D16] Test a support arrangement under a scenario in which the nearest assisting jurisdiction is affected by the same event.

Cooperation contributes to recovery when its scope, activation, resources and practical availability are demonstrated. Record who requests support, who authorizes it, the useful arrival time, responsibility for the work and conditions of return. Consider simultaneous demand across participants. A reference to an organization or network in the literature does not imply that c-ECO or a case partner has joined it or secured a deployment commitment.

Section readings [D16]

SECTION 26

Source classification and evidence quality

Classify sources by the evidentiary role they serve. A technical standard defines recommended practice, an operational record documents performance and an investigation reconstructs a particular disruption. A threat statement does not establish the probability of failure, and a successful exercise does not prove all-hazard readiness. Assess timeliness, independence, methods and relevance to the service objective. Preserve the distinction between observed case evidence and the analytical assumptions used to transfer its lessons to another setting. [D03] For one continuity claim, identify the source that supplies observation and the source that supports interpretation.

Source classes organize origin and function; they do not form an automatic hierarchy of evidential strength. An official statistic, an operational record and a causal study answer different questions. Classify the product, not only the organization. Detect shared data origins so that a dashboard, article and secondary report based on one observation are not counted as three independent confirmations.

Section readings [D03; C04; C05]

SECTION 27

Institutional, regulatory and technical sources

Government and intergovernmental sources provide public responsibilities, official investigations and technical guidance. Their scope and status differ. NIST guidance addresses organizational outcomes and practices; an incident investigation assesses particular events; Sendai supplies a policy framework. None should be cited as if it validates a case-specific numerical forecast. Record edition, jurisdiction and the relevant finding. Where guidance has been updated, use the appropriate version while preserving the historical version when analyzing an earlier decision. [D14] Check whether the source defines a recommended process, reports a verified outcome or establishes a binding duty.

Institutional sources should be selected by product, method and scale. Record whether the source defines a requirement, observes a condition, reports an investigation or synthesizes a literature. A current portal may contain several editions and methods; cite the actual version used. Public access does not establish accuracy for a different question, and a restricted source can still be used only under its authorized conditions.

Section readings [D14]

SECTION 28

Operational observations and monitoring products

Operator and industry records can reveal service timing, constraints and recovery performance. They may also omit unsuccessful access attempts or frame restoration around assets rather than users. Compare operational evidence with independent investigation and community experience. Sensitive details require lawful custodianship, but aggregate accountability remains possible through defined service metrics and verified summaries. Preserve source limitations and avoid presenting a supplier's readiness declaration as an independent assessment. A transparent evidence interface can support scrutiny without publishing live-system vulnerabilities. [D13] Compare an asset-restoration timestamp with the time affected people regained usable service.

Operational observations should show what the system delivered, not merely that an asset was declared available. Inspect the acquisition process, sensor or reporting changes, gaps, coverage and quality controls. Compare records with independent observations where feasible. Aggregated performance, a status dashboard and user experience can diverge because they concern different units, locations, periods or definitions of availability.

Section readings [D13]

SECTION 29

Academic research and independent evidence

Academic and community evidence offer complementary perspectives on resilience. Research can test models and compare mechanisms; local observations reveal accessibility, trust and unmet needs. Evaluate methods and context rather than treating either source category as automatically superior. A theory developed for a power network may not transfer directly to healthcare demand or public administration. Community participation should allow people to challenge assumptions about acceptable degraded service. Scientific interpretation and distributive judgment should remain visible as distinct contributions. [D12] Compare a model-defined successful recovery with a community-defined account of continuing service barriers.

Read the research design before transferring a conclusion. Identify the question, unit of analysis, method, comparison, result, limitations and conditions that matter for the case. Foundational concepts, empirical studies, critical replications and technical syntheses serve different functions. A literature-supported mechanism may justify a hypothesis without validating a local threshold, forecasting performance or a complete TFP application.

Section readings [D12]

SECTION 30

Source–variable correspondence

The source-to-variable map should show how each continuity metric is obtained. Usable capacity requires evidence of staff, supporting supplies and operating conditions; installed capacity alone is insufficient. A recovery time needs a clear start, end condition and affected function. Derived indices require explicit weighting and should retain the underlying observations. Record aggregation choices so that improved overall service cannot hide a prolonged outage affecting a smaller group. Reproducibility starts with consistent definitions before it reaches computation. [D11] Reconstruct one service indicator from records and explain how changing the recovery definition alters its value.

The source–variable matrix exposes the path from an observation to an analytical representation. Preserve the raw unit, time, location, method, transformation and uncertainty. Multiple derived variables may share one observation and therefore share its limitations. Record the code or reproducible procedure, authorized access and version. A score should remain inspectable through its originating evidence rather than replacing that evidence.

Section readings [D11; C04; C05]

SECTION 31

Source–risk correspondence

Evidence-to-risk mapping requires a causal pathway. An outage report can document service loss without establishing which preparedness measure would have prevented it. Compare timing, enabling conditions and plausible alternatives. Shared-source evidence should not be counted as independent confirmation. Use the case investigations to distinguish findings, recommendations and later analytical interpretation. A strong risk map identifies what would falsify the proposed mechanism and where current evidence supports only a scenario rather than a verified relationship. [D18] Write one competing explanation for a service interruption and identify the evidence needed to distinguish it.

