Geopolitics and Critical National Infrastructure

Critical National Infrastructure

Civil-Military Cooperation

September 2026

By Stephen Hermanson

Introduction

My previous blog (Design Basis Threat and the Threshold Gap) about the MI5 Director General’s call for government, business and academia to treat national security as a shared endeavour generated significant interest.

Given the level of traction, there appears to be more appetite for insights into how successful collaboration might be structured. The Annual CIMIC (Civil-Military Cooperation) Foresight Conference (ACFC) is a useful reference point. The 2026 conference (ACFC26) has just concluded in The Hague (14-18 September 2026). As the ACFC26 conference report will likely take a few days or weeks to emerge, we can nonetheless refer to the 2025 conference report to see what the ACFC is recommending.

The NATO Civil-Military Cooperation Centre of Excellence is essentially coming at the same shared endeavour question from a different direction. The ACFC25 conference report offers some useful insights about systematic integration of civil actors into operational [military] processes, which responds in part to the vision that Sir Ken at MI5 is aiming to inspire.

This blog looks at relevant conclusions from the ACFC25 conference report and comments on how they might be used in the broader context for the Civil-CNI (Critical National Infrastructure) relationship.

Eight Takeaways for the Civil-CNI Relationship

1. The growing need for professionally secure and “safe” discussion spaces to address conceptual frictions and integration challenges.

Comment: Very similar if not identical to the Joint Operational Plan (JOP) concept covered in my blog “Design Basis Threat and the Threshold Gap” (see reference #1). Governments can use convening power and actively participate themselves to create safe and secure spaces (or reuse existing platforms to avoid clutter). The key is good organisation (a competent chair and secretariat) and persistence – with regular interactions and all parties contributing to the agenda (ad hoc discussion is simply insufficient). The precise frequency, format and membership can be configured to suit the nature and purpose of the group. The pre-requisite is that organisations will detach relevant personnel and provide them with the mandate and resources to contribute. For busy security professionals, there is a danger this becomes a “reasonable efforts” second order priority because the Executive Committee sponsor is missing or not convinced. That needs fixing straightaway if there’s any doubt. It’s revealing that the ACFC25 report says, “preparedness and resilience carry fiscal and political costs, which must be evidenced to decision-makers”.

2. Joint training, exercises and tabletops, including institutionalise pre-crisis liaison and exercising.

Comment: A classic item for JOP agendas. In some cases, the whole agenda could be dedicated to exercising or specific operational issues. The key is to ensure that exercising doesn’t slip off the agenda and become unfamiliar. For some, exercising can feel artificial and contrived, and the role-play can sometimes feel uncomfortable. The solution is to agree a scenario (meeting #1), brief the scenario (meeting #2), run the exercise (meeting #3) and de-brief/report on actions and follow-ups (meeting #4). In between meetings exercise leads are iterating and refining. The point is that a good exercise doesn’t jump off the page and happen in one meeting. If the group is meeting quarterly, then already the set-agendas for the year should include all the elements (#1-4) and continue year after year whilst rotating the exercise leads to spread the load.

3. Emphasise the commercial attractiveness of collaboration.

Comment: Super interesting to see this takeaway from ACFC25. Commercial attractiveness could mean a number of things. One is the commercial quid-pro-quo from having stronger preparedness and response – meaning less relative cost to deter, detect, respond and recover added to the commercial gain from mitigating or avoiding reputational or strategic damage. The message, it seems, is that collaboration can re-enforce the business case for security and resilience (assuming more convincing is even required). A second is aligning capability requirements with research agendas and product/solution development. The Security sector (either directly or through CNI clients) can understand from the collaboration the areas and priorities for security capabilities – ultimately matching requirements to capabilities and eventually investments and commercial deployments that respond to precise needs. A third might be the advantage of spreading commercial and operational risk across a greater ecosystem. More eyes on the threat, a self-supporting ecosystem that’s more difficult to knock over in isolated actions.

4. Systematic interfaces for common development of interoperability and security standards. This includes standardised information flow between entities and trusted, secure civil-military information-sharing interfaces overcoming IT and clearance barriers.

Comment: This is often where tension and fatigue emerge. Depending on the size of the group and the complexity of the agenda, there may be reasons for close, real-time collaboration, including the exchange of data and shared governance of decisions. In complex collaborations this can demand new and standalone systems and protocols – in some cases spawning entirely separate collaboration entities, sponsored by the original partners but trading in their own right. At the other end of the spectrum, it can be relatively informal and require nothing more sophisticated than standard desktop IT and common sense. Different parties will have different expectations and risk tolerance. Therefore, finding a method of collaboration that doesn’t side-line the agenda is part of what a good secretariat and committed sponsors are installed to navigate. The aim is not to lose sight of the collaboration’s true purpose when interoperability and alternative standards present obstacles – some of this friction is inevitable when building systematic collaboration. Work through it.

5. Rapid, multi-level information flow and dissemination of civil environment analysis, including improving reporting and information flow vertically and across levels of command, and shared threat assessments with critical sectors.

Comment: Builds on the previous point, shifting the focus from how to share onto what to share. Environmental analysis and threat assessments are two examples; incident reports, controls and risk assessments could be equally relevant. The key is deciding what matters and to bring it to the table promptly, with the necessary approvals and redactions – swift and pragmatic, while still respecting the governance individual organisations require around such decisions. CNI teams are in many cases already producing threat assessments, drawing on commercial intelligence sources that government may already use, or on open sources that government already has access to. The tradecraft of building an intelligence-sharing fusion cell across the public and private sectors already exists (and worthy of an entirely standalone blog in due course); what it needs is the political and commercial backing to stand up, mature and persist.

