The US and Europe are preparing for crises. Businesses must do the same.

A power cut can stop a Norwegian business even when none of its own systems has been hacked. Orders remain in the cloud, doors and payment terminals depend on electricity, and the people expected to restore operations are dealing with the same disruption at home. Preparing for that situation is now a leadership responsibility that deserves money, time and a tested plan.

Across Europe, governments are publishing and renewing advice on how people should manage when essential services fail. The UK launched updated guidance on 22 October. Belgium published a new practical brochure on 1 October. Ireland began delivering a national booklet in September. Meanwhile, the Pentagon's FORTRESS America initiative aims to make US military installations less dependent on vulnerable civilian infrastructure.

These initiatives differ in purpose and scale. Together, they show a clear shift: authorities are asking more of households, businesses and infrastructure operators before a crisis starts. Russia's war against Ukraine, the Iran war, a strengthening El Niño and growing dependence on AI and data centres make that shift relevant to Norwegian boards now. The US midterm elections add political uncertainty and an information environment in which dramatic claims need careful checking.

The useful question is concrete: Which services must your business keep delivering if electricity, communications or essential cloud services become unavailable, and what will it take to do so?

What FORTRESS America actually changes

In its official account of Pete Hegseth's 30 September speech, published on 2 October 2026, the US Army describes FORTRESS America as an initiative for greater infrastructure independence. It identifies independent power for military installations, protection against intrusion and more secure critical supply chains as objectives.

The parallel with European civilian preparedness is the underlying problem: essential operations depend on systems outside the operator's control. The military wants bases to function through disruption; European household campaigns aim to help people manage while public services and emergency responders handle a crisis. They are different parts of a wider effort to keep society functioning.

The Reddit post that prompted this article claims a specific 90-day self-sufficiency requirement. The official Army account reviewed here does not establish that number. It should not be treated as a verified universal requirement on the strength of the post. Nor does a preparedness programme establish that a particular attack is imminent.

For Norwegian companies, the actionable lesson is independence where it matters: know which external failure stops the business, decide how much interruption is acceptable and prepare an alternative that actually works.

Several countries are moving in the same direction

The current wave is real, although its components have different dates. Recent campaigns build on a substantial expansion of public preparedness guidance during 2024 and 2025. Here is a selection that shows both the breadth and the timing:

The EU Preparedness Union Strategy, launched in March 2025, provides a broader policy framework. It includes developing guidance for at least 72 hours of population self-sufficiency and stronger public-private cooperation. This is a strategy, not a universal Norwegian business requirement or a promise that services return after three days.

The parallel is bigger than stocking cupboards. Countries are addressing the same dependence on electricity, communications, supplies and public response capacity. Sweden has made the business connection explicit through its dedicated guidance for companies. Norwegian management teams should make that connection too.

Ukraine and Iran show why infrastructure belongs in the risk assessment

In Ukraine, civilian infrastructure is a direct target of war. On 16 October, EU leaders again condemned Russia's systematic attacks on civilians and critical infrastructure. Electricity is part of the ability to keep homes, workplaces and society functioning.

The Iran war has also brought physical attacks into cloud operations. In its public incident record, AWS reported drone damage to facilities in the UAE and Bahrain in March 2026. Its 15 September update said access to resources and data hosted exclusively in the UAE's mec1-az2 zone could not be restored. AWS also reported that it could not restore access to resources and data hosted exclusively in the Bahrain region after damage across multiple zones.

These are supplier statements about specific regions. They do not show that every cloud service, or a Norwegian data centre, faces the same exposure. They do show why a backup that shares the affected location is an incomplete recovery plan.

For a Norwegian company, buying a service from a European supplier does not by itself reveal where every dependency sits. Ask where the service, backups, identity system and critical subcontractors run. Determine which regional failure the actual architecture withstands. Two availability zones in one region are not equivalent to an independently recoverable service elsewhere.

Geographical separation costs money and adds operating complexity. It also needs working credentials, capacity, usable copies of data and a tested restart process. Buying the most elaborate architecture for every workload is wasteful. Leaving the most important service dependent on an untested recovery assumption is a different kind of waste.

The electricity grid connects the threats

Norway has its own reason to examine simultaneous failures. In October 2025, NVE reported weaknesses in repair preparedness for sabotage and multiple serious events. The government's October 2026 budget proposal describes Norwegian security of supply as good, while also recording the need to strengthen preparedness against a changed threat environment and climate.

Those statements belong together. A reliable system still needs contingency plans. A national annual power balance does not establish that a particular site, connection or supplier will remain available during a local incident.

At business level, follow the dependencies through a power failure. A charged laptop is little help if the router, mobile network, access control or cloud login is unavailable. A generator is useful only for the loads it actually supplies, with safe installation, fuel, maintenance and people able to operate it. A fuel delivery agreement is weaker if the supplier cannot dispatch or process payment during the same outage.

Commission qualified people to assess these arrangements. The board's task is to decide the required continuity and resources, then ask for evidence that the plan works.