A source–risk matrix should cover the threat, the observed state, the mechanism and the consequences separately. Evidence that an event occurred does not alone show why a function failed or who was affected. Use a chronology and alternative explanations to test the chain. A citation becomes useful when the specific part of the claim it supports and its limits are visible.

Section readings [D18]

SECTION 32

Monitoring gaps and research priorities

Monitoring gaps often concern relationships rather than components. An operator may know its own inventory while lacking information about shared upstream suppliers or the accessibility of alternative services. Prioritize gaps by consequence for the civilian decision. Additional measurements of a well-observed asset may add less value than a basic account of an undocumented dependency. State where inference relies on assumed availability and what can be done while the gap persists. Observation limits should remain visible in readiness claims. [D01] Identify the unobserved dependency most likely to change the recommended continuity priority.

Prioritize a gap by its consequence for the decision. The next observation may be a targeted measurement, an independent comparison, a capability test or a correction of incompatible definitions. More data of the same kind may not resolve structural uncertainty. Specify the question, required observation, responsible custodian, time of collection and condition under which the gap is considered sufficiently addressed.

Section readings [D01; C03]

SECTION 33

Dependency matrix and propagation tests

The dependency matrix should describe direction, mechanism, delay and substitution at a suitable public level. Energy supports communications, while communications support coordination of energy recovery; these reciprocal links need not have equal strength or timing. Shared geography should be recorded separately from direct service dependence. A matrix becomes analytically useful when a scenario tests how losing one function affects minimum service elsewhere. Avoid turning qualitative links into numerical weights without explaining their evidence and intended interpretation. [D08] Compare a direct physical dependency with a coordination dependency and identify the different recovery actions each requires.

Capacity margins can vanish through simultaneous demand growth and supply loss. Surge demand for emergency communications, fuel or healthcare may occur exactly when staffing and infrastructure are impaired. Track both sides of the balance and distinguish ordinary reserves from capabilities usable under the scenario. [D11]

Situational awareness depends on timely observations, shared definitions and acknowledgement by authorized actors. A technically available signal can be operationally ineffective if it is inaccessible, distrusted or inconsistent with another agency’s information. Exercises should test interpretation and coordination as well as message transmission. [D06]

Continuity arrangements can preserve a minimum function while degrading convenience, capacity or equity. Such degradation should be explicit and time-bounded, with monitoring of affected groups. Returning to nominal operation without addressing unsafe assumptions can restore the conditions that produced the original disruption. [D05]

A dependency matrix should be directional and time-specific. Record the supplying function, receiving function, mechanism, useful delay, substitute and evidence. Test the destination when the origin becomes unavailable for different periods. Then remove a common prerequisite of the substitute. The resulting structure describes the case; it does not establish all connections in a global architecture or validate an edge weight.

For each relationship, add the measured delay, duration of tolerable interruption, substitute and observation supporting the directed edge. Repeat the test for short, intermediate and extended unavailability. A generic list of linked sectors is not an estimated network, and no edge weight is validated by inclusion in this table.

Section readings [D08; C01; C02]

SECTION 34

Documented cases, near misses and recovery

Historical cases illustrate different combinations of exposure, dependency and institutional response. The 2003 blackout highlights system awareness and cascading interruption; Texas in 2021 highlights correlated weather exposure and gas-electric relationships; WannaCry shows digital disruption reaching civilian healthcare. These investigations do not establish a universal probability of strategic failure. Reconstruct the sequence from primary sources and preserve what was reasonably knowable before the outcome. Comparative learning is strongest when a recurring mechanism is identified alongside the conditions limiting transfer. [D15] [D19] Compare two cases using one dependency mechanism while keeping their technologies and civilian consequences distinct.

Historical analysis distinguishes observed loss, protective response, near miss and recovery. Several records can concern one event without becoming independent events. Preserve what the source actually investigated and avoid adding unsupported casualty, cost or restoration-time estimates. Compare cases by mechanism and evidence quality; the fact that one response was associated with an outcome does not alone establish a general causal effect.

Section readings [D15; D19]

SECTION 35

Integrated review, transfer and learning portfolio

Cross-domain synthesis should end with a defensible civilian preparedness decision. Identify the minimum function, affected groups, dependency most constraining continuity, evidence supporting the interpretation and the next lawful action. Explain alternatives and the conditions that would change the recommendation. Strategic resilience is strengthened when public accountability, independent evidence and practical recovery capability remain connected. An attractive network map or a completed checklist is useful only insofar as it helps preserve or restore the service people actually need. [D21] Prepare a decision memo that states both the expected continuity benefit and the unresolved distributional or evidentiary limitation.

The integrated portfolio should allow a reviewer to move from the question to observations, transformations, mechanism tests, scenarios and proposed monitoring. Make the strongest competing explanation and the most consequential unresolved gap visible. Transfer requires checking mechanisms, exposure and recovery resources in the new setting. Formation, optional credentialing, submission permission and licensing remain distinct processes; no case or data contribution enters the SIL without an associated fellow and applicable review.

Section readings [D21; C04; C05]