This study is a pioneer in investigating the state of play of digital resilience of local and regional public authorities (LRAs) across the EU and in underlining the implications of the cost of their digital non-resilience.

Key is the definition of digital resilience in the public sector and of its components (i.e., enforcement of legislation on cybersecurity and cyber resilience, availability of solid and reliable critical infrastructures, and use of appropriate digital and cybersecurity skills).

The study provides an overview of how EU countries foster digital resilience through the National Resilience and Recovery Plans funding. Results of a consultation and the findings of interviews complement information on investments made at the territorial level and allow the mapping of financial opportunities for digital resilience provided by the main EU instruments and programmes under the cohesion policy. 

Case studies related to the path undertaken by European regions and cities to achieve digital resilience contribute to deepening the understanding of challenges faced by LRAs. Examples demonstrate that the cost of digital non-resilience is likely to occur for the European sub-national public authorities.

LRAs are exposed to threats (e.g., cyber-attacks or natural disasters) that may compromise their functioning and the provision of public services. An analysis of the factors affecting these public authorities’ decision to invest in digital resilience demonstrates that the risk of digital incidents (i.e., incidents compromising the digital infrastructure) is underestimated and that most of them are not adequately investing and, instead, bear the cost of digital non-resilience when digital incidents occur.

Scenarios on the evolution of the digital resilience of European LRAs by 2025 and 2030 are presented as a foresight exercise building on the findings of the consultation, the interviews and desk research. Relevant wild cards that might threaten the smooth achievement of digital resilience by LRAs in the next years are also identified. Finally, recommendations to facilitate the achievement of a reasonable level of digital resilience by LRAs conclude the study.