6. Designated contact points. Map and codify National civil-military organisational structures and points of contact.

Comment: Straight out of the JOP playbook. The secretariat compiles and maintains the contact list and organisational structures the group needs to understand.

7. Baseline CIMIC literacy in cross-domain areas (cyber, economic resilience, humanitarian dynamics).

Comment: This takeaway from ACFC25 suggests that a broader cross-section from within the collaborating organisations needs to have a better understanding of the shared endeavour between government and CNI, what their contributions might be and how they stand to benefit. It stands to reason that awareness amongst principal actors such as Security (including cyber), Resilience, Risk and Operations will percolate across the organisation so that others such as Finance, Supply Chain and Public Affairs (for example) are also aware and contribute where relevant and necessary. The point, it seems, is that good end-end awareness avoids fragmented and competing initiatives, especially in large multinational organizations where Dept A and Dept B both pursue the same concept in different ways without knowing the other exists. Proper integration of the collaboration programme into corporate governance and reporting (together with solid Executive Committee sponsorship and support) will create the line of sight and accountability/responsibility to offset this danger.

8. Integrate civilian actors earlier and more substantively into operational planning. Interaction is needed at the working level.

Comment: This is possibly the culmination and high-point of successful collaboration, when participating organisations can effectively detach their staff to take part in detailed operational planning at other participating organisations (including secondments across the public-private sector divide). This implies that participating organisations all have a role in the operational plan and are able to commit their organisations to fulfil that role. Where such a role doesn’t exist or isn’t required, then the collaboration is no less successful. Shared situational awareness and intelligence insights of themselves may be useful and that may be the extent of what the parties need.

Case Study: The UK Home Defence Programme

The Cabinet Office’s Home Defence Programme (established in 2024 as a cross-government plan for the UK’s defence, security and resilience) runs in parallel to the collaboration challenge that ACFC25 describes. It exists to coordinate military and civilian effort, including civilian assistance to the armed forces in a crisis or period of hostilities.

In July 2026 the Ministry of Defence confirmed it was progressing a parallel programme, aligned to the Cabinet Office Home Defence Programme, to facilitate a whole of society approach to defence and security. This resonates with ACFC25’s point about designated contact points and mapped organisational structures, since the coordination challenge is as much interdepartmental as it is civil-military. The Home Defence Programme centrepiece is Operation Albiston Shadow, a Tier 1, ministerial-led exercise planned for 2027 that will test the government’s home defence plans against hundreds of officials, from local responders through Crisis Operations teams to ministers themselves. This echoes the joint training and exercising exactly as ACFC25 recommends – treated as a standing commitment on the calendar, not an ad-hoc event.

More striking still is where the Programme reaches for private-sector help. The Strategic Defence Review has proposed a “new deal” for CNI defence, rooted in partnership between Defence and private-sector operators, including a mooted Reserve-style “Home Guard” to protect strategic sites across energy, food, water, telecoms, medical supplies and transport. This echoes ACFC25’s recommendation to “integrate civilian actors earlier and more substantively into operational planning”, manifest in a live UK defence policy proposal where CNI operators are moving from information-sharing partners toward something closer to co-owners of the protection mission itself. Whether it survives contact with cost, governance and liability questions is exactly the sort of thing a JOP-style standing forum, sponsored at Executive Committee level, would be built to work through before the pressure of an actual crisis forces the answer.

Conclusion

The ACFC25 report calls for “…a mindset shift that recognises modern conflicts affect whole societies and that harm cannot simply be displaced”. This feels very in keeping with the mindset shift that Sir Ken McCallum was aiming for in his public comments.

The ACFC25 report also concludes with a number of research questions, and one in particular seems especially useful for the broader question of public-private partnership for national security as a shared endeavour:

“What is the most effective way to organise and govern engagement with the private sector (NATO, host nation, EU, or blended models) while avoiding over-reliance on single companies or platforms?”

The possible danger is in looking for a binary delineation where private operators take responsibility for x-scope and the State takes responsibility for y-scope (or the balance). Behind this formula is the desire for specific parties to shoulder the responsibility (and accountability) for specific risks and mitigations because that’s how we believe risk is properly managed – leave no doubt about who is responsible (and accountable) because human nature will find room for manoeuvre (and precipitate errors) if there’s any ambiguity.

By creating systems of co-operation and building trust, we begin to understand, to a reasonable degree, the level of delineation we need in order to plan and act. A beautiful RACI may attempt to sketch out the broad parameters and provide some orientation on who is responsible/accountable for what, but not everything can be resolved purely by a bureaucratic process.

If ACFC25 sets out the conditions for good civil-military collaboration, the Joint Operational Plan described in my previous post is one practical vehicle for Civil-CNI partnership. A JOP-style forum (sponsored, resourced and meeting on a fixed cycle) is exactly the kind of standing structure that the Home Defence Programme’s own coordination challenge, and ACFC25’s research question about governing private-sector engagement, both point toward. The open question is whether that structure is built and matured before the next crisis forces it.

References

• Design Basis Threat and the Threshold Gap, Geopolitics and Critical National Infrastructure, Stephen Hermanson, 14 September 2026, 50years.blog
• ACFC25 Final Report, NATO CIMIC COE, October 2025, cimic-coe.org
• Annual CIMIC Foresight Conference 2026 Agenda, NATO CIMIC COE, September 2026, cimic-coe.org
• The UK Government Resilience Action Plan: 2026 Implementation Report, Cabinet Office, 14 July 2026, gov.uk
• What is a ‘whole of society’ approach to defence and security?, House of Commons Library, 2 September 2026, commonslibrary.parliament.uk