The government has this month named UK data centres as Critical National Infrastructure (CNI) to protect the country’s data against IT outages, cyber-attacks and environmental emergencies.
As the first Critical National Infrastructure designation since 2015, this move places data centres alongside water, energy and emergency services systems, giving them greater government support when recovering from critical incidents.
“Data centres are the engines of modern life – they power the digital economy and keep our most personal information safe. Bringing data centres into the Critical National Infrastructure regime will allow better coordination and cooperation with the government against cyber criminals and unexpected events,” said Technology Secretary Peter Kyle.
As part of the designation, a dedicated CNI data infrastructure team of senior government officials will be formed to monitor for potential threats, working with the National Cyber Security Centre and emergency services to ensure data, from photos to NHS records, is protected. With the CNI designation, the government will work to build contingency plans to mitigate risks and damage caused in the event of an attack against a data centre.
“The move is long overdue and will hopefully pave the way for more countries to follow suit,” reports Sylvain Cortes, VP Strategy at Hackuity. “Data is the foundation of trillions of annual transactions, to say nothing of the other CNI dependent on these very data centres. Coincidentally, that makes them a prime target for the $10 trillion cybercrime industry.”
The decision is widely considered timely and strategic from a physical security standpoint, given that data centres comprise the backbone of the digital economy housing vast quantities of sensitive information.
“While data centres are better equipped than most businesses to secure data, this designation will give operators greater reassurance that the government will support them in recovering from and anticipating critical incidents, minimising the impact on the economy,” explains Nick Smith, a data centre security expert and Business Development Manager at Genetec. “In terms of the implications for data centre operators and the wider supply chain, I expect this will further emphasise the importance of government product approvals such as CAPSS.”
The CNI designation is a most welcome step in right direction for sure, but is it enough to truly safeguard our increasingly digital landscape, for commercial and public entities alike?
“As we move deeper into an era defined by AI and cloud services – not only for businesses, but for society as a whole – the need for robust security and resilience for data centres has become more pressing,” says Thomas King, CTO, DE-CIX. “However, data centres on their own are of little value. Interconnection between data centres – therefore robust networks and interconnection platforms – is essential to enable the data and applications housed in data centres to create value for society and business, and these also require recognition as critical infrastructure. This is not just a local issue; it’s a framework that can and should be replicated by other nations to safeguard their digital economies.”
