RISK & RESILIENCY

UI INTELLIGENCE REPORT 76

Electromagnetic
pulse and its threat
to data centers
The state of the industry’s risk assessment and mitigation

Electromagnetic pulse (EMP) poses a risk to data centers and

can permanently damage equipment. To date, many data center
operators have overlooked EMP in their risk assessments. This
report summarizes the types and effects of EMP, and offers
recommendations to assist operators in assessing their EMP risk.

Author
Jacqueline Davis, Research Analyst, Uptime Institute

20-30 MINUTES TO READ

UII-76 v1.0P published 12 August 2022, last updated 12 August 2022 1

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Synopsis
Electromagnetic pulse (EMP) is a rapid discharge of electromagnetic
energy from a natural or artificial source. EMP can disrupt or permanently
damage electronic equipment, posing a potential risk to data centers.
To date, many data center operators have overlooked EMP in their risk
assessments and have not taken protective measures against EMP.

This report summarizes the types and effects of EMP, and offers
recommendations to assist operators in assessing their EMP risk so
that they can implement appropriate protection.

• Data centers can experience • Government and military

disruption or damage from
either artificial or natural
EMP sources.
• Some forms of EMP cause
disruption or damage to
electronic equipment. Others
act most strongly on the
power grid, with secondary
effects on data centers.
• Most data center operators
do not include EMP in their
risk assessments, or include
any protection against it.
infrastructure use a variety of
protective measures against
EMP, some of which may be
useful for nongovernmental
data centers.
• Risk assessments, including
those for EMP, are best
performed periodically as the
risk profile of a data center
can change.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 2

 E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Contents Introduction ----------------------------------------------------------------------------------------------------------------------------------------------4

Types of EMP threats-----------------------------------------------------------------------------------------------------------------------------4
Physical characteristics -------------------------------------------------------------------------------------------------------------------------6
Risk to data centers -------------------------------------------------------------------------------------------------------------------------------7
Nuclear EMP -------------------------------------------------------------------------------------------------------------------------------------------7
Geomagnetic EMP ----------------------------------------------------------------------------------------------------------------------------------8
Intentional EMP --------------------------------------------------------------------------------------------------------------------------------------9
Protective measures ------------------------------------------------------------------------------------------------------------------------------9
Physical security -------------------------------------------------------------------------------------------------------------------------------------9
Shielding ------------------------------------------------------------------------------------------------------------------------------------------------10
EMP detection --------------------------------------------------------------------------------------------------------------------------------------10
Energy storage --------------------------------------------------------------------------------------------------------------------------------------10
Backup techniques -----------------------------------------------------------------------------------------------------------------------------11
Storing protected spares --------------------------------------------------------------------------------------------------------------------11
Surge protection devices --------------------------------------------------------------------------------------------------------------------11
Incremental levels of protection --------------------------------------------------------------------------------------------------------11
Recommendations-------------------------------------------------------------------------------------------------------------------------------12

Illustrations Table 1 ————————————————— 5 Table 2 ———————————————— 12

Types of electromagnetic pulse Electromagnetic pulse protection guidelines

Uptime Institute Intelligence is an independent unit of Uptime Institute dedicated to identifying,

analyzing and explaining the trends, technologies, operational practices and changing business
models of the mission-critical infrastructure industry. For more about Uptime Institute Intelligence, visit
uptimeinstitute.com/ui-intelligence or contact research@uptimeinstitute.com.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 3

