Compute, Connectivity and Cloud: Data centre growth has to focus on regulation and ...

Data centres in India have moved well past their original co-location role. Over the past four to six years, they have added compute, connectivity and cloud access under one roof, placing themselves at the centre of the country’s digital infrastructure chain, rather than at its edge. This shift brings two consequences that operators cannot really separate from each other: a heavier regulatory footprint on the connectivity side of the business and a wider cybersecurity surface that grows in step with every new service layered on top.

Three key drivers of the shift

The shift is being driven by three factors. The first is straightforward customer demand. Operators today want a single provider for compute, connectivity and cloud, rather than piecing together solutions from multiple vendors. The second is global connectivity. India is connected to more than 20 international submarine cable systems, with several additional cable projects under deployment or planned. The continued expansion of this subsea infrastructure is strengthening India’s position as a regional digital connectivity hub, improving data flows between Asia, Europe and North America. Together with growing digital demand and data center investments, this enhanced connectivity is helping attract hyperscalers to expand their presence in the country. That flow is expected to reverse over time too, as India’s own artificial intelligence (AI), gaming and fintech sectors mature and begin generating enough data and demand of their own to send traffic back out rather than only receiving it. The third is the growth of cloud, AI and edge computing, -generation applications built around 5G and future 6G networks, autonomous vehicles, humanoids and smart factories are expected to need latency as low as 1 to 10 milliseconds, demanding seamless integration between data centres, cloud platforms and edge locations. None of these three forces is new in isolation, but what has changed is how tightly they now depend on each other inside a single facility.

Shifting of regulatory boundaries

Bringing that connectivity together pulls data centres into telecom regulation, since connectivity itself is a licensed and regulated business in India as it is worldwide. Where data centres once offered only co-location, passive space, racks, power, cooling and physical security, they are now taking on equipment, network functions and traffic carriage of their own, pushing them from passive and unregulated territory into hosting, connecting and carrying activity that is regulated. For an operator used to thinking of itself purely as a landlord for compute, this is a significant change in how the business needs to be licensed and run.

This has coincided with a broader shift in telecom licensing. Recently, the Department of Telecommunications introduced a new authorisation framework, alongside the existing licensing regime. Under this, a data centre offering cloud-hosted telecom network functionality to smaller internet service providers (ISPs), virtual network operators and cloud communication players needs a cloud-hosted telecom network service authorisation. A data centre already providing internet access needs what was an ISP licence, now becoming an internet service authorisation, which also folds in domestic leased bandwidth previously under a separate national long-distance licence. Bandwidth providers moving between domestic and international capacity, previously split across national long distance and international long-distance licences, now fall under a single long distance service authorisation covering both. The overall direction is towards fewer and broader authorisations, rather than a growing patchwork of narrow licences, which should, in principle, make the regime easier to navigate, once operators have made the initial adjustment.

Migration is optional, but the calculus is business-specific

Moving to this new authorisation regime is not mandatory. Operators can apply for it up to a year after their existing licence expires and whether it makes sense depends on each organisation’s own business case, weighing potential commercial and operational advantages against the compliance cost.

Connectivity itself can become a genuine growth engine, giving operators new revenue streams and customer stickiness as a one-stop shop for both compute and connectivity. The authorisation an operator needs follows from its business model rather than the other way round. Besides, regulatory readiness, understanding eligibility, security obligations, customer onboarding and compliance costs need to be sorted before any commercial launch, not after.

Cybersecurity threats are broader than AI headlines suggest

AI-specific risks dominate most boardroom discussions, but a wider set of threats is just as relevant to data centre operators. Boards understandably focus on the newest, most talked risk, but attackers are just as happy to exploit an old, familiar weakness left unaddressed. Third-party dependence is one of these, with operators relying on outside providers for information systems, software and networks in ways that widen their exposure. Physical assets need the same rigour as information systems.

ESG compliance is adding its own pressure through construction-and-water related requirements, particularly as growth spreads into Tier 2 and Tier 3 cities. Customer expectations are rising too, with operators increasingly expected to hold certifications spanning security, business continuity and service operation centre (SOC) compliance, given how many regulated customers, from banks to insurance companies to telecom operators, rely on data held within these facilities. Internal risk has not gone away either, breaches by employees or contractors remain a significant and persistent threat besides anything coming from outside.

On the AI-specific side, key threats include AI-assisted phishing and social engineering, advanced ransomware that increasingly evades traditional defences, supply chain attacks and identity-based attacks, all accelerating as AI itself is used both to find and exploit vulnerabilities faster than organisations can patch them.

Eight priorities, built around a recognised framework

Organising a response to these risks starts with mapping them against the NIST Cybersecurity Framework, resulting in eight priorities spread across four pillars – protect; detect; respond and recover; and govern. Anchoring the response in an established framework rather than a bespoke checklist gives operators something they can benchmark against and explain to customers and regulators alike, rather than relying on an internal standard nobody outside the organisation can easily assess.

Under protect, identity is treated as the security perimeter, with least privilege access enforced as standard and a consistent security baseline maintained across every site, even where different facilities run under different operating models. Visibility over the full asset base and specifically over an organisation’s most sensitive crown jewel systems is treated as a precondition for deploying any control, since assets that cannot be seen cannot be protected.

Under detect, the priority is unified threat visibility across environments, delivered through automated detection and response run out of a security operations centre and a SIEM deployment, with AI-enabled detection specifically called out, given how fast AI-driven threats are evolving.

Respond and recover covers breach reporting obligations, contractual compliance commitments to customers, evidence retention against agreed service levels and resilience drills robust enough to go beyond a simple tabletop exercise into real time, scenario-based testing. It also covers automated threat response, playbooks that can isolate a compromised server without waiting on manual intervention, rapid threat containment, accelerated remediation once crown jewel systems have been identified in advance and the resilience that comes from immutable backups and an isolated recovery environment that can be restored if the primary is compromised.

Govern ties the other three pillars together, encompassing policy, breach reporting, regulatory alignment and board-level oversight of the entire programme. Without this pillar, the other three risks becoming a set of disconnected technical fixes rather than a programme that the board can actually stand behind.

Closing the gaps means different things for different stakeholders

These priorities map on to gaps in India’s current cybersecurity ecosystem, including weak access controls, limited visibility into service accounts and shadow systems, inconsistent resilience and recovery testing, uneven security maturity between hyperscale and edge sites, a shortage of cyber talent, slow attack response caused by manual and fragmented processes, gaps in readiness for AI-powered attacks, and expanding risk from vendors, contractors and cloud providers.

Closing these gaps calls for action on three fronts. Operators need to adopt zero- trust principles, improve visibility across their assets, test recovery capabilities regularly, and secure both operational and information technology from a physical standpoint. Policymakers need to set common security standards, develop and retain cyber talent and encourage threat information sharing across the industry, since knowing what is happening elsewhere strengthens everyone’s defences. Technology providers need to prepare for AI-enabled threats by securing their own AI systems, models and training data; support the industry with real-time threat intelligence and analytics; and manage vendor risk through proper third-party due diligence.

Regulatory readiness and cybersecurity resilience are no longer separate conversations for data centre operators. Both now sit at the centre of how an operator competes, not at the edge of compliance and both point in the same underlying direction, connectivity and security decisions that used to be made reactively, once a customer asked or a regulator required it, increasingly need to be built into how a data centre is planned and run from day one.