The Cyber Fragility Index (CFI), introduced by the authors as a synthetic indicator for predictive governance at the organisational level, can be extended to two higher scales. At the level of a Member State, National Cyber Authorities (NCAs) could aggregate the individual CFIs of NIS2 entities into a National Cyber Fragility Index (NCFI): a predictive surveillance instrument for the national cyberspace, capable of detecting sectors converging towards instability before incidents occur. At the European level, ENISA could aggregate the NCFIs of Member States into a European Cyber Fragility Index (ECFI): the first synthetic indicator of the Union's cyber fragility, comparable across countries and over time. This article introduces the three-tier architecture CFI → NCFI → ECFI, discusses the fundamental distinction between CFI-Local and CFI-National, and proposes a structural analogy with meteorological and civil protection alert systems. The proposed system is not a compliance tool: it is a strategic early warning system — the cyber equivalent of seismic and hydrogeological monitoring networks.
Leva et al. (Fri,) studied this question.