Data Centres Given Critical National Infrastructure Status In Britain

In September, the Technology Secretary Peter Kyle declared that UK data centres will now be classified as Critical National Infrastructure (UK CNI), marking the first new CNI designation since 2015.

UK CNI constitutes critical elements of infrastructure of which the loss or compromise could result in major detrimental impact on essential public services, emergency systems, national security, defence, or the functioning of the state. 
 
This new designation places data centres on par with essential services, ensuring they receive prioritised support during critical incidents such as cyber-attacks, environmental disasters, and IT blackouts.

This follows the Science and Technology Committee’s recent inquiry into the cyber resilience of the UK CNI sector, during which the importance of bolstering the digital infrastructure against potential cyber-attack was emphasised. 

Key Aspects  

Data centres are crucial to the UK’s digital economy, powering essential services like healthcare, finance, and increasingly AI applications. Investment in data centres has surged recently, particularly within the UK; for example, Chancellor Rachel Reeves confirmed that Amazon Web Services plans to invest £8 billion in the UK over the next five years to build, operate, and maintain data centres.

Important aspects and implications of their designation as UK CNI include as follows: 

  • Strengthening UK’s digital Infrastructure:  The UK Government’s growing investment in the digital sector necessitates parallel enhancements in protections to ensure its resilience and security. A notable recent development is the proposed £3.75 billion investment welcomed by the UK Government in Europe’s largest data centre in Hertfordshire, which is anticipated to create nearly 14,000 jobs across the UK. As technological advancement and development become increasingly central to government policy and integral to the daily lives of UK citizens, such as in NHS records, financial information, and personal data stored on smartphones, it is increasingly critical to ensure the digital infrastructure storing this data is secure.
  •  Recent Cybersecurity Incidents: The need for greater resilience in the UK’s Digital infrastructure can be highlighted by two significant incidents this year. The first was a ransomware attack affecting services provided by Synnovis, a pathology firm, causing severe disruptions at healthcare sites including Guy’s and St Thomas’ Hospital and King’s College Hospital which resulted in the cancellation of operations and the diversion of emergency patients.

Additionally, the faulty CrowdStrike software update that caused a global computing outage was estimated as causing approximately £7.8 billion in damages, indicating the potential financial damage arising from such incidents. The greater protection given to datacentres by the new CNI classification will reduce and mitigate the impact of such incidents. 

  •  NIS Regulations: The UK Network and Information Systems Regulations 2018 (NIS) are a crucial cyber security framework applicable to to ‘operators of essential services’ and ‘relevant digital service providers’, enhancing the security and resilience of network and information systems across sectors like energy, healthcare, and finance. The NIS2 Directive came into force across the European Union in January 2023, which is aimed at CNI sectors and expanded the original scope of the NIS Directive to include other critical sectors such as space, waste, water, food, and manufacturing.

Although the EU’s NIS 2 Directive does not apply directly to the UK, the UK government plans to align its NIS regime with the EU’s updated framework to strengthen cyber defences, particularly for digital service providers and future-proofing the regulations. Proposed reforms include expanding the scope to cover ‘managed services’ and implementing a flexible risk-based assessment regime regulated by the UK Information Commissioner. These measures aim to ensure high levels of cyber-resilience and safeguard essential services against cyber threats. 

  •  Cyber Security and Resilience Bill:  The government plans to introduce the Cyber Security and Resilience Bill to strengthen the country’s cyber defences, as announced in the King’s Speech in July. This legislation will mandate that providers of essential infrastructure (i.e., UK CNIs) protect their supply chains from cyber threats, as well as expanding the scope of the current NIS Regulations, safeguarding a wider range of digital services and supply chains than currently protected. 
  • Enhanced Government Support: The new classification means UK data centres will receive additional government support in anticipating and recovering from emergencies. This includes the creation of a dedicated CNI data infrastructure team of senior officials who will monitor potential threats and coordinate priority access to government security agencies (including the National Cyber Security Centre) and emergency services to ensure rapid response and recovery during critical incidents.

 Takeaways
The classification of data centres as Critical National Infrastructure marks a pivotal moment for the UK’s digital economy. By providing enhanced protections and support, the UK government aims to ensure the resilience and security of data centres, fostering a secure environment for investment and growth.

This move not only intends to safeguard vital data but reinforce the UK’s position as a leader in data security and technological innovation.

David Varney and Victoria McCarron Technoloy & Data lawyers at Burges Salmon

Image: Unsplash

You Might Also Read: 

Proposed British Digital Information & Smart Data Bill:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Remote Pager Attack Begins A New Era Of Warfare
Attackers Can Use RAM To Steal Data From Air-Gapped Networks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Intrinsic-ID

Intrinsic-ID

Intrinsic-ID's authentication technology creates unique IDs and keys to authenticate chips, data, devices and systems.

Libraesva

Libraesva

Libraesva specialize in Email Security. From Email Security, Phishing Awareness and Email Archiver. We can assist you with any email issues you may have.

NinjaJobs

NinjaJobs

NinjaJobs is a community-run job platform developed by information security professionals. We focusing strictly on cybersecurity positions.

Eco Recycling (Ecoreco)

Eco Recycling (Ecoreco)

Eco Recycling is India's first and leading professional E-waste Management Company that has set industry benchmarks with its innovative & environment friendly disposal practices.

Netsecurity AS

Netsecurity AS

Netsecurity is a Norwegian owned company focused and specialised within IT security and cybersecurity-as-a service.

Evanston Technology Partners (ETP)

Evanston Technology Partners (ETP)

ETP provides services and solutions to enable and transform businesses in the areas of cybersecurity, data protection, and efficient operations practices.

Shift5

Shift5

Shift5 focus on securing operational technology (OT) by building best-in-class, dual-use products serving military and commercial entities.

Slice

Slice

Slice offer subscription based Cyber Insurance for small businesses.

Tego Cyber

Tego Cyber

Tego Cyber delivers a state-of-the-art threat intelligence platform that helps enterprises deploy the proper resolution to an identified threat before the enterprise is compromised.

Electrosoft Services

Electrosoft Services

Electrosoft provide mature, innovative technology-based services and solutions to power critical IT programs and keep our nation safe from cybersecurity attacks.

International Cyber Threat Task Force (ICTTF)

International Cyber Threat Task Force (ICTTF)

The International Cyber Threat Task Force is a not-for-profit initiative promoting the ecosystem of an International independent non-partisan cyber security community.

NetGain Technologies

NetGain Technologies

NetGain Technologies helps small to medium-sized businesses gain access to expert IT talent. We provide strategies that use technology as a driving force behind business growth.

Evo Security

Evo Security

Evo Security is an Identity and Access Management company focused exclusively on serving MSPs, MSSPs and their SMB and Mid-Market customers.

Cyber News Live (CNL)

Cyber News Live (CNL)

Cyber News Live provide vital information and raise awareness about all things 'cyber' to ensure you stay protected in the digital world.

Q-Bird

Q-Bird

Q*Bird's mission is to provide equipment for the current, and future European quantum internet.

ViCyber

ViCyber

ViCyber is an Australian based company whose mission is to simplify and strengthen cybersecurity for all businesses, irrespective of size.