Large Russian data centers may fall under the scope of presidential decree No. 604, which permits temporary state management of critical infrastructure facilities with insufficient protection. By default, Rosimushchestvo would assume the role of administrator.
The measure can be applied when an owner fails to fulfill security requirements, poses a threat to stable operations, inadequately protects the facility from drone attacks, or restores operations too slowly after an incident. The decree covers communications, energy, transport, industry, utilities, and other critical sectors.
Industry participants believe that major commercial and departmental data centers serving government bodies, banks, and federal operators clearly qualify. While Tier III and higher facilities usually maintain solid cyber defenses, the primary new expenses will involve physical security measures.
Operators must now protect generators, cooling systems, communication nodes, and other external engineering equipment against aerial threats. The challenge is especially acute in European Russia, where 80–90 percent of commercial data center capacity is concentrated in Moscow and St. Petersburg.
Protection against drones was not previously part of standard data center design. Some companies are already modernizing infrastructure. RTK-DC stated it continuously reviews security measures, while RUVDS confirmed work on safeguarding external equipment.
The market anticipates detailed sector-specific requirements tied to facility category and criticality. Experts highlight the need for redundant communication channels, DDoS protection, vulnerability management, and accelerated recovery processes. Additional protection will require significant capital expenditures that may ultimately be passed on to clients, particularly in government, financial, and telecommunications segments.
First Deputy Prime Minister Denis Manturov assured that no mass campaign or nationalization is planned; decisions will be made on a case-by-case basis at the highest level.
