Risk-based determination of reporting thresholds for extraordinary events at critical entities and critical infrastructures

Cross-sectoral methodological approach and professional recommendation

Abstract

A fundamental prerequisite for the resilience of critical entities is the timely detection, and assessment, and - where applicable - reporting of operational disruptions. One of the challenges in implementation is determining when an event reaches a level of severity that warrants broader escalation and/or an immediate review of the applicable reporting obligations. This study presents a cross-sector, risk-based methodological framework, the generally applicable Model of Determination of Threshold Value of Incident (REKÜM). The model combines ten assessment dimensions, overriding criteria, sector-specific calibration, and dynamic reassessment. Its aim is not to establish a uniform legal threshold, but rather to create a documentable decision-support logic that - while preserving sectoral characteristics - facilitates early detection, escalation, and the consistent assessment of reporting criteria.