Developers of US data centers face significant, complicated and evolving challenges beyond the more familiar if still formidable complexities associated with permitting, power and water. Where a facility is built, where its equipment was made, who can see or control the systems on which it depends, and who can reach the data and compute inside are increasingly important concerns. Addressing these questions before procurement and commissioning can reduce developers’ exposure to regulatory change and to operational disruption by sophisticated threat actors and, moreover, can better position developers to respond to government scrutiny and oversight.

Recent incidents illustrate the physical consequences of compromised control systems. In October 2026, attackers compromised refrigeration controllers at hundreds of French supermarkets, raising temperatures and forcing affected stores to discard stock.¹

Data centers are distinctively attractive targets: They hold concentrated sensitive data across sectors, house advanced chips that US export controls strive to keep from adversaries, and can cause widespread disruptions if compromised. 

US agencies warn that state-sponsored actors are pre-positioning on US critical-infrastructure networks to enable disruption during a major crisis or conflict. In March 2026, drone strikes directly hit two Amazon Web Services facilities in the United Arab Emirates, while a nearby strike damaged a third facility in Bahrain, illustrating data centers’ appeal as targets when conflict erupts.² Artificial intelligence (AI)-enabled tools can also expand the cyber capabilities available, especially to less sophisticated non-state actors. 

In addition to targeting the systems that process data, foreign adversaries may use cyberattacks and surveillance malware on servers and supporting systems such as cooling systems and building-management software. Risks can also arise from foreign investors, suppliers, vendor connections or customers. 

These risks should be monitored and evaluated throughout a project’s full life cycle. WilmerHale has the experience to provide sound legal, business-tailored and operational advice to guide and support clients from predevelopment through operation. To explore WilmerHale’s latest insights and legal guidance related to data centers, please see our data centers page. 

What to Do, by Project Stage

If You Are Planning a Data Center

• Assess location. Assess whether the site falls within the Committee on Foreign Investment in the United States (CFIUS) real estate jurisdiction, including proximity to listed military installations or location within a covered port. Separately evaluate whether the business’s infrastructure functions, including at submarine cable landing points, make foreign investment reviewable. Document the jurisdictional analysis.
• Screen capital and partners. Foreign investors, joint venture partners or minority stakes may trigger CFIUS or other national security scrutiny. Build into the project schedule the time necessary for what is often a complex review.
• Evaluate overseas siting. For projects outside the United States, evaluate host-country legal environments, regional stability and asset suitability.
• Trace the critical supply chains to source countries. For power, cooling, control, security and network systems, establish where the equipment and its firmware and software are designed, manufactured, assembled, programmed, updated and serviced. Identify who ultimately owns or controls each vendor.
• Confirm compliant access and data flows. During planning, identify systems that could communicate externally, through which channels and with whom. Assess whether vendor, employment and investment arrangements could give countries of concern or covered persons access to data covered by the Department of Justice (DOJ) Data Security Program.
• Build export control diligence into the customer life cycle. Establish know-your-customer and end-use diligence for tenants and cloud customers. Use the Bureau of Industry and Security’s (BIS) red-flag guidance for advanced computing chips.
• Allocate security obligations by contract. Ensure that procurement terms require origin and ownership disclosures, bills of materials, authenticated updates, vulnerability disclosures and incident notification. Preserve audit and testing, substitution, and termination rights.
• Define responsibilities across the operating chain. Allocate customer diligence, access approvals, incident escalation, evidence preservation and recovery among owners, operators, cloud providers and tenants. Preserve rights to obtain information and suspend access when necessary.

