Long-Term Systems Assessment: Interdependencies Among Critical Global Systems

11. Introduction

Critical systems are usually assessed one at a time. Grid reliability, water security, food security, financial stability and the resilience of communications and computing each have their own institutions, data and standards of adequacy. The Office of Strategic Risk Assessment (OSRA) undertook this assessment because the most consequential failures of recent decades did not stay within the system in which they began, and because the channels through which they spread have changed faster than the sectoral assessments that monitor them.

The assessment asks three questions. Which dependencies among critical systems are strong enough that the loss of one function would substantially impair another within weeks? Along which sequences do disturbances most often propagate through several systems? And where is capacity so concentrated that a single site, supplier or corridor sits beneath several systems at once?

This is a structural assessment. It describes the present architecture of dependency and how that architecture has changed over the past decade. It does not estimate the probability of any future condition. The Department’s first probabilistic assessment, the Civilizational Systems Outlook, is scheduled for October 2026 and will draw on the structure described here, propagated through a full ensemble of the Integrated Civilizational Systems Model (ICSM).¹

22. Scope and methods

Six focal systems are in scope: energy (generation, fuels, transmission and distribution), water (supply, treatment and distribution), food (production, inputs, storage, processing and trade), information (communications networks and the services carried on them), finance (payments, clearing, credit and trade finance) and computation (data-center capacity, cloud services and automated decision and control systems). They correspond to seven of the eleven ICSM modules; Supply Chain and Manufacturing enters as the source of the concentration chokepoints in Section 6, and Governance, Public Health and Demography are treated as boundary conditions.

Network representation

Each system is represented as one layer of a multilayer network. Nodes are functions at regional resolution — for example, bulk transmission in a region, cereal import handling at a group of ports, or wholesale payment settlement in a currency area — rather than individual assets. Intralayer edges represent flows within a system. Interlayer edges represent dependencies: a directed edge from node i to node j indicates that j requires the function provided by i. Each interlayer edge carries a dependency strength between 0 and 1, defined as the fraction of j’s function expected to be lost within 30 days if i were lost completely and no emergency measures were taken.²

Dependency strengths were estimated from three sources, in order of preference: perturbation experiments in ICSM v4.1, in which a function is removed in one region and the response of receiving functions is recorded; engineering data on backup provision, stockholding and redundancy; and, where neither was adequate, structured elicitation with sector specialists. Of the 2,618 interlayer edges, 1,412 are estimated primarily from model experiments, 803 from engineering data and 403 from elicitation. To examine change over time, the same procedure was applied to a reconstruction of the 2016 network using historical data and the 2016 wave of the infrastructure automation survey.

33. Dependency classes

Dependencies differ not only in strength but in mechanism, and mechanism determines speed of propagation and the kinds of buffer that can interrupt it. The assessment assigns each interlayer edge to one of five classes.

The most significant change over the decade is the growth of the control class, from 15 to 24 percent of interlayer edges, at the expense chiefly of physical dependencies. This is not because physical dependencies have weakened; it is because a large number of new control edges have been added, principally from the computation layer into energy, finance and information. Control dependencies have the fastest onset of any class and the weakest buffers. A physical dependency on fuel can be bridged by a stockpile measured in weeks; a control dependency on an automated dispatch or settlement service can be bridged only by a manual procedure, which in many operators now exists in documentation but is no longer exercised at scale.

44. Strongest couplings

A full 6 × 6 system-level dependency matrix, and the underlying 1,326 × 1,326 node-level matrix, are maintained by the Integrated Systems Modeling Program. Table 3 summarizes the twelve strongest directed system-level couplings, each expressed as the population-weighted mean dependency strength across regions.

Two features of the table matter most. The first is that energy remains the root dependency: three of the five strongest couplings originate in it, and every other system ultimately requires electricity on timescales of hours to days. The second is that the three largest increases since 2016 all originate in computation. Of these, the rise in the dependence of energy on computation — from 0.31 to 0.61 — is the most consequential, because energy also supplies computation at a strength of 0.94. The two systems now form a tightly coupled mutual dependency whose characteristic response time is shorter than most operator procedures.

The increase in energy’s dependence on computation reflects the automation of balancing, dispatch, market clearing, protection coordination and distributed-resource management, and the growing share of these functions performed by learned models rather than fixed algorithms. The Department’s framework for evaluating such systems is set out in DSC-TR-2026-007; its evaluation results are now used to parameterize correlated-failure rates in the computation layer.³

55. Cascade pathways

To identify recurring pathways of propagation, the Office ran 18,600 perturbation experiments in which individual functions or groups of co-located functions were removed in one region, and recorded the sequence in which other functions fell below 50 percent of their reference level. Sequences reaching at least three systems were clustered. Four clusters account for 71 percent of all three-system cascades and are described below.

P1: grid–control pathway

The fastest and most frequent pathway arises from the mutual dependency between energy and computation. A disturbance on either side reduces the other’s capacity, which feeds back before operators can intervene. In experiments where the initiating fault is a correlated failure across automated control deployments — the same model or software version misbehaving in several control rooms at once — the pathway reaches finance in a median of six hours, faster than any physical shock. Its severity depends almost entirely on whether manual fallback procedures can be enacted at the necessary scale; experiments that assume practiced manual fallback contain the cascade to two systems in 82 percent of cases, compared with 37 percent when fallback is assumed to be degraded.

