CrowdStrike IT outage caused widespread impacts on essential services

The 2025 edition of the National Risk Register (NRR), published by the Government, cites the CrowdStrike IT outage in its foreword as an event that revealed the widespread impacts of technology failure on services essential to daily life¹. The register sets out the Government's latest assessment of the risks the UK faces, covering 89 plausible risks within 9 risk themes¹. It follows the previous edition, which was published in August 2023¹.

The foreword states:

The register describes its own scope and audience. It says this edition "is not targeted at the general public"¹, and that it underpins the public guidance at GOV.UK/Prepare, which the Government describes as setting out simple and effective steps people can take to prepare for emergencies¹. The register notes that in May 2024 the Government published advice for individuals, households and communities on GOV.UK/Prepare on preparing for emergencies¹.

The NRR sets out how risks are assessed. It says the assessment period is 5 years for non-malicious risks and 2 years for malicious risks¹, and that the National Security Risk Assessment now operates as a dynamic process, with risks reassessed more regularly to reflect the changing risk landscape¹. Likelihood is scored from 1 to 5, where 1 is the lowest and 5 the highest¹; the register states that a score 3 risk is approximately 5 times more likely to occur than a score 2 risk¹. Impact is assessed across 7 broad dimensions, each scored on a scale of 0 to 5¹, with fatality bands running from 1 to 8 deaths through to more than 1,000¹.

The document also lists the local structures that plan and respond to emergencies: the 38 Local Resilience Forums in England, the 4 in Wales, 3 Regional Resilience Partnerships in Scotland and Emergency Preparedness Groups in Northern Ireland¹.

Why it matters for households

The register is a national assessment rather than household guidance, and it states that this edition is not targeted at the general public¹. Its relevance to households is indirect: it is the document the Government says underpins the public preparedness guidance at GOV.UK/Prepare¹, and it names technology failure affecting essential services as one of the risks it considers¹. The register does not, in the cited text, set out specific advice for households on IT failures, and no household-level guidance specific to the CrowdStrike incident is reported here.

The register's own account of household advice points to the May 2024 Government guidance for individuals, households and communities on GOV.UK/Prepare¹. The site's Cyber Attacks and Major IT Failures: A Household Guide covers the wider subject of major IT failures, and the cyber-attacks hub collects related material.

What happens next

The register states that the Government will continue with the review of national resilience announced to Parliament the previous year, as a response to the Module 1 report, and that it is listening to those in society whose voices are too often unheard¹. No further dated steps are given in the cited text.