FCS response to Department of Science, Innovation and Technology consultation: Protecting and enhancing the security and resilience of UK data infrastructure

The FCS represents companies which provide professional communications solutions to business users. Our members deliver telecommunications services via mobile and fixed line telephony networks, broadband, satellite, wi-fi and business radio. Our members’ customers range from SMEs, home-workers and micro-businesses up to the very largest private enterprises and public sector users. The FCS is the largest trade organisation in the professional communications arena, representing the interests of circa 350 businesses which supply B2B services nationwide.

The FCS welcomes BIST’s focus on security and resilience of UK data infrastructure and agrees that data centres play an increasingly important part in the UK economy.  To enable the UK economy to grow, the tens of thousands of businesses who use data centres need to have the confidence that their data, applications and hardware are secure and resilient. It is also imperative that regulatory safeguards are in place to prevent adverse impacts of failure of a data centre, or part of the data centre supply chain, and, therefore, ex-ante regulation needs to be considered.  

With the move to all-IP, data centres should increasingly be seen as an essential service in the same way that energy services are viewed.  It is important that confidence is built up throughout the supply chain and that clear responsibilities are identified at every part of the chain. 

As a trade organisation representing varied businesses, we have a number of general comments that we think will be useful to the debate:

1. The FCS believes that regulation needs to be focused on the appropriate part of the supply chain. To promote economic growth and innovation, it is important that the supply chain is properly understood, and regulation focused on the wholesale market. This will allow the most efficient outcomes, with costs appropriately spread throughout the supply chain. This should also help to ensure standardisation across the industry.
2. To ensure that appropriate remedies are put in place, the FCS suggests that it may be beneficial to complete a formal market review in the data centre market, an action that Ofcom will be well placed to conduct. Data centres are a key part of the communications infrastructure and need to be treated as such.
3. We agree that any new regulation should exclude public electronic communication services and networks as they are already covered by regulation, and specifically by the Communications Act 2003.
4. In relation to cloud and managed service providers, it will be important that obligations are clear, and the FCS does not support a split in regulatory responsibilities. It will be important that requirements cover physical infrastructure as well as the application/service level, whether this is to be regulated by NIS regulation or by the newly proposed regulations. The

FCS suggests that minimum resilience standards should be put in place for cloud/managed service providers, with an obligation for providers to inform customers clearly of their resilience measures – transparency within the market should help to increase standards and give customers real choice.

5. Owners of data centres should ensure that there are appropriate physical security measures in place. Additionally, it will be important that there are obligations in relation to energy security and resilience, ensuring that there are minimum requirements to safeguard these services to data centres. Again, it will be important that data centres are obligated to inform customers clearly what resilience provisions are in place, which again will help to drive competition and increase standards.
6. We agree that provision should be made for potential insolvency of significant data centres or other operators to prevent loss of cumulative UK capacity (Q42). This is increasingly important to safeguard service. A supplier of last resort model should be considered, and adequate time given for customers to arrange alternative provision where necessary.  Such resilience may also be needed at different levels in the supply chain, for example, obligations on cloud/managed service providers should be considered to allow for hosted services to be transferred to another provider in the case of insolvency or other difficulties.  

The FCS would welcome the opportunity to discuss these points with the BIST and are very happy to provide any clarification if helpful.

February 2024