So much of our lives depend on digital services. The Government's decision to designate Data Centres as Critical National Infrastructure (CNI) is therefore a welcome step. The change effectively codifies what was already a widely held assumption, even among the general public, regarding the importance of data centres.
The UK has an estimated 500 data centres. This puts it ahead of many countries, including China and most of Europe, although it is dwarfed by America (which has circa 5,000). Moreover, it is highly likely that demand for data centre capacity will grow significantly, as business seek to meet the computing needs of Artificial Intelligence alongside more routine services.
The recognition of data centres as a vital part of the country's infrastructure is therefore not before time. Undoubtedly it will bring some benefits to the sector, in particular in justifying greater focus and support at a governmental level. However, it is no panacea, and much will still fall to the providers and consumers of these services.
Strong and stable?
Security is often the headline issue when it comes to digital services. As a data centre client, ensuring that the data centre can securely house sensitive data is crucial. As a result, many view the sector as being a leader in physical security already, and there are well-trodden practices to manage physical risks.
However, from the customer's viewpoint, resilience often takes precedence. Recent outages in data centres, such as the Oct 2021 Meta misconfiguration, show that availability issues that cause service disruption create headlines. Whilst in this case, although the fault only led to 6 hours of service outage, it was a highly public event and was linked to a drop in the share price of Meta.
Clouds on the horizon?
Perhaps the most interesting part of the announcement is contained in a footnote that "CNI will include both the physical data centres and the cloud operators that use them to supply ordinary services".
The extent of support for major cloud providers is yet to be disclosed. However, it is a positive sign to see government support for these service providers being potentially formalised.
Benefits of designation
Risk management in data centres is a collaborative effort, with strategies between operators and clients being mutually dependent.
The UK Government National Protection Security Authority already publishes guidance for the data centre sector and its customers. The advice is well developed, focusing on specific risks driven by considerations ranging from geography and asset ownership to the management of data halls and 'meet-me rooms' where network interconnectivity occurs.
The Government's designation of data centres as CNI will likely lead to greater support in the sharing of intelligence related to issues, and support in the recovery from crisis events. The changes are not just focused on cyber security issues, but also will improve overall resilience – such as from extreme weather events or other disruptions.
This designation may also offer further, more subtle, benefits to Data Centre operators, who (like other sectors) have likely recognised their susceptibility to disruptions from physical protests; their status as CNI may now mean that data centre operators will have an easier argument when seeking injunctive relief to safeguard their services. Additionally, it could influence planning and construction practices to improve access to essential utilities like electricity and water making construction more viable.
However, a belief that this status alone will deter cybercriminals may be somewhat optimistic. It will need to be backed by clear measures that target those who attack critical infrastructure, to send a message that it is off-limits.
Further, the change will potentially bring more scrutiny with it for data centre operators. In the context of the broader economic environment, it appears that businesses will bear the brunt of any implementation costs, barring extraordinary events or civil contingencies.