The UK Government has issued a “call for views” on the current level of physical, technical and organizational security provided by data center operators (i.e. colocation service providers, not businesses that operate their own data centers) and cloud service providers (including providers of infrastructure-as-a-service, platform-as-a-service, and managed services). The Government intends to use the responses it receives to determine whether it needs to provide additional support to providers of these services—or whether additional regulation is required—to improve the level of security for data storage and processing infrastructure.
Similar to the Government’s announcement about the Product Security and Telecommunications Infrastructure Bill in the recent Queen’s Speech (which will, among other things, impose cybersecurity requirements on internet-connected “smart” products—see more here), this call for views also is sector specific. This suggests that the UK will focus its cyber policy in different sectors rather than imposing horizontal obligations.
The Government is clear that in addition to receiving the views of service providers, it wishes to hear from customers (e.g., content delivery networks, financial services firms and telecoms providers) and industry experts (e.g., researchers and trade bodies). The call for views covers three main areas:
1. The current risks to UK data storage and processing infrastructure. First, the call for views sets out two principal risks relevant to data processing infrastructure:
a. unwanted access to large-scale data stored on processing infrastructure; and
b. disruption to digital services relying on that infrastructure.
It then provides a more detailed list of factors that might increase the likelihood or severity of these risks (e.g., risks that access to sensitive data / systems are compromised, risks of physical or supply chain concentration, and risks of state actor influence), and requests input on whether these are the correct risks for the UK Government to address.
2. The current state of data center security. The second part of the call for views focuses on data centers (which, unlike cloud service providers, are not fully in scope of the UK’s Network and Information Security Regulations). It requests information from data center operators and their customers on:
a. whether the types of risks described in Part 1 have been sufficiently mitigated;
b. whether and how data center security practices have changed in recent years;
c. whether respondents would like the Government to take additional measures (e.g., legal requirements to maintain a certain level of security, to share information about incidents, or conduct penetration testing, and accountability at a high management level. Notably, a number of these measures appear similar to those set out in the EU’s NIS2, which you can read more about here); and
d. information about the effectiveness of other countries’ frameworks, as well as the costs (e.g., employee time, legal costs) of complying with those frameworks.
3. Mapping the impact of risks. Finally, the call for views requests information from data center operators and cloud service providers only about their customer base, including information about the sectors their customers operate in. The Government indicates that its aim is to understand which sectors are affected most by the security risks outlined in the first part, and the extent to which they are affected.
Respondents can submit their views until July 24, 2022. After that, the Government will provide a response, and further down the line may progress to drafting new legislation covering cybersecurity requirements for data centers and cloud providers.