Data centres are now critical national infrastructure
The designation is official. Data centres join water, energy, and transport as top-tier CNI. The Cyber Security and Resilience Bill brings strict new oversight to operators.
What does CNI status mean for data centres?
Designation as Critical National Infrastructure (CNI) means the UK government views data centres as vital to the country's function. A catastrophic failure or attack on these facilities would have a debilitating impact on national security, the economy, or public health.
Under the Bill, this moves security from a commercial "value-add" to a statutory duty. Operators will face mandatory reporting windows, strict physical and cyber security standards, and significant fines for serious failures.
1MW vs 10MW
Regulators are debating which facilities fall under the strictest rules. Here is the technical breakdown.
| Criteria | Lower threshold (1MW+) | Higher threshold (10MW+) |
|---|---|---|
| Target segment | Small co-location & edge facilities | Hyperscalers & wholesale providers |
| Supply chain impact | High (captures niche, critical providers) | Concentrated (major cloud zones) |
| Registration volume | ~400-600 UK facilities | ~50-100 UK facilities |
| Regulatory intent | Likely outcome To prevent fragmenting the secure estate. | Focus on systemic risk only. |
*Thresholds based on provisional consultation documents and subject to final enactment.
New operational obligations
What designation as critical national infrastructure means in practice for operators.
Mandatory incident reporting
Disruptions to power, cooling, or connectivity must be reported to the NCSC / regulator, often within 24-72 hours.
Physical security audits
Strict controls on physical access. "Remote hands" and visitor access logs will be scrutinised under new compliance audits.
Power resilience
Backup generator testing and UPS maintenance records become regulatory evidence, not just operational hygiene.
Secure your infrastructure
Ensure your facility meets the new CNI standards. Precursor Security provides specialised physical and cyber audits for data centres.