Vitālijs Rakstiņš

Security expert, with 18 years of experience in the Ministries of Defence, and the Interior. Researcher at Rīga Stradiņš University, and published author. 

 

The damage caused by the storm of 22–23 August 2026, exposed systemic problems in the business-continuity protocols of many critical service providers. The Cabinet of Ministers announced plans to strengthen the operational continuity of critical service providers, by harmonising requirements to secure at least 72 hours of backup electricity supply, and by unveiling ambitions for large-scale new training exercises and sector-wide stress tests. The Crisis Management Centre and sectoral ministries can certainly draw on NATO’s guidelines for strengthening public-private sector resilience, which were prepared on the basis of global practice.

In July 2026, NATO published guidance on how to strengthen public-private sector cooperation in order to enhance resilience (“Guidance for Enhancing Public-Private Cooperation for Resilience”[1]). RSU researcher, Vitālijs Rakstiņš, took part in drafting the guidance. It should be noted that NATO develops such guidelines and recommendations, regularly, based on current events. For example, guidance on countering disinformation was topical some time ago. This document was drawn up by an international group of experts over the course of several months, including by coordinating and testing the draft with various NATO bodies, so the final published product becomes an agreed compromise version, applicable to all member states. Given that the guidance concerns the private sector, it was decided not to classify it, but to make it publicly available to everyone.

As a politico-military alliance, NATO does not directly govern the activity of member states’ private sectors (unlike the EU); however, the operations of armed forces today are unthinkable without private-sector involvement. From logistics and communications support, to the provision of critical services and host-nation support. In all NATO member states, national emergency or exceptional-state regulations impose certain obligations on the private sector (mobilisation, obligations to work, and so on), yet in peacetime, the private sector has no unconditional statutory duty to provide priority services to military units, or to carry out their tasks. As a result, NATO’s strategic documents increasingly highlight the private sector’s critical role, and call on member states to invest in the resilience of critical-function/service providers.

The guidance is not binding on member states, but it describes the necessary model(s) of cooperation with the private sector, including successful examples of public-private cooperation. The health sector is one of the intended audiences of this guidance. The ability to provide mass-casualty assistance is one of NATO’s seven baseline resilience requirements. Yet almost everything that delivers this capability, pharmaceutical wholesale distribution, medical equipment, laboratory work, medical waste management, IT systems, transport, generator maintenance and security, belongs to the private sector. A healthcare institution’s resilience chain ends at its weakest subcontractor.

The guidance focuses on achieving three objectives:

The first objective is institutionalization, and the establishment of a resilience system. The state must create a permanent governance structure in which the private sector is represented with clearly defined tasks and division of responsibility, with designated points of contact for each baseline resilience requirement. Critical service providers must be identified, their resilience strengthened (minimum security standards, improved supply security, reduced dependencies), and risk shared with the state,  including the establishment of a protected information-exchange environment for commercially sensitive data, and the introduction of various incentive/compensation mechanisms so that companies are willing to take on additional responsibilities during a crisis at all. The guidance separately emphasises the principle of “resilient by design,” calling for improved supply security and the building of just-in-case reserves.

The second objective, is ensuring the continuity of critical services for the population during crisis or war. This means regular exchange of threat information, joint risk assessments, the use of state cyber-defence resources to protect critical service providers, training staff on their specific crisis-time duties, and pre-agreed procedures for resource prioritisation and crisis communication (for example, how to notify the public that a critical service is being restricted during a crisis).

The third objective, is civil support to the armed forces. Here the health sector is a direct participant, starting with Host Nation Support for incoming allied forces, which includes the provision of blood plasma, surgical capacity, evacuation chains and the flow of medicines. The guidance calls for full mapping of the medicine and pharmaceutical supply chain down to raw materials, alternative sources and substitute materials. It also addresses delayed deliveries and similar mechanisms that can be activated immediately in a crisis. There is no other effective way to test the system than regular civil-military exercises with genuine private-sector participation.

Overall, NATO’s recommendations are aimed at a systemic, institutionalised approach, requiring member states to structure cooperation with critical service providers, including by integrating the private sector into planning and information-sharing chains, and by regularly organising joint exercises and stress tests. It should be noted that the logic of the guidance rests on the assumption that the civilian and military sectors are equally aware of the actual capabilities of all parties involved — which is not always the case in reality. The guidance also addresses uncomfortable questions about prioritising civilian and military needs, calling for a pre-defined decision-making mechanism for allocating or reallocating limited resources, in order to answer a question, we are reluctant to answer in peacetime: who will receive blood products, operating-theatre capacity and oxygen when demand exceeds supply in a crisis.

Investment in resilience costs money today but pays off only at some uncertain point in the future. Every resilient solution, whether alternative communications, additional generator capacity or secure IT software, places a burden on a healthcare institution or pharmacy. The question of state compensation mechanisms for ensuring critical state functions, most of which are carried out by the private sector, remains unanswered.

A meaningful approach to strengthening private-sector resilience, meanwhile, is by its nature always cyclical and long-term: an initial resilience assessment and supply-chain mapping, followed by regular stress tests and theoretical training with suppliers, staff training on specific crisis roles, and ongoing situational awareness of changes in regulation, supply chains and threats. Each of these elements alone yields little. Taken together and repeated over time, they are the only factor that will give a company the edge it needs in a crisis to keep operating — unlike companies that have only a formally drafted plan but lack the actual capacity to keep functioning.

[1]NATO, “Guidance for Enhancing Public-Private Cooperation for Resilience”, 16 July 2026. nato.int — Guidance for enhancing public-private cooperation for resilience