The government has taken a significant step in recognising the vital role of data centres in the UK’s digital economy by classifying them as Critical National Infrastructure (CNI).
This landmark decision, announced by Technology Secretary Peter Kyle on 12 September 2024, places the data centres sector on an equal footing with 13 other sectors the UK currently designates as CNI, including chemicals, nuclear, communications, defence, energy, food and water.
This classification brings both opportunities and responsibilities for data centre operators and other players in the sector, recognising the vital role data centres play in the economy and safeguarding essential data and services.
Enhanced government support
The CNI designation means data centres will now receive greater government support in anticipating and recovering from critical incidents. A dedicated CNI data infrastructure team of senior government officials will be established to monitor potential threats, provide prioritised access to security agencies like the National Cyber Security Centre (NCSC), and co-ordinate emergency services when needed. The NCSC is expected to play a key role in supporting data centres, specifically:
- Prioritised access: exercising prioritised access to data centres in the event of cyber incidents or threats.
- Threat monitoring and prevention: monitoring and anticipating potential cyber threats to data centres.
- Incident response: providing support in responding to and mitigating cyber attacks or other critical incidents affecting data centres.
- Cybersecurity guidance: working closely with data centre operators to enhance their cybersecurity posture and resilience.
- Co-ordination: collaborating with other government agencies and the private sector to ensure a co-ordinated approach to protecting data centre infrastructure.
This increased level of protection is particularly crucial given the sensitive nature of data stored in these facilities, ranging from personal smartphone photos to NHS patient records and financial information. The government's intervention aims to minimise disruption to essential services and the broader economy in the event of cyber attacks, outages or adverse weather events.
Implications for data centre operators
- Increased responsibility: with CNI status comes a heightened level of responsibility, as data centre operators will need to maintain stringent security measures and operational standards to align with their new critical status.
- Government collaboration: operators can expect closer collaboration with government agencies, particularly in threat assessment and incident response, including the sharing of intelligence and best practices to enhance overall sector resilience.
- Investment attraction: the CNI designation could boost investor confidence in the UK data centre market, with the government's commitment to supporting the sector potentially attracting increased domestic and foreign investment, potentially leading to expansion opportunities for existing operators.
- Regulatory compliance: while no new regulations have been announced immediately, operators should prepare for potential future regulatory changes that may come with CNI status.
Broader industry impact
The CNI classification is expected to have far-reaching effects on the UK's digital landscape:
- Economic growth: the government hopes this move will stimulate economic growth in the tech sector, citing a proposed £3.75 billion investment in Europe's largest data centre in Hertfordshire, with potential for job creation and a boost to the economy.
- Cybersecurity focus: the CNI designation underscores the critical importance of cybersecurity in national infrastructure, potentially leading to increased resources and innovation in this field.
- International competitiveness: with this move, the government hopes to position the UK as a leader in recognising and protecting digital infrastructure, potentially attracting more international businesses to host their data in the UK.
Concluding thoughts
NCSC CEO Felicity Oswald welcomed the CNI designation, stating:
"Our critical national infrastructure is a high-priority target for cyber attackers – ranging from criminals to hostile states – who would seek to do the UK harm…acknowledging the essential role [data centre] services play in driving forward our economy and society. CNI organizations must have a high level of security to combat the cyber threats they face and the NCSC will continue working hand in hand with operators to bolster their online resilience."
The classification of data centres as Critical National Infrastructure marks a significant milestone in the UK's digital strategy. It reflects the new Labour government's recognition of data centres as the backbone of the digital economy and, for data centre operators, this development brings both opportunities and challenges.
While it promises enhanced security and government support, the CNI designation also demands higher standards of operation and potentially increased costs, with a renewed focus on driving innovation in cybersecurity, operational resilience and data management, as well as complementing the forthcoming Cyber Security and Resilience Bill.
If you would like to discuss the content of this article further, please get in touch with Tim Wright.
