Data Centres Given Critical National Infrastructure Status In Britain

In September, the Technology Secretary Peter Kyle declared that UK data centres will now be classified as Critical National Infrastructure (UK CNI), marking the first new CNI designation since 2015.

UK CNI constitutes critical elements of infrastructure of which the loss or compromise could result in major detrimental impact on essential public services, emergency systems, national security, defence, or the functioning of the state. 
 
This new designation places data centres on par with essential services, ensuring they receive prioritised support during critical incidents such as cyber-attacks, environmental disasters, and IT blackouts.

This follows the Science and Technology Committee’s recent inquiry into the cyber resilience of the UK CNI sector, during which the importance of bolstering the digital infrastructure against potential cyber-attack was emphasised. 

Key Aspects  

Data centres are crucial to the UK’s digital economy, powering essential services like healthcare, finance, and increasingly AI applications. Investment in data centres has surged recently, particularly within the UK; for example, Chancellor Rachel Reeves confirmed that Amazon Web Services plans to invest £8 billion in the UK over the next five years to build, operate, and maintain data centres.

Important aspects and implications of their designation as UK CNI include as follows: 

  • Strengthening UK’s digital Infrastructure:  The UK Government’s growing investment in the digital sector necessitates parallel enhancements in protections to ensure its resilience and security. A notable recent development is the proposed £3.75 billion investment welcomed by the UK Government in Europe’s largest data centre in Hertfordshire, which is anticipated to create nearly 14,000 jobs across the UK. As technological advancement and development become increasingly central to government policy and integral to the daily lives of UK citizens, such as in NHS records, financial information, and personal data stored on smartphones, it is increasingly critical to ensure the digital infrastructure storing this data is secure.
  •  Recent Cybersecurity Incidents: The need for greater resilience in the UK’s Digital infrastructure can be highlighted by two significant incidents this year. The first was a ransomware attack affecting services provided by Synnovis, a pathology firm, causing severe disruptions at healthcare sites including Guy’s and St Thomas’ Hospital and King’s College Hospital which resulted in the cancellation of operations and the diversion of emergency patients.

Additionally, the faulty CrowdStrike software update that caused a global computing outage was estimated as causing approximately £7.8 billion in damages, indicating the potential financial damage arising from such incidents. The greater protection given to datacentres by the new CNI classification will reduce and mitigate the impact of such incidents. 

  •  NIS Regulations: The UK Network and Information Systems Regulations 2018 (NIS) are a crucial cyber security framework applicable to to ‘operators of essential services’ and ‘relevant digital service providers’, enhancing the security and resilience of network and information systems across sectors like energy, healthcare, and finance. The NIS2 Directive came into force across the European Union in January 2023, which is aimed at CNI sectors and expanded the original scope of the NIS Directive to include other critical sectors such as space, waste, water, food, and manufacturing.

Although the EU’s NIS 2 Directive does not apply directly to the UK, the UK government plans to align its NIS regime with the EU’s updated framework to strengthen cyber defences, particularly for digital service providers and future-proofing the regulations. Proposed reforms include expanding the scope to cover ‘managed services’ and implementing a flexible risk-based assessment regime regulated by the UK Information Commissioner. These measures aim to ensure high levels of cyber-resilience and safeguard essential services against cyber threats. 

  •  Cyber Security and Resilience Bill:  The government plans to introduce the Cyber Security and Resilience Bill to strengthen the country’s cyber defences, as announced in the King’s Speech in July. This legislation will mandate that providers of essential infrastructure (i.e., UK CNIs) protect their supply chains from cyber threats, as well as expanding the scope of the current NIS Regulations, safeguarding a wider range of digital services and supply chains than currently protected. 
  • Enhanced Government Support: The new classification means UK data centres will receive additional government support in anticipating and recovering from emergencies. This includes the creation of a dedicated CNI data infrastructure team of senior officials who will monitor potential threats and coordinate priority access to government security agencies (including the National Cyber Security Centre) and emergency services to ensure rapid response and recovery during critical incidents.

 Takeaways
The classification of data centres as Critical National Infrastructure marks a pivotal moment for the UK’s digital economy. By providing enhanced protections and support, the UK government aims to ensure the resilience and security of data centres, fostering a secure environment for investment and growth.

This move not only intends to safeguard vital data but reinforce the UK’s position as a leader in data security and technological innovation.

David Varney and Victoria McCarron are Technoloy & Data lawyers at Burges Salmon

Image: Unsplash

You Might Also Read: 

Proposed British Digital Information & Smart Data Bill:

DIRECTORY OF SUPPLIERS - Critical Infrastructure Security:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Remote Pager Attack Begins A New Era Of Warfare
Attackers Can Use RAM To Steal Data From Air-Gapped Networks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

SABSACourses

SABSACourses

SABSA is a development process used for solving complex problems such as IT Operations, Risk Management, Compliance & Audit functions.

Red Hat

Red Hat

Red Hat is a leader in open source software development. Our software security team proactively identifies weaknesses before they become problems.

Zerto

Zerto

Zerto provides enterprise-class disaster recovery and business continuity software specifically for virtualized data centers and cloud environments.

Intertek Group

Intertek Group

Intertek Group provides Assurance, Testing, Inspection and Certification services. Activities include cybersecurity testing and certification.

Aveshka

Aveshka

Aveshka is a professional services firm focused on addressing complex threats and challenges including Cybersecurity and Information Technology.

Intel Capital

Intel Capital

Intel Capital, Intel's strategic investment organization, backs innovative technology startups and companies worldwide. We invest in a broad range of hardware, software, and services.

Key Cyber Solutions

Key Cyber Solutions

Key Cyber is an IT consulting firm that specializes in agile software development services, program management and infrastructure services, cyber security and cloud and managed services.

CyberCyte

CyberCyte

CyberCyte provides a disruptive built-in integrated physical, network and perimeter security solution framework.

Binary Security AS

Binary Security AS

Binary Security is a Norwegian information security consultancy company. We are specialists at application security, penetration testing and secure code reviews.

AwareGO

AwareGO

AwareGO is a global provider of security awareness training content and solutions that help enterprises improve cybersecurity awareness in the workplace.

MorganFranklin Consulting

MorganFranklin Consulting

MorganFranklin Consulting is a management advisory firm that works with businesses and government to address complex and transformational technology and business objectives including cybersecurity.

Centre for Cyber Security Research and Innovation (CSRI) - Deakin University

Centre for Cyber Security Research and Innovation (CSRI) - Deakin University

CSRI solves the cyber security threats of tomorrow, today. We work with industry and government leaders on innovative research that has real-world impact.

Celebrus

Celebrus

Celebrus Fraud Data Platform, by D4t4 Solutions, works with existing fraud structures to augment functionality and turn fraud management into true fraud prevention.

IGI Cybersecurity

IGI Cybersecurity

IGI Cybersecurity delivers people-driven cybersecurity for personalized, resilient cyber defense focused on individualized strategy and unshakeable partnership.

UltraViolet Cyber

UltraViolet Cyber

UltraViolet is an industry leading tech-enabled managed security services company.

BlackSwan Technologies

BlackSwan Technologies

BlackSwan Technologies is reinventing enterprise software through Agile Intelligence for the Enterprise – a fusion of data, artificial intelligence, and cloud technologies.