The Preparedness Gap: From Capability to Coordination

Europe’s approach to security has undergone a profound transformation. For decades, policy debates concentrated on identifying threats, strengthening protective measures and developing the capabilities needed to respond to crises. While these priorities remain essential, the focus has gradually shifted from resilience towards preparedness. The question is no longer simply whether Europe possesses sufficient capabilities, but whether it is prepared to organise and mobilise them effectively when they are needed most.

This evolution is reflected in recent European initiatives, including the Critical Entities Resilience (CER) Directive, the NIS2 Directive and, more recently, the Preparedness Union Strategy. Together, they signal a broader understanding of resilience, one that extends beyond emergency response to encompass anticipation, coordination and the ability of society as a whole to withstand, manage and recover from disruption.

Preparedness is therefore no longer solely the responsibility of governments or emergency services. It requires a whole-of-society approach in which public authorities, Critical Infrastructure operators, emergency responders, businesses and relevant regulated actors each contribute to a shared resilience architecture.

Yet despite this evolution, an important challenge remains largely overlooked.

Across Europe, many of the capabilities that would prove essential during a crisis already exist. Public authorities, emergency services, Critical Infrastructure operators, regulated private security providers, specialised technology operators and other essential actors protect critical infrastructure, monitor sensitive facilities, respond to alarms, secure transport networks, support business continuity and provide situational awareness around the clock.

However, these capabilities are still too often brought together only after a crisis has begun, in the absence of agreed governance arrangements, communication protocols, operational procedures and established coordination mechanisms.

This article argues that Europe faces not only capability gaps, but also what I describe as the Preparedness Gap: the gap between the capabilities and experience available within society and those effectively recognised, integrated and institutionalised as part of preparedness before a crisis occurs.

Closing this gap requires more than additional investment or new technologies. It requires a shift in mindset: from viewing resilience as the accumulation of capabilities to understanding it as the organisation of capabilities.

Private security offers a compelling illustration of this broader challenge. With approximately two million licensed professionals operating across Europe, the sector contributes daily to the protection of airports, ports, energy facilities, hospitals, public institutions, transport networks and countless other critical assets. Yet despite this operational presence, the sector’s capabilities, expertise and operational resources are frequently incorporated into preparedness arrangements only when emergencies are already unfolding. This is not simply a challenge for one sector. It reflects a broader governance challenge that is relevant to every organisation responsible for preparedness and the protection of society.

Preparedness therefore raises a broader question than capability development alone:

How can existing capabilities become an integral part of resilience before, not during, the next crisis?

Public policy frequently refers to capability gaps, skills shortages or technological deficits. These concepts assume that resilience depends primarily on acquiring what is missing. While this remains true in some areas, it does not fully explain why well-equipped societies continue to encounter coordination challenges during major emergencies.

Increasingly, Europe’s preparedness challenge lies elsewhere. In many cases, the necessary capabilities already exist, but they remain insufficiently recognised, connected and embedded within preparedness planning.

I therefore propose a complementary concept: the Preparedness Gap.

The Preparedness Gap is the difference between the capabilities and experience available within society and those effectively recognised and fully integrated in governance, procedures and operational planning, as part of preparedness before a crisis occurs.

In practical terms, preparedness means that roles and responsibilities, communication protocols, standard operating procedures, information-sharing mechanisms, legal authorities and decision-making processes have already been agreed, tested and exercised before an emergency arises. It also means that procurement models are designed for long-term resilience, not short-term cost efficiency. And finally, it makes sure that valuable operational experience gained during previous crises is translated into permanent institutional practice.

In short, preparedness is about ensuring that every relevant capability, and every relevant lesson, has already been recognised, connected and embedded before the first alarm is raised. This saves precious time and energy in crises, during which these resources are most scarce.

The Preparedness Gap rarely results from a single policy failure. Rather, it emerges from the gradual accumulation of decisions taken across different policy domains, often with legitimate but disconnected objectives. Legal frameworks, procurement models, operational planning and institutional cultures have evolved in parallel rather than together, creating preparedness systems in which existing capabilities are not always fully connected.

Closing the Preparedness Gap therefore requires more than additional resources. It requires preparedness to be understood as a question of governance.

Four dimensions deserve particular attention.

Preparedness begins by recognising which capabilities already exist within society.