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Introduction
Electromagnetic pulse (EMP) is a rapid discharge of electromagnetic energy from a
natural or artificial source. The resulting electric field acts upon conductive materials in
electric and electronic equipment, inducing electric currents that can disrupt equipment
operation and may cause permanent damage. Susceptible conductors, depending on the
characteristics of the EMP, range from the wires that make up the electrical grid or a data
center’s power distribution system to the microscopic features on silicon chips. Yet the
data center industry lacks well-established practices to assess EMP risk to operations —
partly because operators consider EMP events to be highly unlikely.
Most commentary about EMP risk tends to focus on large-scale events that could threaten
critical infrastructure, such as the electrical grid. The US government features prominently
in coverage relating to EMP risk, having commissioned research into the threat of EMP
to national infrastructure and critical operations. In addition to describing the potential
for catastrophic consequences from a large-scale EMP event, the US government has
defined incremental levels of EMP protection (for further information see Table 2). The
Swedish government has also published EMP research.
EMP risk modeling requires estimation of uncertainties, especially those of human
behavior — but the physical analyses of EMP effects and appropriate safeguards
are rigorous, and may offer important insights that largely have yet to trickle down to
nongovernmental data centers.
All forms of EMP can pose some risk to data centers — but it is still overlooked in
data center risk assessments. Although a variety of protective measures against EMP
are commercially available, most current data center designs do not incorporate any
protections specifically designed for EMP other than shielding against a narrow band of
weak electromagnetic interference, the sources of which are largely radio networks.
Uptime Institute Intelligence conducted briefings with a number of data center
operators: only one operator had conducted an EMP risk assessment — but had not yet
implemented EMP protections.

Types of EMP threats

There are three major types of EMP sources: nuclear, geomagnetic and intentional. Each
type arises from a distinct EMP mechanism with different likelihoods of occurrence,
different geographic scales of effect and varying electromagnetic characteristics, such as
peak electric field strength, pulse duration and electromagnetic frequency. The results of
each varies in terms of potential for disruption and damage, as well as the types of devices
and systems likely to be most strongly impacted (see Table 1).

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 4

 E M P A N D I T S T H R E AT TO D ATA C E N T E R S
Table 1 Types of electromagnetic pulse
Technical name
Source of EMP
Likelihood of
occurrence
Duration of EMP
Scale of impact
Peak electric field
strength
Frequency range of
EM radiation
Data center-related
equipment impacted
A DA P T E D F R O M U S G O V E R N M E N T G U I D E L I N E S *
*US Department of Energy (unclassified memo). Physical characteristics of HEMP waveform benchmarks for use in assessing
susceptibilities of the power grid, electrical infrastructures, and other critical infrastructure to HEMP insults (2021).
© 2022 UPTIME INSTITUTE
Nuclear EMP Geomagnetic EMP Intentional EMP
High-altitude nuclear Geomagnetic Intentional
weapon-generated disturbance (GMD) electromagnetic
electromagnetic pulse (HEMP) interference (IEMI)
Human activity. The detonation of a Solar activity. A brief Human activity.
nuclear warhead at an altitude of and violent solar event A portable
25-250 miles (40-400 km). interacts with Earth’s device designed
magnetic field. to intentionally
generate an EMP,
such as a high-
power microwave
generator.
Unlikely, due to risk of retaliation by Likely, but impossible Unpredictable,
nuclear nations / allies. to predict with high dependent on
accuracy. attacker / target
profile.
Typically over a minute. Typically minutes Typically
Three distinct stages differentiated by to hours per pulse. nanoseconds per
duration, peak electric field strength One to two pulses per pulse. Hundreds of
and frequency: solar event. pulses are possible.
E1 (early-time): nanoseconds.
E2 (intermediate time): milliseconds.
E3 (late-time): seconds to minutes.
One to two pulses per detonation.
Up to thousands of miles / km Ranges from Localized (ranges
(estimated to impact about 70% of local to global. from hundreds to
the US power grid). thousands of feet /
meters).
E1: 15 kV / feet (50 kV / m) Can meet or exceed 3-30 kV / feet
nuclear E3 (130 V / (10-100 kV / m)
E2: 30 V / feet (100 V / m) mile, 80 V / km)
depending on solar
E3 blast: 130 V / mile (80 V / km) event intensity, and
orientation of Earth’s
E3 heave: 80 V / mile (50 V / km) magnetic field.
E1: 1 MHz to 1 GHz <1 Hz 100 MHz to 10 GHz
E2: 1 Hz to 100 kHz
E3: <1 Hz
E1: Silicon chips, circuit boards. Long-run conductors Silicon chips,
in power and circuit boards.
E2: Silicon chips, circuit boards. communications
Damage potential is greater in utilities. Secondary
equipment already damaged by E1. effects on data center
equipment through
E3: Long-run conductors in power and power connection.
communications utilities. Secondary
effects on data center equipment
through power connection.
| ALL RIGHTS RESERVED 5
E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Physical characteristics
Nuclear EMP
Although currently implausible, a nuclear explosion could occur that affects critical digital
infrastructure. Modeling the impact of a nuclear EMP, also referred to as high altitude
nuclear weapon-generated electromagnetic pulse (HEMP), involves some estimation and
extrapolation, with no new data generated since the 1962 US Starfish Prime nuclear test.
A nuclear EMP’s scale of impact and electric field strength depends on the yield of the
nuclear warhead (effective power) and the altitude at detonation. A high-altitude burst
at 25 miles to 250 miles (40 kilometers, or km, to 400 km) affects a wide area — a major
objective of a nuclear EMP attack. For this reason, “nuclear EMP” in this report refers
only to a high-altitude burst. Low-altitude nuclear detonation (including accidents) would
produce a highly local, albeit powerful EMP, the effect of which would be secondary to
physical destruction and radioactivity.
Simulations predict disruption and damage to equipment over thousands of miles (or
kilometers). Table 1 includes benchmark field strength figures from a US Department of
Energy memo, which was calculated using estimated attack capabilities and a factor of
safety of two (calculated field strength is multiplied by two to account for uncertainties in
modeling).
Unlike other EMP events, a nuclear EMP event produces three EMP components that are
distinct from each other in peak field strength and rise time:
• The E1 (early-time) component. A very high frequency — 1 megahertz (MHz) to 1
gigahertz (GHz) — burst, attaining its peak electric field strength rapidly (in under 10
nanoseconds). E1 has the shortest duration of the three components and represents
the highest electric field strength reached during the nuclear EMP event by orders of
magnitude.
• The E2 (intermediate-time) component. Intermediate in terms of peak field strength,
frequency and duration. The E2 component acts over a time span from approximately
10 nanoseconds to one millisecond.
• The E3 (late-time) component. Occurs as the nuclear fireball distorts the Earth’s
magnetic field (referred to as a “blast”), followed by a subsequent change in the
opposite direction (referred to as a “heave”). E3 has a low frequency (<1 hertz, Hz)
and acts much more slowly than E1 and E2, over a period spanning from seconds to
minutes. Its peak electric field strength is the lowest of the three components.

