Data Infrastructure Risk Reduction Act
- Sponsor
- Rep. Subramanyam, Suhas [D-VA-10]
- Committees
- Homeland Security Committee (primary)
- Last action
- May 8, 2026
Bottom line
This bill aims to enhance national security by fortifying data center infrastructure against threats and mitigating risks to surrounding communities through a comprehensive federal strategy.
What it actually does
This bill mandates the Department of Homeland Security, through the Director of the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Secretary of Defense, to develop a comprehensive strategy within 180 days. This strategy must identify data centers as critical infrastructure, assess the security of their power and water supplies, and consider the implications of data centers located near residential areas. The goal is to defend these facilities from external breaches and protect surrounding communities.
Proponents argue
Supporters argue this bill is a crucial step in recognizing data centers as vital national infrastructure, essential for economic stability and national security. They contend that a proactive federal strategy is necessary to protect these facilities from increasingly sophisticated external threats and to address potential environmental or safety concerns for nearby communities, ensuring resilience in the digital age.
Opponents contend
Critics might argue that this bill could lead to overreach of federal authority into private sector operations, potentially imposing burdensome regulations on data center operators without sufficient justification or clear benefit. Some may also contend that existing cybersecurity frameworks are adequate or that the bill's focus on physical infrastructure and community protection might divert resources from more pressing cyber threats.
The bill is exceptionally short and straightforward, allowing for a quick and easy understanding of its provisions.
Section 2(a)
Data Center Critical Infrastructure Strategy Mandate
This provision directs the Department of Homeland Security, specifically the Cybersecurity and Infrastructure Security Agency (CISA), to work with the Department of Defense to create a strategy within 180 days of enactment. This strategy must identify data centers that should be treated as critical infrastructure, assess the security of their power and water supplies (especially above-ground lines and substations), and evaluate the risks data centers pose to nearby communities. The final strategy will include recommendations to protect these data centers from external breaches and safeguard residential areas.
Supporters argue
Supporters argue this provision is essential for national security, ensuring that the critical digital infrastructure underpinning the economy and government functions is adequately protected from both cyber and physical threats. They emphasize the importance of a coordinated federal approach to address vulnerabilities in power and water supply and to proactively manage risks to surrounding populations.
Critics contend
Critics might argue that this mandate could lead to an expansion of federal bureaucracy and potentially duplicate efforts already undertaken by private industry or state and local governments. Some may also contend that the scope of 'critical infrastructure' for data centers could become overly broad, leading to unnecessary regulatory burdens.
Tradeoffs
The bill balances the need for robust national security and infrastructure protection with concerns about federal overreach and potential compliance costs for private industry. It also seeks to balance the economic benefits of data centers with the safety and environmental concerns of nearby communities.