Many preparedness frameworks understandably focus on public institutions and emergency responders. Yet resilience increasingly depends on a much broader ecosystem of stakeholders that contribute to the protection of Critical Infrastructure every day. Recognition does not imply transferring public responsibilities or blurring lines of authority. Rather, it means acknowledging operational realities and understanding how existing capabilities can contribute more effectively before, during and after crises.

Recognition is therefore the first step towards integration. Capabilities cannot become part of preparedness if they are absent from preparedness planning.

Recognition alone is not enough. Capabilities become operationally meaningful only when they are translated into preparedness.

That requires more than acknowledging their existence. It means embedding them in contingency planning, governance arrangements, communication protocols, information-sharing mechanisms, joint exercises and clearly defined responsibilities before a crisis occurs.

In practice, however, cooperation often develops only out of operational necessity. Public authorities, Critical Infrastructure operators and private actors establish pragmatic, ad hoc working relationships because circumstances leave them little alternative. These improvised arrangements frequently demonstrate remarkable professionalism and commitment. They also consume valuable time and energy at precisely the moment when both are most limited.

The more fundamental challenge emerges after the crisis.

Once normality returns, temporary cooperation too often disappears with it. Operational experience is acknowledged, reports are produced and participants are thanked for their commitment. Yet valuable lessons are not always translated into revised governance, updated contingency plans, regular joint exercises or permanent cooperation mechanisms.

As a result, each new crisis risks beginning with many of the same conversations, uncertainties and organisational barriers as the previous one.

The issue is not whether societies learn from crises. It is whether institutions learn quickly enough to transform operational experience into permanent preparedness.

Preparedness should ensure that cooperation no longer depends on operational necessity alone, but becomes a permanent feature of resilience.

Preparedness also depends on clarity.

• Who has the authority to act?

• Who shares information, with whom, and under what conditions?

• Who makes operational decisions?

• Who assumes responsibility?

• How are roles and responsibilities coordinated across organisations?

These questions often prove more complex than the technologies themselves. Without clearly defined governance arrangements, even highly capable organisations struggle to work together efficiently under pressure.

Governance is therefore not an administrative layer added to preparedness. It is the mechanism through which individual capabilities become collective resilience.

Preparedness cannot be separated from the long-term sustainability of essential capabilities.

Resilience depends on organisations being able to recruit, train and retain qualified professionals, invest in innovation and maintain operational readiness over time.

Procurement strategies that prioritise lowest price at the expense of quality may appear economically efficient in the short term, yet they can gradually erode the capabilities upon which preparedness ultimately relies. Workforce resilience, professional standards and sustained investment are therefore not simply economic concerns; they are integral components of preparedness itself.

The Preparedness Gap is rarely visible during routine operations. It becomes apparent when crises expose the disconnect between existing capabilities and the governance arrangements needed to mobilise them effectively.

The following examples come from different operational domains. They involve different technologies, legal frameworks and stakeholders. Yet they reveal the same underlying challenge: the necessary capabilities already exist, but they are not always sufficiently integrated into preparedness before they are needed.

Perhaps the clearest illustration of the Preparedness Gap lies in emergency planning itself.

Across Europe, public authorities, emergency services, Critical Infrastructure operators and private security organisations routinely cooperate during major incidents. Terrorist attacks, natural disasters, industrial accidents and large public events have repeatedly demonstrated the professionalism and commitment of all actors involved.

Yet this cooperation frequently develops under the pressure of events rather than through prior preparedness.

As situations evolve, communication channels are established, responsibilities clarified and practical solutions found. Organisations adapt remarkably well to circumstances that no contingency plan could fully anticipate.

This capacity to improvise is one of Europe’s strengths.

It should not, however, become its preparedness model.

Improvisation inevitably consumes time, leadership attention and operational capacity precisely when these resources are most valuable. More importantly, once the crisis has passed, many temporary arrangements disappear. Relationships remain personal rather than institutional, while lessons identified are not always translated into revised procedures, regular joint exercises or permanent governance mechanisms.

The consequence is that each major crisis risks beginning with many of the same discussions about roles, responsibilities and coordination.

Preparedness should ensure that these conversations have already taken place.

Counter-Unmanned Aircraft Systems (Counter-UAS) are frequently presented as a technological challenge.

In reality, technology is only one part of the equation.

Detection systems continue to improve. Artificial intelligence enhances identification capabilities, while mitigation technologies continue to evolve. Yet technology alone cannot determine how a drone incident is managed.

Who is authorised to detect?

Who validates the threat assessment?

Who decides whether intervention is justified and authorises it?

Who coordinates the operational response?