Geomagnetic EMP
A geomagnetic EMP, or geomagnetic disturbance (GMD), occurs when a violent solar
event interacts with the Earth’s atmosphere, producing a slow-acting EMP with a low
frequency (<1 Hz). The electromagnetic characteristics and the effects of a geomagnetic
EMP are like those of the E3 component from a nuclear EMP. A geomagnetic EMP can
arise in seconds, then persist from minutes to days, depending on the intensity of the
solar event.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 6

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Intentional EMP
Intentional EMP, or intentional electromagnetic interference (IEMI), originates from an
engineered EMP device, so the physical characteristics of the EMP burst vary with the
attacker’s capabilities and goals. Intentional EMP has a high frequency (typically from
100 MHz to 10 GHz) and its peak electric field strength is reached rapidly, similar to a
nuclear EMP E1 component. Peak electric field strength from larger EMP devices is also
similar to nuclear E1. Attackers can design the device to concentrate its emitted energy
over a small range of frequencies (“narrowband”) or to spread its energy across a larger
range of frequencies (“wideband”), depending on their goals and prior knowledge of the
susceptibilities of a target.

Risk to data centers

All forms of EMP pose a potential risk to data centers. The probability of occurrence of
any type of EMP (either nuclear, geomagnetic or intentional) is challenging to model and
it is even less straightforward to estimate the potential risk to a specific data center. EMP
can bypass most — but not all — conventional physical security measures at data centers
and may render traditional site infrastructure resilience irrelevant since both primary and
backup equipment would be affected.
Unlike many other data center risks, such as natural disasters or cyberattacks, once an
EMP occurs, the root cause is often not readily apparent. If errors appear in logs, they may
appear random or difficult to explain. Damage may manifest as a gradual degradation and
be undetected for some time. Data corruption risks due to IT hardware failures (relating
to processor, memory or storage devices) and undetected soft errors (corrupted bits) may
also increase.

