From NIS2 to the Supply Chain: Data Centers Are Becoming the Intersection of Regulation and Cyber Risk

Introduction

Data centers have long ceased to be merely a combination of real estate and mechanical and electrical engineering; they are the physical hosting layer for cloud computing, AI training, industrial control systems, and government data processing. In its publicly available “Data Centers” topic page, international law firm Squire Patton Boggs systematically lays out the full-lifecycle issues of this industry, from site selection, financing, construction, and operations to dispute resolution, with cybersecurity, data privacy, regulatory compliance, and supply chain risk listed as separate key areas. This perspective deserves the attention of corporate security leaders: when regulators and capital providers begin to treat data centers as critical infrastructure, security ceases to be merely a problem for the operations team and enters discussions of contract terms, financing conditions, and corporate governance.

Event Overview: An Industry Map from a Legal Perspective

This topic page is not the disclosure of a particular security incident, but an issues map for participants across the data center lifecycle. The key areas listed on the page include:

• AI: Enterprise adoption and development of AI solutions are significantly driving up demand for data center capacity; the related content also touches on data privacy, intellectual property, competition law, and regulatory policy.
• Cloud hosting services: Covers IaaS, PaaS, SaaS, hyperscale environments, edge and distributed computing, as well as outsourcing of business-critical platforms and multi-party data supply chains.
• Cybersecurity: Includes response options and obligations for incidents such as ransomware, personal data breaches, unauthorized disclosure, and phishing emails, engagement with law enforcement, regulators, data protection authorities, and insurers, breach notification, crisis management response, and resulting litigation.
• Data privacy: Laws, policies, and litigation risks involved in data collection, commercialization, storage, and cross-border transfers.
• Antitrust and competition: “No-poach” arrangements in data center construction, exchanges of competitively sensitive information (such as pricing and customer data), and scrutiny of hyperscalers’ market dominance; regulatory compliance risks explicitly point to the EU NIS2 Directive and the Data Act.
• Construction engineering: Uninterruptible power supply (UPS), cooling solutions, building management systems (BMS), fire and security, heating, ventilation, and air conditioning (HVAC), modular construction, critical testing and commissioning mechanisms, and the downward pass-through of operations agreements and service level agreements (SLAs).
• Corporate structure and financing: OPCO/PROPCO structures, M&A transactions, and financing bankability design around power availability, resilience, long-term land arrangements, fiber connectivity, redundancy, and service level obligations, including phased construction, modular rolling delivery, capacity reservations, and tiered commissioning tied to resilience and performance testing.
• Energy: In the context of grid strain, shifting to on-site generation and dedicated-line power supply arrangements, while managing carbon emissions and energy market volatility risk.These items together outline one fact: the risk boundary of a data center is far broader than "computer room security."

Technical and Risk Analysis: The Four Layers of a Data Center's Attack Surface

Based on the description in this feature, the network and operational risks of a data center can be roughly divided into four mutually overlapping layers.

Layer 1: Physical and building systems layer. UPS, cooling, BMS, fire protection, and security systems originally fell within the engineering domain, but in modern data centers they are generally networked and remotely manageable systems. Once BMS and operations networks lack isolation from IT networks, attackers may be able to affect availability through engineering-side entry points. The feature lists BMS, fire protection, and security alongside UPS and cooling as contract and engineering issues, showing that these systems simultaneously have the dual attributes of "security equipment" and "attacked assets."

Layer 2: Cloud and hosting platform layer. IaaS, PaaS, SaaS, hyperscale environments, edge and distributed computing, and outsourcing of business-critical platforms constitute a service chain with multiple parties and multiple layers of outsourcing. Where the boundaries of responsibility lie, who can access what, and how failures and security incidents are reported all need to be clarified in contracts, yet in reality these details are often obscured by the wording of SLOs and SLAs.

Layer 3: Identity and data layer. Breach notification, cross-border data transfers, data sovereignty, and data commercialization are themes repeatedly mentioned in the feature. Once an identity system is compromised, the attacker gains not only a particular customer's data, but possibly lateral movement capability in a multi-tenant environment.

Layer 4: Supply chain and third-party layer. Modular construction, long-lead equipment procurement, subcontractors, suppliers, and co-investors all enter the data center delivery and operations chain. The feature explicitly mentions that its cybersecurity work includes due diligence on third-party service providers, M&A, and joint ventures. This layer is often the hardest to audit and the hardest in which to quickly define responsibility when an incident occurs.

It should be noted that the source content is a mapping of issues from legal and commercial perspectives and does not disclose specific attack incidents, attack organizations, or statistical data. Therefore, this article does not make any inferences about attack frequency, loss amounts, or attribution.

Enterprise Impact Analysis

Operational risk. The availability of a data center directly determines whether downstream businesses can operate. Once engineering-side systems (power supply, cooling, BMS) are disrupted, the impact is physical and cannot be avoided by switching cloud regions.

