On 12 September,  the Technology Secretary Peter Kyle declared that UK data centres will now be classified as Critical National Infrastructure (UK CNI), marking the first new CNI designation since 2015. UK CNI constitutes critical elements of infrastructure of which the loss or compromise could result in major detrimental impact on essential public services, emergency systems, national security, defence, or the functioning of the state. 

This new designation places data centres on par with essential services, ensuring they receive prioritised support during critical incidents such as cyber-attacks, environmental disasters, and IT blackouts. This follows the Science and Technology Committee’s recent inquiry into the cyber resilience of the UK CNI sector, during which the importance of bolstering the digital infrastructure against potential cyber-attack was emphasised. We discussed this inquiry further in October last year. 

Key Aspects

Data centres are crucial to the UK’s digital economy, powering essential services like healthcare, finance, and increasingly AI applications. Investment in data centres has surged recently,  particularly within the UK, with some estimates projecting the UK data centre market to grow from approximately £15.5 billion to £26 billion by 2032. 

Important aspects and implications of their designation as UK CNI include as follows: 

• Strengthening UK’s Digital Infrastructure. The UK Government’s growing investment in the digital sector necessitates parallel enhancements in protections to ensure its resilience and security. A notable recent development is the proposed £3.75 billion investment welcomed by the UK Government in Europe’s largest data centre in Hertfordshire, which is anticipated to create nearly 14,000 jobs across the UK. As technological advancement and development become increasingly central to government policy and integral to the daily lives of UK citizens, such as in NHS records, financial information, and personal data stored on smartphones, it is increasingly critical to ensure the digital infrastructure storing this data is secure.
• Recent Cybersecurity Incidents. The need for greater resilience in the UK’s Digital infrastructure can be highlighted by two significant incidents this year. The first was a ransomware attack affecting services provided by Synnovis, a pathology firm, causing severe disruptions at healthcare sites including Guy’s and St Thomas’ Hospital and King’s College Hospital which resulted in the cancellation of operations and the diversion of emergency patients. Additionally, the faulty CrowdStrike software update that caused a global computing outage was estimated as causing approximately £7.8 billion in damages, indicating the potential financial damage arising from such incidents. The greater protection given to datacentres by the new CNI classification will reduce and mitigate the impact of such incidents. 
• NIS Regulations. The UK Network and Information Systems Regulations 2018 (NIS) are a crucial cyber security framework applicable to to ‘operators of essential services’ and ‘relevant digital service providers’, enhancing the security and resilience of network and information systems across sectors like energy, healthcare, and finance. The NIS2 Directive came into force across the European Union in January 2023, which is aimed at CNI sectors and expanded the original scope of the NIS Directive to include other critical sectors such as space, waste, water, food, and manufacturing. Although the EU’s NIS 2 Directive does not apply directly to the UK, the UK government plans to align its NIS regime with the EU’s updated framework to strengthen cyber defences, particularly for digital service providers and future-proofing the regulations. Proposed reforms include expanding the scope to cover ‘managed services’ and implementing a flexible risk-based assessment regime regulated by the UK Information Commissioner. These measures aim to ensure high levels of cyber-resilience and safeguard essential services against cyber threats. 
• Cyber Security and Resilience Bill. The government plans to introduce the Cyber Security and Resilience Bill to strengthen the country’s cyber defences, as announced in the King’s Speech in July. This legislation will mandate that providers of essential infrastructure (i.e., UK CNIs) protect their supply chains from cyber threats, as well as expanding the scope of the current NIS Regulations, safeguarding a wider range of digital services and supply chains than currently protected. 
• Enhanced Government Support: The new classification means UK data centres will receive additional government support in anticipating and recovering from emergencies. This includes the creation of a dedicated CNI data infrastructure team of senior officials who will monitor potential threats and coordinate priority access to government security agencies (including the National Cyber Security Centre) and emergency services to ensure rapid response and recovery during critical incidents.

Takeaways

The classification of data centres as Critical National Infrastructure marks a pivotal moment for the UK’s digital economy. By providing enhanced protections and support, the UK government aims to ensure the resilience and security of data centres, fostering a secure environment for investment and growth. This move not only intends to safeguard vital data but reinforce the UK’s position as a leader in data security and technological innovation.

If you have any questions or would otherwise like to discuss any issue raised in this article, please contact David Varney or a member of Burges Salmon's cybersecurity team.

This article was written by Victoria McCarron