Nuclear EMP
Arguably, a nuclear EMP attack is unlikely because only a handful of state actors possess
the capability. A high-altitude nuclear EMP attack requires both a warhead and a delivery
mechanism (most likely an intercontinental ballistic missile). The use of nuclear weapons
is a last resort in modern military doctrines, and they are generally held as a deterrent
against existential threats only. The majority of global data center capacity resides in
countries that are either nuclear powers themselves or are part of a military alliance
with nuclear weapons, and this threat of nuclear retaliation continues to act as a
strong deterrent.
Each of the three components of a nuclear EMP would affect a data center differently.
Due to its high frequency, the early-time (E1) component induces currents in very short
electrical conductors, such as those in circuit boards and silicon chips. This affects not
only IT hardware but also control systems for mechanical and electrical equipment.
Effects of E1 on these electronics can include aborted operations, malfunctioning, data
destruction, equipment shutdown and permanent physical damage.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 7

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

The intermediate-time (E2) component also couples most strongly to very short electrical
conductors, like E1. E2 acts on electrical systems similarly to a lightning strike. Lightning-
rated surge protection devices (SPD) can be effective against E2 if the SPD itself has not
been damaged by the preceding E1.
The late-time (E3) component induces currents in very long electrical conductors, such
as the high-voltage transmission lines in the power grid. The induced current behaves
like direct current (DC) in a system designed for alternating current (AC) — potentially
overheating or destroying transformers.
If a nuclear EMP damages high-voltage transmission infrastructure over hundreds or
thousands of miles (or kilometers), data centers and all power consumers will experience
widespread power outages. Replacement high-voltage transformers have long lead times
(even in normal circumstances) and power outages may last indefinitely. If the power
grid remains operational, data centers may experience potentially severe power quality
problems — specifically, harmonic distortion (defects in AC voltage waveforms).

Geomagnetic EMP
The solar events that cause geomagnetic EMP occur frequently but chaotically, and
astronomers can predict them only probabilistically. For example, a “great super storm”
with enough power to cause a significant EMP event typically reaches Earth once every
25 years. Predicting an individual geomagnetic EMP event on Earth is currently not
possible. The US National Oceanic and Atmospheric Administration’s Space Weather
Prediction Center observes solar events and can provide advance notice of hours or days
if the events may affect Earth. Even solar storms that strike the Earth’s atmosphere do not
always cause an EMP due to variations in the magnetic field interactions.
A geomagnetic EMP has a low frequency, similar to nuclear EMP’s E3, and it induces
similar currents in high-voltage power transmission lines. A large geomagnetic EMP can
cause high-voltage transformer damage and widespread, lasting power outages like those
caused by a nuclear EMP. Smaller solar storms occur more frequently and can instead
cause more localized power outages lasting hours or days.
Most storms are not powerful enough to cause power outages — grid operators can
compensate for a smaller EMP’s induced currents and continue delivering power.
However, data centers are likely to encounter harmonic distortion. As power is transmitted
from the high-voltage lines to utility customers, it passes through a succession of
transformers — each of which steps down the voltage but intensifies harmonics. When
the power reaches the end user, in this case a data center, the harmonics are at their
greatest intensity.
Most data center uninterruptable power supply (UPS) systems are designed to
accommodate some harmonics and protect downstream equipment, but geomagnetic
EMP can overwhelm these built-in protections — potentially damaging the UPS or
other equipment. The effects of harmonics inside the data center can include inefficient
UPS operation, UPS rectifier damage, tripped circuit breakers, overheated wiring,
malfunctioning motors in mechanical equipment and, ultimately, physical damage to
IT equipment.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 8