P2: energy–input–food pathway

Nitrogen fertilizer production depends heavily on natural gas, and mechanized production and distribution on diesel. A fuel shock propagates to food through input prices and availability, with a lag set by crop calendars. The pathway is slow but has two dangerous properties: its effects on production arrive after the initiating shock may already have eased, and because several major producing regions share input suppliers and planting seasons, it tends to synchronize production shortfalls that would otherwise be independent.

P3: settlement–trade pathway

Import-dependent regions finance food and fuel purchases through a small number of payment and trade-finance arrangements. A prolonged outage or exclusion propagates within weeks to physical supply, and from fuel and imported treatment chemicals into water systems. In experiments the pathway is most severe for regions with less than 60 days of import cover.

P4: drought–power–water pathway

Drought reduces hydroelectric output and the cooling capacity of thermal plants at the same time as it increases electricity demand for pumping and, during heat, for cooling. The resulting loop between water and energy is balancing in mild conditions and reinforcing in severe ones. The pathway is the clearest case in this assessment of climate acting as a multiplier on existing structural dependencies rather than as an independent cause.

66. Concentration chokepoints

A chokepoint is a function supplied by so few sites, firms or corridors that its loss cannot be compensated within the dependent systems’ buffer durations, and on which at least two of the six focal systems depend. The assessment identifies nine. Concentration is reported in bands rather than as point estimates because ownership and capacity data differ in quality between items.

The first three chokepoints share a property that the others do not: their recovery lead times are measured in years, while the buffers of the systems that depend on them are measured in weeks to months. A loss of leading-edge fabrication capacity would not cause immediate failure — installed computation would continue to operate — but would cap the replacement and growth of compute capacity on which, as Section 4 shows, an increasing share of other systems’ control functions rely. In ICSM this effect enters through the slow reinforcing loop between Supply Chain and Manufacturing and Computational Systems and AI.

77. Network metrics

Network theory offers measures of how the structure of a system affects its robustness to the loss of components. A central result for interdependent networks is that coupling layers together can make the whole far more fragile than any layer alone, and can change the character of failure from gradual degradation to abrupt collapse once a critical fraction of nodes is lost. The assessment computed standard robustness metrics for the six layers in isolation, for the reconstructed 2016 network and for the 2026 network.

The coupled 2026 network loses half its mutually connected function after the random loss of 23 percent of its nodes, compared with 41 percent for the average layer considered alone; under targeted removal the corresponding figure is 4 percent. Both thresholds have fallen since 2016. The number of single points whose loss would remove more than a tenth of another system’s function has risen from 11 to 19; 12 of the 19 are in the computation or information layers.

The shift in the most central layer, from energy in 2016 to computation in 2026, summarizes the decade’s structural change. Energy remains the root dependency on which every layer ultimately rests. Computation has become the principal intermediary: the layer through which the largest number of shortest dependency paths between other systems pass. A disturbance that enters the computation layer now reaches more of the network, more quickly, than a disturbance of equal size entering any other layer.

Metrics of this kind should be read with care. They depend on how functions are aggregated into nodes, and abstract removal experiments do not represent the operator response, repair and substitution that real systems mount. Their value lies in comparison: between coupled and isolated structure, and between 2016 and 2026 under a consistent method.⁴

88. Limitations

The assessment is subject to limitations that readers should weigh in interpreting its findings.

• Aggregation. Function nodes aggregate many assets. Within a node, redundancy is assumed to be available; in practice, sub-regional concentrations, such as data-center clusters sharing a single substation, may make some dependencies stronger than the regional figures suggest.
• Dependence on survey and elicitation. Control dependencies, the class that has grown most, are also the class least supported by engineering data. Of the 403 edges estimated primarily by elicitation, 236 are control edges. Appendix A shows that where engineering data exist, they more often indicate stronger control dependence than the model does.
• Static structure. Dependency strengths are estimated for a reference state. Under prolonged stress, operators substitute, ration and improvise, and some dependencies weaken while others strengthen as buffers are exhausted. Dynamic changes of this kind are represented only in the coupled model.
• Exclusion of deliberate action. Removal experiments are random or ranked by network position. They do not represent adversaries choosing targets with knowledge of the network, or the reallocation of effort that occurs when operators know which functions are failing.
• Reconstruction of 2016. The 2016 network was estimated retrospectively. Its control-class edges rest on an earlier, smaller survey wave and are likely to be less complete than those for 2026, which may overstate the measured change. Sensitivity tests in which unobserved 2016 control edges are imputed at 2026 densities reduce, but do not remove, the decline in robustness reported in Table 6.

Regional variation is substantial. The dependence of energy on computation exceeds 0.75 in five of the 24 regions, all with high shares of variable renewable generation and extensively automated balancing, and is below 0.35 in seven. Import-dependent regions with limited import cover are most exposed to the settlement–trade pathway. Regional tables are maintained by the Integrated Systems Modeling Program and are provided to the Outlook configuration of ICSM.

99. Findings and next steps

These findings describe the structure through which future stresses would propagate. They do not by themselves indicate how likely any particular stress is, or how severe its consequences would be once the balancing responses of operators and governments are taken into account. Those questions require the full coupled model, its stochastic shock generator and its representation of institutional response, run across a probabilistic ensemble.

The Department’s first Civilizational Systems Outlook, scheduled for release in October 2026, will provide that assessment. The dependency strengths, cascade clusters and chokepoint concentrations reported here have been supplied to the Integrated Systems Modeling Program as inputs to the Outlook configuration of ICSM. The network itself will be re-estimated annually, with the next full update planned for August 2027 following the 2027 wave of the infrastructure automation survey.