GUIDE · RULES

NATO’s seven baseline requirements for resilience and what they mean for UK councils, operators and charities

NATO addresses its baseline requirements for national resilience to governments, yet in the UK the work itself falls to councils and Local Resilience Forums, water and energy companies, the NHS, transport operators and the voluntary sector. Below we go through the seven requirements as revised in 2026, where they came from, how they connect to UK resilience policy, and what they mean below the national level.

Last checked 2026-10-23

Where the requirements come from

Under Article 3 of the North Atlantic Treaty, Allies commit to maintain and develop their individual and collective capacity to resist armed attack. NATO reads civil preparedness into this, since a country whose government, energy, communications and transport fail under pressure can neither defend itself nor receive help from Allies.

Allied leaders agreed the seven baseline requirements for national resilience at the 2016 Warsaw Summit. They turn three core functions of civil preparedness (continuity of government, continuity of essential services to the population, and civil support to military operations) into areas a country can measure itself against. At the 2023 Vilnius Summit Allies agreed to set national resilience objectives, and in Washington in 2024 they committed to bringing civil planning closer into defence planning.

NATO published a revised set in September 2026, the 2026 Baseline Requirements for Resilience. It raises the level of ambition and names sabotage of critical infrastructure, more frequent cyberattacks, harmful economic dependencies, extreme weather and dependence on space-based services. Separately, at the 2025 Hague Summit Allies agreed to account for up to 1.5% of GDP for defence- and security-related spending, which can include resilience and civil preparedness.

The UK, a founding member of NATO, approaches the same agenda through its own documents. The Strategic Defence Review 2025 called for a whole-of-society approach to defending the country, the Resilience Action Plan of July 2025 set goals for assessing risk, involving the whole of society and strengthening the public sector, and the 2026 implementation report announced a Home Defence Programme with a national exercise in 2027 involving everyone from local responders to ministers.

The seven baseline requirements at a glance

REQUIREMENT	WHAT NATO ASKS OF ALLIES	WHAT IT MEANS LOCALLY
1. Assured continuity of government and critical government services	Tested continuity plans, clear succession and decision-making, a protected crisis management centre with alternatives	Council incident teams that can meet, decide and keep records when the council offices have no power or network
2. Resilient energy supply	Mitigation and restoration plans with infrastructure operators, information sharing with all relevant stakeholders	Repair crews and emergency planners working from one picture of outages and priorities
3. Ability to manage controlled and uncontrolled movement of people	Plans for mass influx (including above 2% of the population), controlled evacuation, deconflicting civilian and military movement	Evacuation routes, rest centres and registration that hold up under pressure
4. Resilient food and water resources	Situational awareness, early warning and protection of food and water resources, exercised contingency plans	Water companies and councils able to organise bottled water and bowser distribution points
5. Resilience to deal with mass casualties and disruptive health crises	Whole-of-society planning, sharing medical information and situational awareness between civil and military authorities	Ambulance services, hospitals and volunteers looking at the same view of casualties and capacity
6. Resilient civil communications systems	Continuity planning with the private sector, priority access, means for authorities to communicate with and warn the population	A fallback for when mobile networks and the internet are degraded or down
7. Resilient civil transportation systems	Prioritise, protect and restore transport, cross-government coordination, backup systems for transport IT and OT	Knowing which roads, bridges and vehicles can be used, and who sets priorities

Summary of the 2026 NATO brochure. The full objectives are in the source documents below.

What it means for councils and LRFs

Most of the seven areas reach local authorities in some form. As Category 1 responders under the Civil Contingencies Act they keep local services running, warn and inform residents, run rest centres and coordinate volunteers, usually through their Local Resilience Forum. In practice that calls for:

An emergency plan that assumes no power, no mobile network and no internet for at least the first hours.
An incident team able to move to a fallback location and still see the same information (see emergency planning software for councils).
Evacuation routes, assembly points and rest centres agreed in advance, plus some way to register who passed through them.
Contacts and procedures for working with the police, neighbouring councils and the armed forces, whose joint regional liaison officers advise LRFs.
Exercises with LRF partners, since a council rehearsing alone learns little about the handoffs.

What it means for infrastructure operators

Requirements 2, 4, 6 and 7 fall almost directly on energy, water, telecoms and transport operators. NATO’s text keeps returning to restoration plans developed with operators, information sharing, priority access and backup systems. In the UK this overlaps with the Category 2 responder duties under the Civil Contingencies Act and with the NIS Regulations 2018. For an operator it translates into:

Restoration and repair plans that crews can carry out without the central control system.
One picture of outages, crews and priorities, shared with the authorities who decide what comes back first.
Business continuity planning that covers crisis and conflict scenarios, which NATO explicitly encourages.
Secure field communications and device management (they also matter for network and information systems security).
Named contacts for civil-military coordination.

What it means for charities and volunteer organisations

NATO describes resilience as a whole-of-society effort that involves the private sector and civil society. Charities and volunteer groups run rest centres, hand out food and water, search for missing people and support the NHS. In a serious emergency they are most useful when they plug into the Local Resilience Forum and the statutory responders instead of running in parallel to them:

Find out which statutory responder will task you, and how requests and reports travel.
Keep a current list of the people, qualifications and equipment you can really deploy.
Be able to work offline and to share positions and reports with partners when asked.
Set rules for data protection and for what you pass to authorities or the military.
Train with the organisations you would work beside, civil-military exercises included.

Resilience self-check for organisations

Decide and lead

Who decides if the usual leader cannot be reached?
Where does the crisis team meet if the main building is out of use?
How are decisions recorded so they can be reviewed later?

Communicate

How do teams get tasks and report back with no mobile data?
Which maps, plans and contact lists are already on the devices?
How do you share a common picture with the police, the armed forces or other agencies?

Recover

Which services come back first, and who agreed that order?
How are reports collected offline merged once links return?
When did you last exercise this with partners?

Where Sinkaos helps

Sinkaos gives crisis staffs, operators and volunteer teams one shared operational picture that keeps working without the internet. Mission packs sit offline on phones, local field servers sync later, and decisions are recorded on a timeline. For work alongside armed forces it supports APP-6 symbols, MGRS coordinates and Cursor on Target exchange with TAK apps. It is not a certified NATO system and does not handle classified information. See civil preparedness.

Questions about NATO resilience requirements

Are the baseline requirements legally binding on councils or companies?

No. They are commitments between Allied governments. In the UK they reach councils, operators and charities through the Civil Contingencies Act, sector regulation, government resilience policy and contracts.

What changed in the 2026 revision?

NATO describes a higher level of ambition and explicitly considers sabotage, cyberattacks, emerging technologies, harmful economic dependencies, extreme weather and reliance on space-based assets. Compared with the original 2016 wording, the fifth requirement now also covers disruptive health crises, and the third covers controlled as well as uncontrolled movement of people.

How does this relate to the Civil Contingencies Act and the NIS Regulations?

There is overlap. The Civil Contingencies Act sets local planning and co-operation duties, and the NIS Regulations 2018 cover the cyber security of essential services, while NATO’s requirements look at the same services from the angle of crisis, conflict and civil support to the military. Our NIS guide has more.

Do charities have a role in NATO resilience?

Indirectly, yes. NATO calls resilience a whole-of-society effort that includes civil society, and in the UK charities contribute through Local Resilience Forums and agreements with statutory responders.

What is host nation support?

The civil and military help a country gives Allied forces on its territory, such as transport, fuel, food and accommodation. Several of the 2026 objectives refer to it directly.