If You Are Already Building a Data Center

• Reexamine committed equipment. Review selections, orders or installations against provenance and remote-access criteria, prioritizing the highest-consequence systems. For bulk-power system equipment, assess potential exposure under Executive Order 14421³ and the Department of Energy’s (DOE) implementation; coverage depends on the equipment, foreign connections and required DOE determinations and excludes local distribution facilities.
• Harden exposed equipment. Protect or relocate critical cooling, power and generator equipment that is exposed to physical attack, and confirm on-site redundancy for power and cooling subsystems.
• Disable remote access by default. Where access is necessary, require phishing-resistant multifactor authentication, approval, least privilege, time limits, logging and monitoring. Review vendor pathways that bypass enterprise controls.
• Segment networks. Separate power, cooling, building controls, physical security, life safety, corporate and tenant environments to contain potential compromises.
• Vet personnel and contractors who have privileged physical or network access.

If You Already Own or Operate a Data Center

• Maintain a current inventory of hardware, software, firmware, connectivity, vendors and support paths, and plan for end-of-life equipment before it falls out of support.
• Hunt for pre-positioning. Apply the Cybersecurity and Infrastructure Security Agency’s (CISA) Volt Typhoon mitigation steps,⁴ focusing on vendor access, credentials and information technology (IT) to operational technology (OT) pathways; these are the routes through which dormant access can move laterally into operational technology.
• Audit access to systems and data. Confirm which vendors, contractors, employees, investors and tenants can access data and systems, from where, and under what agreements. Assess DOJ Data Security Program compliance.
• Monitor customers and end users for export-control risks, including indications of diversion, restricted end users or remote access to advanced computing capacity by restricted parties.
• Reduce common-mode dependencies. Identify where redundant systems or sites share a vendor, firmware, substation, fiber route, water source or control path. Qualify alternate suppliers and maintain critical spares where feasible.
• Evaluate disruption readiness. Test whether the facility can operate safely without vendor support or external connectivity, and run incident-response exercises covering cyber, physical and grid scenarios.
• Plan legal escalation and notifications. Assign responsibility for applicable government and customer notifications, preserve evidence and involve counsel promptly in incident response.
• Stress-test insurance before an incident. Assess how cyber and property policies treat physical damage from a cyberattack. Review state-backed cyber operation and war exclusions and the attribution standards those exclusions use.

The five risks below explain the legal and operational considerations underlying these project-stage recommendations.

Key Risks

1. Site Selection, Governance and Investment

Site selection and investment terms can create separate bases for CFIUS jurisdiction. Its real estate rules cover certain purchases, leases and concessions by foreign persons near designated military installations, subject to geographic limits and exceptions; the Department of the Treasury expanded that coverage in November 2024.⁵ Separately, CFIUS can review transactions that could result in foreign ownership or control of a US business and certain noncontrolling investments in businesses involving critical technologies, specified critical infrastructure or sensitive personal data (TID US businesses). For a qualifying TID US business, board or observer rights, access to material nonpublic technical information, or involvement in specified substantive decisions can bring a minority investment within scope. Colocation at a submarine cable landing point warrants analysis of the business’s infrastructure functions and the investor’s rights; proximity alone does not establish CFIUS jurisdiction.

Diligence should trace ultimate ownership and control and evaluate governance and information rights before those rights are committed. For overseas projects, Treasury’s Outbound Investment Security Program may prohibit or require notification of certain investments by US persons involving covered foreign persons connected to China, Hong Kong or Macau and specified semiconductor, quantum or AI activities.⁶ Applicability turns on the parties, transaction structure and covered activities rather than the data center label. These assessments can affect financing terms, closing conditions and the project schedule.

2. Foreign-Sourced Technology

Foreign-adversary exposure can reside inside the systems that keep a facility running: power equipment, cooling, building-management controls, and their embedded firmware and software. The relevant questions include who can alter operating settings, authenticate updates, retrieve telemetry or interrupt support. Equipment provenance should be assessed alongside supplier ownership, software dependencies and continuing access throughout the equipment’s service life.

The National Institute of Standards and Technology’s (NIST) supply-chain guidance addresses malicious functionality, counterfeit components and vulnerabilities arising from poor manufacturing or development practices. For counsel, the consequential issue is whether procurement and maintenance arrangements provide sufficient visibility and enforceable rights to manage those exposures. Long equipment lead times and dependence on proprietary service tools can make replacement difficult after commissioning. Origin and ownership disclosures, update controls, incident notification, and practical substitution rights therefore warrant attention before procurement commitments become difficult to unwind.

