Major data centres to meet stricter security, resilience rules with the passing of new Bill

The Digital Infrastructure Bill, recently passed by Singapore's Parliament on October 7, aims to enhance security and resilience for large data centers crucial to the nation's digital services. The bill mandates stricter licensing and operational requirements for these centers, focusing on energy efficiency, physical security, and disaster recovery.

To qualify for licensing, data centers must either generate at least S$100 million in annual revenue from Singapore users over three years or utilize at least 10 megawatts (MW) of electrical capacity. Current data centers exceeding these thresholds include Amazon Web Services, Microsoft Azure, and Google Cloud Platform. The amendments to the Cybersecurity Act will also require most data centers to report cyber incidents, similar to current reporting standards for critical information infrastructure operators.

Sen. Minister of State for Digital Development and Information Tan Kiat How emphasized the interconnected nature of digital services, highlighting that disruptions in one can have widespread economic and societal impacts. The bill introduces two licensing categories: foundational digital infrastructure (FDI) and data centre (DC) licences.

FDI licensees must ensure physical and cyber security, develop business continuity plans, and report cybersecurity incidents to the Infocomm Media Development Authority (IMDA). DC licensees will need to meet stringent power usage effectiveness (PUE) requirements, which are still being defined. Tan acknowledged the challenges older data centers may face in meeting these standards but emphasized a commitment to supporting their transition.

The bill seeks to balance the country's digital ambitions with its limited resources, aiming to maintain Singapore's competitiveness while addressing environmental concerns.