How are responsibilities allocated between public authorities, Critical Infrastructure operators and specialised security providers?

These are governance questions.

Without clear answers established before an incident occurs, even the most advanced technologies risk being deployed inefficiently or too late.

Counter-UAS therefore illustrates a broader lesson. Preparedness is not achieved simply by acquiring new capabilities. It depends on integrating those capabilities into coherent legal, operational and institutional frameworks long before they are required.

In many cases, the technology gap is smaller than the preparedness gap.

Critical communications provide perhaps the most tangible illustration of the Preparedness Gap.

Across Europe, Monitoring and Alarm Receiving Centres continuously monitor sites, verify incidents and assess the credibility of alarms before emergency services are alerted. They already generate information that is filtered, verified and operationally relevant.

Yet in many cases, this information still reaches emergency services through traditional voice telephone calls. The capability to produce high-quality situational awareness already exists. Technologies capable of digitally transmitting structured, verified information also exist. What remains insufficient is their systematic integration into emergency communication architectures.

The result is not merely a technical inefficiency.

It is a preparedness issue.

Every additional telephone conversation introduces delay, increases the potential for misunderstanding and limits the ability to establish a common operational picture. During rapidly evolving incidents, these seemingly minor inefficiencies can accumulate into significant operational consequences.

The challenge is therefore not primarily one of digital innovation.

It is one of governance, interoperability and preparedness.

When existing capabilities remain disconnected, technology cannot fully deliver the resilience it promises.

From the Preparedness Gap to Preparedness by Design

Identifying the Preparedness Gap is only the first step. The more important challenge is to rethink how preparedness itself is conceived.

Too often, preparedness evolves reactively. Crises expose weaknesses, force organisations to cooperate and generate valuable operational experience. Some of these lessons become policy or practice. Many remain local, temporary or informal. As a result, familiar coordination challenges continue to reappear from one crisis to the next.

Preparedness by Design requires a different approach. Rather than relying on crises to create cooperation, it seeks to ensure that the relationships, governance arrangements and operational interfaces required during emergencies already exist before they are needed.

This approach rests on four principles.

Preparedness should begin with a comprehensive understanding of the capabilities that already exist across society. Effective resilience depends not only on public institutions but also on the regulated private actors, operators and service providers that contribute daily to the protection of Critical Infrastructure and essential services.

Capabilities create value only when they are connected.

Emergency planning, communication protocols, information-sharing mechanisms and joint exercises should be established before an incident occurs, not developed under operational pressure.

Preparedness requires clear responsibilities, decision-making structures and legal frameworks that enable organisations to work together efficiently. Governance is what transforms individual capabilities into collective resilience.

Every crisis generates valuable operational experience. Preparedness by Design requires this experience to be systematically translated into revised procedures, permanent cooperation mechanisms, regular exercises and continuous improvement. Resilience should not depend on institutional memory alone; it should be embedded in institutions themselves.

Preparedness is therefore not simply the ability to respond effectively when a crisis occurs. It is the ability to ensure that existing capabilities, partnerships and lessons learned have already been transformed into a coherent system before the next crisis begins.

Closing the Preparedness Gap is ultimately not about creating more capabilities.

It is about designing preparedness so that the capabilities already available can achieve their full collective value.

Europe has entered an era in which preparedness has become as important as protection. This reflects an important recognition: resilience cannot be built during a crisis alone. It must be designed beforehand.

The concept of the Preparedness Gap offers a complementary way of understanding resilience. It shifts the debate from what is missing to what already exists but remains insufficiently connected. It reminds us that preparedness is not simply about acquiring new capabilities, but about recognising, integrating and institutionalising the capabilities and experience that society already possesses.

Private security is one illustration of this broader challenge. The same reasoning applies wherever valuable capabilities remain outside preparedness planning, where cooperation depends on personal relationships rather than established governance, or where operational experience is not systematically transformed into lasting institutional practice.

Europe’s next step in strengthening preparedness may therefore depend less on creating additional capabilities than on organising the capabilities it already possesses. In an increasingly complex risk environment, resilience will not be determined solely by the quality of individual organisations, technologies or regulations, but by the way they are designed to work together.

Closing the Preparedness Gap ultimately means making preparedness intentional rather than incidental.

Because preparedness should never begin when the first alarm is raised. It should already be embedded in the relationships, governance arrangements and capabilities that protect our societies every day.

Ultimately, Europe’s resilience will depend less on the capabilities it possesses than on its ability to organise the capabilities it already has.