UK2 Notice Template

The Department for Science, Innovation & Technology (DSIT) is seeking a supplier to conduct a comprehensive risk assessment of data centres in the UK. The assessment must systematically evaluate the sector across a range of critical risk vectors, ensuring that all relevant threats and vulnerabilities are identified and addressed. This assessment is intended to provide an evidence-based understanding of the current landscape, identifying threats and vulnerabilities that may impact the resilience and security of data centre operations. The scope of the assessment is broad, encompassing physical security, personnel security, operational technology (OT) security, business continuity, supply chain security, risk management, data centre facilities and data protection.

Whilst cyber security risks will play a part in this report (e.g. insider threat), they should not be the primary focus as DSIT can pull on an existing body of knowledge relating to the cyber vector.

The work should identify and rank all vectors by severity. This risk assessment will play a part in policy development and will be used by DSIT to help identify relevant standards and other mitigations that data centres operators could follow to minimise risk.