The evidence review report from SAPEA presents the latest scientific evidence on the subject of crisis management, and evidence-based policy options for action. The European Union is confronted with an increasing number of crises with growing complexity. Their effects can cascade and ripple to all parts of society, the economy, and the environment. The effects of such crises are not limited to specific geographical regions or sectors of society, and many crises continue indefinitely. Because they last, they overlap and amplify each other. Decisions made during crises are not only urgent, but have long-lasting consequences. Therefore, strategic crisis management needs to be aligned with broader policy objectives. Using digital tools, guidance and standards can be set for strategic foresight and risk monitoring, to ensure that a longer-term perspective is integrated. Better data preparedness can ensure that information can be shared effectively while respecting privacy and security when a crisis hits. To address the growing complexity of crises, we need a vision that integrates both risk management and crisis management. Different activities and organisations also need to coordinate: responses on multiple geographical and temporal scales need to be aligned, rather than aiming at the one ‘right’ level. Here, the EU could play an important coordinating role. The EU can also play a role in training decision- and policy-makers to coordinate and manage crises. Crises amplify existing inequalities, hitting the most vulnerable the hardest — and this can erode trust across society at exactly the time when trust is most needed. New technologies and forms of communication offer ways for citizens to be engaged and empowered. Involving civil society can bring many advantages, producing a better informed, tailored, and localised response.

Risk analysis is an essential methodology for cybersecurity as it allows organizations to deal with cyber threats potentially affecting them, prioritize the defense of their assets, and decide what security controls should be implemented. Many risk analysis methods are present in cybersecurity models, compliance frameworks, and international standards. However, most of them employ risk matrices, which suffer shortcomings that may lead to suboptimal resource allocations. We propose a comprehensive framework for cybersecurity risk analysis, covering the presence of both intentional and nonintentional threats and the use of insurance as part of the security portfolio. A simplified case study illustrates the proposed framework, serving as template for more complex problems.