El Niño adds weather exposure, not a timetable for a Norwegian blackout

The NOAA outlook issued on 8 October 2026 puts the chance of a strong to very strong El Niño continuing through January to March 2027 above 83%. El Niño changes the distribution of weather risks across parts of the world. NASA's October explanation also stresses that the exact impacts remain uncertain, especially as its influence travels beyond the tropics.

For Norwegian companies, the relevant questions include suppliers exposed to drought or flooding, transport disruption, cooling needs and energy costs. These are exposure checks, not forecasts that all those events will occur together. Local and regional forecasts must guide operational decisions. The global El Niño outlook alone does not establish the weather at a Norwegian facility this winter.

The practical parallel with security preparedness is straightforward: different causes disrupt many of the same services. A plan for losing electricity and communications earns its value across several scenarios. It need not depend on predicting the precise cause correctly.

AI makes the physical dependencies more important

AI is part of this picture in more than one way. More work relies on remote models and data centres. Cybersecurity teams face faster AI-assisted attack preparation, discussed in the article on shortening cyber response times. And data centres add to electricity demand.

In its Electricity 2026 outlook, the IEA expects data centre expansion to account for about half of US electricity demand growth through 2030. That is a forecast share of the increase, not half of all electricity use. It concerns data centres as a category, not AI alone. Growth makes investment in grids and supply more important; it does not prove an imminent blackout.

AI also offers useful support for preparedness: organizing supplier information, identifying missing dependencies and drafting exercise scenarios. People must check the underlying records and test the proposed alternatives. Keep the essential plan available without the AI service whose failure you are preparing for.

The opportunity is to adopt useful AI with a workable fallback. Preserving every old process indefinitely is expensive. Removing all alternative capacity before testing recovery is an avoidable exposure.

The US midterms put preparedness in a political context

The US general election takes place on 3 November 2026. The composition of Congress matters to US policy, including decisions on budgets and international commitments. Norwegian companies with US customers, suppliers or dollar-denominated costs have reasons to follow policy changes through the election and its aftermath.

My assessment is that the election makes resilience a politically important subject as well as an operating concern. Boards should follow actual decisions on security, energy and international cooperation, then assess their consequences for the business. The dates of the European initiatives also show that this preparedness effort extends beyond the current US election cycle. The operational case rests on documented dependencies and disruptions, regardless of the election result.

There is a separate information problem. Microsoft's September election guidance describes how AI answers increasingly mediate election information and recommends checking original, current sources. In a crisis, leaders need the same discipline. An alarming post, an AI summary and a government instruction have different evidential weight.

Agree in advance who verifies urgent messages, where official information comes from and who may authorize changes to payments, suppliers or operating arrangements. Do not let a convincing message replace an established verification process.

Give the business a continuity decision, not another general warning

Use a hypothetical Norwegian engineering workshop as a starting point. It has trained staff and usable equipment, but maintenance instructions and customer work orders depend on a cloud service. Management should establish what remains safe to do when that service and ordinary communications are unavailable. Some work can continue from verified records. Other work must stop because the necessary instructions cannot be checked.

For the next leadership meeting, produce one page for a genuinely important activity:

• Service to preserve: what customers still need, what can safely wait and when delay becomes unacceptable.
• Shared dependencies: electricity, water or cooling, connectivity, identity, cloud region, people and critical suppliers. Include the dependencies shared by the proposed backup.
• Fallback in practice: the alternative location, records and equipment, who starts the procedure, what it costs and how normal operation resumes.
• People and information: deputies, agreed contact methods, an offline copy of essential instructions and realistic availability when employees' households are affected too.
• Evidence and funding: the last relevant test, what failed, the next correction and the decision needed from management or the board.

Start proportionately. A small AS may gain more from accessible operating instructions, a tested data recovery route and clear arrangements with its landlord and IT provider than from buying equipment it cannot maintain. A service with major safety or societal consequences needs a more demanding assessment and any applicable sector-specific requirements.

Keep household preparedness and company continuity connected without confusing them. DSB recommends that households prepare for one week. That is not a standard recovery target for every company. The business must set its own justified objectives and follow the requirements that actually apply to it.

Management must design and exercise the arrangements. The board should challenge the most consequential shared dependencies, approve appropriate resources and follow up unresolved exposure. Use the guide to board cyber-risk reporting to turn the test results into decisions. When an incident occurs, the CEO's incident guide addresses the operational choices.

The message running from FORTRESS America to Europe's preparedness campaigns is that essential services cannot be taken for granted. Norwegian businesses should act on that now: identify what must keep working, fund a credible alternative and demonstrate that people can use it when normal infrastructure is unavailable.

Sources checked on 26 October 2026. The workshop and proposed management exercise are hypothetical. The practical recommendations are the author's analysis. Military objectives, household advice and legal business obligations are distinct; no forecast of an imminent attack, election-related disruption or Norwegian blackout is made. The featured illustration is AI-generated.