Who decides what a data centre must withstand?
In four days this month, drone strikes put two of a large technology company's data centres out of service and damaged a third. Canada's standards leave the threat a data centre must withstand to its owner. A board that depends on one should know who made that decision.
Most boards I work with can describe the controls that protect their data from a cyber attack. Few can say what the building that holds the data is designed to withstand, or who decided. That question stopped being theoretical this month.
What happened in October
Between 8 and 11 October 2026, drone strikes in the war between Russia and Ukraine hit three data centres belonging to Yandex, the Russian technology company. Yandex said two of the sites were taken completely out of service and part of the third was disabled. One of them held two of the three supercomputers the company uses to train its AI model. Users reported problems with streaming, digital banking and other services run by companies with no part in the conflict, and Yandex told its own customers to activate their disaster recovery plans.
These were not the first. In March, drone strikes damaged commercial cloud data centres in the United Arab Emirates and Bahrain. Since late September, Russian drones have been striking data centres in Ukraine. In each case the targets were commercial buildings, attacked from the air.
The decision sits with the owner
Canada's blast design standard, CSA S850:25, requires the owner of a building to define the threat the building is designed against. The federal physical security guidance leaves that definition to each department, and none of it names the drone as a means of delivery. The standard also excludes the penetration, fragmentation and fire that these weapons produce. The decision belongs to the owner. Unless the owner has made it deliberately, the building's protection reflects whatever threat its designers assumed.
For a federally regulated financial institution, this is now a supervisory question as well. OSFI Guideline E-21, which applied in full from 1 September 2026, asks each institution to test its critical operations against severe but plausible disruption, including disruption to the facilities they depend on. The guideline's examples are power outages, large-scale technology failures, critical third-party service disruptions, cyber incidents, natural disasters and health pandemics. It names no physical attack, so each institution has to decide for itself what severe but plausible means for a data centre.
Oversight and management
The line I draw for cyber risk applies here too. Management, or the operator it contracts, defines the threat and the protection. The board approves the threat the company is prepared to accept, the same way it approves risk appetite, and it asks how that decision is tested.
Five questions for management
These are the questions I would put to management:
- What threat is each critical facility designed to withstand, and who adopted that decision?
- Does that threat include drones and other attacks from a distance, or only the vehicle-borne and person-borne threats in federal guidance?
- Which parts of the facility are most exposed, such as cooling plant on the roof or generators in an open yard?
- If the facility were lost, where would the critical workloads run, and when was that last tested?
- Who confirms each year that the answer still holds?
Where the answer comes from
The answer starts with a written threat definition that the owner adopts, with a protection level for each part of the facility. An assessment then measures the facility against it, a plan sets out the work, licensed engineers engaged by the owner carry the work out, and an annual review keeps the record current. Move Add Change does this work under its Kinetic Protection Standard, KPS-1.
Read about kinetic protection services
The test I apply is the one I use for cyber risk. Every director should be able to say what the company's critical facilities are built to withstand and who decided. When they can, the board is overseeing the risk.