Financial risk. The financing section of the feature shows that power availability, resilience, redundancy, and service-level obligations are themselves assessment factors for financing bankability. Poor security and resilience performance may directly affect financing terms and project timelines; capacity reservation and tiered commissioning being tied to resilience testing means that "failing the test" has clear commercial consequences.Compliance risk. In the EU context, the NIS2 Directive and the Data Act are explicitly listed as sector-specific regulatory requirements, while also involving multi-party engagement with data protection authorities, law enforcement agencies, and insurers. For data center companies operating across borders, the same set of security controls may need to satisfy differing notification deadlines and evidentiary requirements across multiple jurisdictions.

Brand and customer trust risk. A single breach in a multi-tenant environment affects all tenants. In the feature, “breach notification,” “crisis management response,” and “related litigation” appear side by side, indicating that the chain of consequences of an incident extends from technical response to customer communication, regulatory reporting, and legal proceedings.

Data risk. Data sovereignty, cross-border transfers, and data commercialization are intertwined, meaning that data placement location and access paths are themselves compliance decisions, rather than purely technical architecture choices.

Industry Trend Observations

First, AI-driven capacity demand and security demand are rising in tandem. The feature notes that AI adoption is significantly increasing data center capacity demand. Capacity expansion is usually accompanied by pressure for rapid delivery, and rapid delivery and rigorous security reviews are naturally in tension in terms of pace.

Second, regulation is moving from “recommendations” to “enforceable obligations.” NIS2 and the Data Act are explicitly named and directly linked to objectives such as “facilitating supplier switching” and “protecting security,” indicating that regulatory attention is not only on point-level security but also on market structure and substitutability.

Third, security is being written into commercial contracts. UPS, cooling, BMS, fire safety and security, SLA flow-down, O&M agreements—these clauses essentially convert security and resilience requirements into accountable contractual obligations. This changes the positioning of security teams: increasingly, they need to provide technical judgment for procurement and legal.

Fourth, energy constraints are becoming a resilience variable. Grid strain is driving on-site generation and dedicated-line power supply arrangements, placing energy security and cybersecurity side by side on the same risk register.

Fifth, industry consolidation brings due diligence pressure. As M&A, strategic partnerships, and cross-minority equity investments increase, cybersecurity posture will become part of deal due diligence and closing conditions.

Taken together, this is not an isolated event but a structural industry change: the role of data centers is shifting from “facilities” to “regulated critical assets.”

Defense and Response Recommendations

Enterprise level (identity and access)

• Implement strong authentication and least privilege for operations, engineering, and third-party remote access, and avoid shared high-privilege accounts.
• Implement network isolation for management interfaces of engineering systems such as BMS, UPS, and cooling, and establish clear boundaries and monitoring with the IT network.
• Extend the scope of vulnerability management to engineering-side software and firmware, not just servers and endpoints.

• Technical level (detection and response)- Use SIEM to aggregate IT and OT/engineering-side logs, so that anomalous operations of physical systems can be viewed on the same timeline.
• Deploy EDR/XDR on endpoints and servers, and use threat intelligence to identify known techniques targeting managed service providers and cloud environments.
• For multi-tenant environments, focus on validating lateral movement detection capabilities, rather than only validating perimeter defenses.

Management Level (Governance and Third Parties)

• Establish executable incident response procedures, specifying communication paths and internal authorization with law enforcement, regulators, data protection authorities, and insurers.
• In contracts, clearly write out security requirements, notification timeframes, audit rights, and allocation of responsibilities, and ensure SLAs can be passed down to subcontractors and suppliers.
• Move third-party risk management forward to the procurement and investment decision-making stage: the cybersecurity posture of suppliers, M&A targets, and joint venture partners should be included in the due diligence checklist.
• At the financing and construction stages, bind resilience metrics to commissioning and acceptance standards, avoiding security and resilience becoming something patched in only after delivery.

SecurityPost Insight

The real value of this data center issues map from a legal perspective lies not in how many risks it lists, but in the shift in position it reveals: cybersecurity for data centers is moving from a KPI of operations teams to a part of financing conditions, contract terms, M&A due diligence, and regulatory filings.

For corporate security leaders, three points are worth noting. First, the attack surface has already crossed IT and engineering boundaries; BMS, UPS, cooling, and fire protection are no longer merely “facility issues,” and incorporating them into asset inventories and logging systems is a necessary action. Second, regulation is intervening through industry-specific rules; the approach represented by NIS2 and the Data Act—protecting security, promoting switching, and constraining market dominance—means that security capabilities will be deeply coupled with market access and commercial relationships. Third, the capacity expansion pressure brought by AI will, for a considerable period, create tension with security reviews; those who can move resilience requirements earlier into the design and contract stages are more likely to strike a balance between delivery speed and risk control.

For some time to come, what deserves continuous attention is not any single incident, but two changes: whether regulation will further turn “supplier switchability” and “resilience disclosure” into hard requirements; and whether, in M&A and financing activities, cybersecurity due diligence will move from optional to a standard clause. For CISOs, participating early in procurement, legal, and investment decisions may be more valuable than adding another security appliance.