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Intentional EMP
An intentional EMP attack produces a high-intensity, high-frequency electromagnetic
burst that resembles parts of a nuclear E1 component — and will cause similar damage
and disruption to silicon chips and circuit boards. Intentional EMP differs from other EMP
sources in that there is potential for rapid repeated bursts, potentially striking the targeted
equipment hundreds of times within seconds.
An intentional EMP attack targets a specific site. This type of attack is plausible, but
inherently unpredictable. An attacker without specialized training can assemble a
portable electromagnetic interference (EMI) device such as a high-power microwave
generator that fits on a truck, or even in a suitcase. Blueprints for EMI devices are
available on the internet at low cost and only require up to a few thousand dollars of
commercially available and unregulated components. Surveillance and assessment of a
potential intentional EMI scheme is difficult but the impact may be significant: a single
data center outage can cost millions of dollars and is a sufficient incentive for sabotage or
blackmail (see Uptime Intelligence’s Annual outage analysis 2022).
However, there is no evidence that intentional EMP attacks on data centers are occurring
with any regularity, if at all. In the 28 years Uptime Institute has been collecting Abnormal
Incident Reports (AIRs) data, we have not recorded a single instance of a data center
outage being caused by sabotage. One EMP attack and one blackmail incident are
referenced in international standards documents but these incidents targeted public-
facing computer systems, which lack the physical security of most data centers.

Protective measures
A data center can be either equipped to recover from an EMP event or designed to
operate through an EMP event. The following protective measures can meet one or
more of these objectives, with varying degrees of cost-effectiveness.

Physical security
An intentional EMP attack has sufficient range to affect only a single data center
or campus, which means some physical security measures can mitigate or prevent
disruption from this type of EMP. Relative to other EMP events, it produces less energy
(by orders of magnitude), which makes distance the most effective defense. Electric field
strength drops quadratically with distance, which means a quarter of the energy reaches
equipment if the distance from the EMP source is doubled. Strong access controls to
the site reduce the opportunity for an attacker to operate an EMI device within range of
sensitive equipment. This includes security procedures to screen belongings of those
entering the site as protection against low-power EMI devices, as well as an increased
stand-off distance between the site perimeter and data center facilities wherever
possible (to defend against vehicle-mounted attacks). Physical security assessments and
improvements also serve broader security goals and may be easier to justify economically,
compared with other specialized EMP protections.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 9

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Shielding
A Faraday cage is a protected space that is completely enclosed in a conductive material,
so that it is not affected by external electric fields. In data centers, this can protect against
nuclear E1 and intentional EMP.
Data center operators can deploy a Faraday cage around all (or some) of the facility to
protect the most critical equipment. Shielded server racks are available, or operators can
construct a shielded room or a fully shielded facility. A Faraday cage can enable critical
equipment to operate through an EMP incident but the cost of constructing a large,
protected space is considerable. Every opening into the protected space — such as air
supply, networking, power wiring and doors for personnel — must be engineered so as not
to compromise the protection. This reduces flexibility in later design or layout changes.
It may be more practical to engineer a Faraday cage to protect a room or a full facility
in a new data center, rather than retrofit an existing one. A Faraday cage cannot,
however, protect power lines and other conductors entering the cage. Without additional
precautions, these lines and conductors may allow harmful electric currents to enter the
protected space, such as harmonics from a geomagnetic EMP or the E3 component of a
powerful nuclear EMP.
In briefings with data center operators, Uptime Intelligence identified a few operators
using Faraday cages, but for purposes other than EMP protection. These included
protecting against passive electromagnetic interference and electromagnetic
eavesdropping.

EMP detection
Because damage and disruption from EMP can appear as gradual degradation, or
as random equipment failures, both the root cause and the timing of the incident are
obfuscated This makes it difficult for operators to respond to an intentional EMP attack
appropriately, or to learn from the incident to improve EMP protections when recovering a
data center.
There is at least one vendor, Emprimus, producing high-frequency EMP detection
products that can alert data center operators when a nuclear or intentional EMP occurs.
The vendor also produces a nuclear EMP detector that responds to an early-time E1
event and triggers other EMP protections, such as closing a shielded room to allow critical
equipment inside to operate through the EMP incident. The manufacturer does not
disclose sales figures and is no longer marketing strongly to the data center sector, as it
once did.

