Government begins project to raise resilience of State services to disasters and attacks

Flooding in Enniscorthy, Co. Wexford, in January. The National Strategy on the Resilience of Critical Entities 2026-2029 seeks to strengthen essential services in the State against natural disasters, terrorist attacks, public health emergencies, and sabotage. File picture: Niall Carson/PA

The Government has launched a strategy to strengthen essential services in the State against natural disasters, terrorist attacks, public health emergencies, and sabotage.

Authorities are under pressure to identify all such services — across a massive range of sectors — to the European Commission in just four months.

The critical sectors cover energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and food.

The National Strategy on the Resilience of Critical Entities 2026-2029, published by the Department of Defence, contains a list of actions that need to be implemented in the short, medium and long term.

The strategy stems from the EU Critical Entities Resilience (CER) Directive, which was published in January 2020 and entered into force in January 2023.

The European Commission has told member states that they must supply the identity of all critical services to them by July 16, 2026.

In a significant expansion of its remit, the Department of Defence is the lead department in Ireland for developing and implementing the strategy.

What's your view on this issue?

You can tell us here

This involves setting up a new structure within the state to increase the resilience of critical services and co-ordinate efforts with other departments and what are called ‘competent authorities’.

These authorities — including ministers, regulators and authorities — each have their own legal responsibilities to ensure resilience in services in their sectors, including by conducting audits and inspections.

In the strategy foreword, the minister for defence Helen McEntee said: “Resilience relies on the continuous availability of a wide range of essential services including the water we drink, the food we eat, the energy that lights and heats our homes, the transport we depend on, and the health services that keep us healthy. 

"Certain entities that provide these services are vital to the functioning of our society and are therefore classified as critical.” 

The CER Directive – which concentrates on physical resilience – was introduced by the European Commission along with the NIS 2 Directive, which focuses on cyber resilience of critical services.

The National Cyber Security Centre is responsible for the implementation of NIS 2 through an equal system of competent authorities.

The Critical Entities strategy said that it is based on the existing whole-of-government national policy for strategic emergency management, which defines the roles of lead departments.

Competent authorities will be responsible for: 

• requiring operators of essential services to provide the information necessary for the critical entity identification process; 
• reporting risks to the Department of Defence; 
• conducting analysis after any incident affecting a critical service; 
• assessing the compliance of services and, where a critical entity is not compliant, taking enforcement action.

Critical entities, in turn, are required to conduct risk assessments and take appropriate measures to ensure their resilience.

Resilience is defined as the ability to “prevent, protect against, respond to, resist, mitigate, absorb, accommodate, and recover” from an incident.

The Department of Defence will continue to oversee “a programme of national exercises” to test aspects of national resilience in co-ordination with relevant Government departments and competent authorities. 

The department will also conduct an annual review of lessons identified and the strategy will be updated every four years, with next publication planned for 2030.