Why data centres are reshaping resilience and cybersecurity for critical infrastructure

Data centres are becoming one of the fastest-growing and most complex sources of electricity demand. In 2024, data centres consumed 1.5% of global electricity, according to the International Energy Agency, while their energy consumption expanded by 12%. But grid operators need to consider more than just this increased demand when planning for expected data centre growth.

Data centres can create situations in which large loads suddenly join or drop off the grid, posing challenges for grid stability.

At the same time, data centres directly and indirectly support all kinds of economic activity – from virtual meetings to a power company's energy forecasts and dispatch strategies. Data centres cannot provide this support without power, whether from the grid or from on-site backups.

The interdependence between data centres and energy systems makes it important to understand and manage cyber risks to energy infrastructure, including on-site power production at data centre facilities. Understanding what resilience looks like for data centres, their on-site energy systems and their interactions with regional electricity grids will bolster the resilience of current and future critical infrastructure.

Data centre resilience underpins the availability of data services, which can include everything from online advertising to business logistics, invoicing, digital banking and more. And so, data centres must be able to repel, detect and clear cyber threats without interrupting these services. Designing or operating data centre energy systems without considering cybersecurity can introduce or overlook vulnerabilities.

To provide data services, some portion of the data centre facility must be connected to external networks. This continuous exposure to the internet requires security architecture that protects on-site energy systems.

This is why a data centre’s power plant or backup battery systems should be protected – or "hardened" – through correctly configured digital controls, including firewalls and the closure of unused ports. And because security tools tend to erode over time, periodic review of security is a best practice.

Power plant systems and their backups must also be monitored because these systems will be digitally managed. Monitoring sensor and production data together with security event data can help discover threats and vulnerabilities before damage can occur. Even hardened systems should be monitored.

And cybersecurity requires visibility across the system of systems. The power plant, backup power, cooling and physical access systems each have potential for misuse that could affect data centre and grid stability. Visibility across these systems can help to quickly identify and address high-consequence anomalies better than if each system is monitored separately.

Coordination also matters because data centres are large demand loads. When they switch to backup or return to grid-based operations it can create grid management challenges. Planned, periodic operation from backup power systems can help operators gain experience communicating about, recognizing and managing any unintended interactions between these systems.

Resilient data centre infrastructure must be able to withstand interruptions to grid power, while continuing to deliver data services. For most data centres, the goal is to achieve a minimum of 12 hours of backup power and water. Using multiple energy sources and sets of identical equipment can improve redundancy and eliminate single points of failure.

Battery storage is a common solution for short-term backup power purposes. Shifting from grid-connected to battery backup can happen within milliseconds, even on an unplanned basis. Battery backups allow time for utilities to resolve power outages or for data centre operators to ramp up slower-starting power production, such as gas turbines.

When deciding what scale of batteries to install, data centre operators must consider discharge rates and total capacity. Once installed, operators must determine when to store electricity and when to dispatch it. These decisions become more complex when additional layers of on-site power production or performance metrics are involved – for example, optimizing for low emissions or low cost, or pairing battery power with solar, wind or gas turbines.

Data centres are typically designed on a power-first basis. On-site power production systems are capable of running the facility at full capacity indefinitely. In daily operation, these data centres make an economic decision whether to generate on-site or draw power from the electrical grid, often relying on the grid’s more efficient power production.

The rapid pace of data centre deployment in highly-regulated regions like the US tends to incentivize on-site power generation. Guiding new power production and transmission lines through the necessary regulatory hurdles takes time, but investors in artificial intelligence (AI) innovation call for speed.

At the same time, supply chain constraints can delay the purchase and deployment of heavy equipment like gas turbines. Developers can transition from small, immediately available generators to sources like wind, solar or nuclear power as these slower-to-construct systems come online. Integrating multiple energy sources has the advantage of diversifying risk, but requires careful attention to ensure visibility across the system of systems for cybersecurity monitoring.

Data centres can further reduce the risk of localized power disruptions by distributing data services geographically. This poses several technical challenges, such as latency and alignment with data sovereignty requirements, which can make such strategies impractical or uneconomical. And from the grid operator perspective, the potential for data services switching from one data centre to another means that unplanned outages in one area may result in a rapid ramp-up in loads from elsewhere within national borders.

Data centre and electricity sector resilience are interconnected. Data centres must operate backup power systems during grid outages, and grid operators must build systems capable of handling data centre load variability. Both sectors benefit when the electric grid delivers uninterrupted, low-cost power. This mutual benefit should drive cooperation on resilience.

Power outages and cyber incidents could potentially occur simultaneously. But building resilience into the relationship between data centres and the electricity sector – and continuing to engage across sectors as each sector's requirements evolve – can help address the solvable engineering challenges that will transform these events from major emergencies into minor incidents.