How this links to the Cyber Security and Resilience Bill
The Bill does not use the noun “enterprise data centre”. It says a data centre service is provided “on an enterprise basis” when both limbs of new para 11(7) are met, and gives that kind of service a higher 10 MW threshold. The practical effect is that most corporate server rooms stay out of scope, while very large in-house facilities, such as those run by banks, retailers or AI developers for their own compute, can become Operators of Essential Services.
- cl.4(3), para 11(3): the threshold for a data centre service provided on an enterprise basis is rated IT load of 10 MW or more.
- cl.4(3), para 11(7): enterprise basis means the data centre is owned or managed in connection with the person’s undertaking and its sole purpose is to provide IT services for that undertaking.
- cl.4(3), para 11(2): anything that is not enterprise basis falls to the general 1 MW threshold.
- Once in scope, an enterprise operator carries the same duties as any data centre OES: reg 8ZA information, reg 10 security duties, reg 11A reporting and reg 11C customer notification.
What makes a data centre “enterprise basis”?
Both conditions in para 11(7) must be satisfied. First, the data centre is owned or managed by a person in connection with the carrying on of an undertaking by that person. Second, the sole purpose of the data centre is to provide information technology services for that undertaking.
The word “sole” does the work. A facility that hosts even some third-party equipment or sells capacity to others appears to fail the second limb, which would move it to the 1 MW threshold. How Ofcom will treat group companies, shared services within a corporate group, or small amounts of incidental hosting is not settled in the Bill and will depend on guidance.
Why is the enterprise threshold higher?
The policy aim is to regulate data centres whose failure would disrupt many other organisations. A colocation site serving hundreds of customers creates wider dependency than a server room that only supports its owner. Setting the enterprise threshold at 10 MW keeps ordinary corporate facilities out, while still catching very large single-owner sites that the economy relies on.
The owner of a sub-10 MW enterprise facility may still be regulated in other ways. If it is itself an OES in energy, transport or another sector, its own systems are already covered by its sector duties. See Schedule 2 thresholds for the other sector tests.
Enterprise versus non-enterprise data centre services
| Question | Enterprise basis | Non-enterprise |
|---|---|---|
| Who is served? | Only the owner’s own undertaking | Third parties, or a mix |
| Threshold | 10 MW rated IT load | 1 MW rated IT load |
| Source | para 11(3), (7) | para 11(2) |
| Regulator | Ofcom | Ofcom |
| Duties once in scope | Same OES duties | Same OES duties |
Worked example (illustrative)
Illustrative example: an in-house facility that starts renting racks
A retailer runs a 6 MW data centre solely for its own systems. On the Bill’s wording it is below the 10 MW enterprise threshold and out of scope. If the retailer starts leasing spare racks to a partner, the sole purpose limb appears to fail, the 1 MW threshold applies, and the site would be deemed designated as an OES. This is illustrative, and Ofcom guidance may refine the test.
Where it appears in the Bill
- cl.4(3), NIS Sch 2 para 11(3)10 MW threshold for data centre services provided on an enterprise basis.
- cl.4(3), NIS Sch 2 para 11(7)The two-limb definition of enterprise basis, including the “sole purpose” test.
- cl.4(3), NIS Sch 2 para 11(8)(b)Rated IT load: maximum electrical power available for the IT equipment.
- cl.4(2), NIS Sch 1Ofcom as designated competent authority for data infrastructure.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Is my company server room regulated under the Cyber Security and Resilience Bill?
Almost certainly not. A data centre run solely for your own business is provided on an enterprise basis, and the threshold for that is a rated IT load of 10 megawatts or more. Typical corporate server rooms and small private facilities are far below that figure, so they are not essential services under the new data infrastructure subsector.
What happens if an enterprise data centre hosts customer equipment?
The enterprise basis test requires the data centre’s sole purpose to be providing IT services for the owner’s undertaking. Hosting third-party equipment appears to break that test, so the general 1 megawatt threshold would apply instead. Ofcom has not yet published guidance on edge cases such as intra-group hosting, so treat mixed-use sites cautiously.
Do enterprise data centres have lighter duties once in scope?
No. The higher threshold only affects whether the site is in scope. An enterprise data centre at 10 megawatts or more is an Operator of Essential Services with the same duties as a colocation operator: information to Ofcom under reg 8ZA, security duties, 24 and 72-hour incident reporting and customer notification.