The Department of Commerce’s information and communications technology and services (ICTS) authority permits review, mitigation or prohibition of covered foreign-adversary-linked transactions that pose undue or unacceptable risks, independently of CFIUS or export controls. John S. McCain National Defense Authorization Act Section 889 restrictions on covered telecommunications and surveillance equipment can also affect federal contracting eligibility, subject to applicable scope, exceptions and waivers.⁷

3. Access to Systems and Data

Vendor portals, remote diagnostics, cloud monitoring and maintenance connections can create privileged access outside an operator’s ordinary enterprise controls. Diligence should identify the systems and data reachable through each connection, including independent cellular links, subcontractor access and credentials retained after installation. The DOJ-administered Data Security Program adds a distinct compliance obligation where covered transactions give countries of concern or covered persons access to US government-related data or bulk US sensitive personal data. Subject to applicable exemptions, data brokerage and certain other transactions are prohibited, while covered vendor, employment and investment agreements are restricted and require compliance with prescribed security and other requirements. Operators should establish whether they or their service providers can access covered data and allocate access controls, diligence, audit and reporting responsibilities accordingly.

4. Customers and Tenants

Customer diligence should address beneficial ownership, actual end users and intended end uses of advanced computing capacity, including access arranged through resellers or intermediaries. BIS’s May 2025 guidance identifies diversion red flags and explains how existing controls can apply to advanced chips used to train AI models for military-intelligence or weapons-of-mass-destruction end uses.⁸ Depending on the facts, a change in end user or end use, or support by a US person, can require authorization. Remote access therefore calls for a transaction-specific analysis of the items, parties, activities and applicable knowledge standard; the physical location of the chips does not resolve the issue.

Office of Foreign Assets Control (OFAC) sanctions can independently restrict counterparties and services. Screen customers and beneficial owners at onboarding and periodically thereafter; entities owned directly or indirectly 50 percent or more in the aggregate by blocked persons are themselves blocked, even if not separately listed.

Physical diversion remains a separate exposure. In March 2026, DOJ charged three individuals with allegedly conspiring to divert servers containing controlled US AI technology to China.⁹ BIS’s May 2026 guidance also confirmed the continuing license requirement for specified advanced computing items destined outside the United States for entities headquartered in, or with ultimate parents headquartered in, Country Group D:5 or Macau, subject to certain exceptions.¹⁰ The guidance preserves ongoing use, storage, disposal and servicing by bona fide data center operators otherwise acting consistently with the Export Administration Regulations (EAR) until further notice. Customer onboarding and contractual assurances should be paired with procedures to resolve red flags and reassess material changes in ownership, end users or use.

5. Dormant Access and Coordinated Disruption

Persistent access can create a latent disruption risk long before an outage reveals it. Notably, CISA, NSA and FBI assess that the People’s Republic of China state-sponsored group Volt Typhoon has compromised US critical-infrastructure IT networks and is pre-positioning to enable movement into OT for disruption during a major crisis or conflict.¹¹ For data center operators, this risk latency makes connections between enterprise networks, vendor support, and power or cooling controls a business-continuity concern, with implications for incident escalation and recovery planning.

Resilience also depends on shared dependencies across nominally redundant systems and sites. Common vendors, firmware, control platforms, substations or telecommunications routes can allow one compromise or external event to affect multiple facilities. The North American Electric Reliability Corporation (NERC) has documented simultaneous data center load reductions following grid disturbances; sudden, large load losses can raise grid frequency and voltage, although the effects depend on system conditions.¹² Those events demonstrate a reliability mechanism, rather than evidence of coordinated attacks. Counsel should test whether continuity commitments, recovery arrangements and cyber and property coverage address correlated outages, prolonged loss of vendor support, and applicable war-related or state-backed cyber-operation exclusions.