Energy storage
Increasing fuel storage, or other forms of energy storage, allows data centers to operate
for longer in the absence of grid power. Increased fuel storage may be sufficient to operate
through a power outage lasting from hours to days (i.e., from a geomagnetic EMP).
However, operators need to also make sure critical power systems (e.g., switchgears and
transformers) are not vulnerable to geomagnetically induced currents from the grid, which
would damage the ability of emergency backup power to take the load.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 10

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Backup techniques
Some techniques for data backup will enable a data center to recover from an EMP event.
For instance, out-of-region backup places a copy of critical data outside the area affected
by a major EMP event. Data backups in cold storage and associated disaster recovery
systems, completely disconnected from network and power, can be shielded to protect
against all forms of EMP. However, backups in cold storage and standby disaster recovery
systems are expensive and fully restoring all operations can take time (up to days).

Storing protected spares

Operators can store spare IT equipment, mechanical equipment and components to
facilitate recovery following an EMP. However, high-frequency EMP (from a nuclear or
intentional EMP event) would also damage spare equipment in the affected area. To
guard against this, spare equipment can be stored in shielded rooms or buildings — or
in improvised conductive shielding. This can include galvanized steel garbage cans or
aluminum foil, as long as the shielding has no gaps.

Surge protection devices

The early-time E1 pulse of a nuclear EMP can damage a lightning-rated SPD, potentially
disabling its protective circuitry and allowing the E2 pulse to cause additional damage.
EMP-rated SPDs designed to withstand an E1 pulse and to protect connected data
center equipment from EMP damage via power wiring are available. SPDs can enable a
data center to operate through a nuclear EMP when complemented by other protective
measures.

Incremental levels of protection

Data center operators can apply EMP protections individually or as complementary parts
of a larger protected facility design. EMP protections can be implemented incrementally
to provide the resiliency that is necessary and cost-effective for that facility.
The US government has established guidelines for four levels of nuclear EMP protection
for their critical facilities. Table 2, which is adapted from these government guidelines,
suggests measures for nuclear EMP protection of data centers. The levels represent
discrete, ascending grades of protection and associated costs.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 11

 E M P A N D I T S T H R E AT TO D ATA C E N T E R S

Table 2 Electromagnetic pulse protection guidelines

Protective measures
Level 1 • Detach conductive network and power cables from spare electronic equipment.
• Store spare electronic equipment in Faraday containers.
• Install lightning-rated surge protection devices (SPD) on conductive network and power cables.
• Ensure backup power has seven days of EMP-protected stored fuel / energy.

Level 2 • Use fiber-optic cables (nonconductive) where possible.

All Level 1
measures and: • Where conductive cables are necessary, they should be shielded, either individually or within
rack / room / building shielding.
• Install EMP-rated SPDs on conductive network and power cables.

Level 3 • Install rack / room / building shielding to protect critical equipment to meet International
All Level 3 Electrotechnical Commission standards (SC 77C series).
measures and:
• Ensure EMP-protected backup power has 30 days of protected stored fuel / energy.
• Ensure 30 days of stored critical supplies and spare equipment.

Level 4 • Install rack / room / building shielding to meet US military standards (MIL-STD-188-125-1
All Level 4 and MIL-HDBK-423).
measures and:
• EMP-protected backup power to US military standard, plus an alternate on-site power
generation (consider holding more than 30 days stored fuel / energy).
• Consider two SPDs on critical conductive network and power cables entering shielded
racks / rooms / buildings.

A DA P T E D F R O M U S G O V E R N M E N T G U I D E L I N E S *

*National Coordinating Center for Communications. Electromagnetic pulse (EMP) protection and
resilience guidelines for critical infrastructure and equipment (2019).

Recommendations
Data center operators that consider risks of strong electromagnetic disturbances as
part of an overall risk assessment can improve their infrastructure resiliency. There is no
singular set of EMP protections that will be effective or economical for all data centers,
given the variation in data center building designs, siting, physical security, equipment
designs and nature of workloads. A comprehensive risk assessment, tailored to each
individual data center, should inform the selection of appropriate EMP protection
measures. Operators should define the business objective of any investment in protective
measures and detail whether the aim is to recover from an EMP event or to equip the data
center to remain operational throughout the event.
Recovering from an EMP event does not call for the expense and complexity of shielding
active equipment. An operator can protect spare equipment or components, as well as
backup media in cold storage, using simple shielding (see Storing protected spares).
Operating through a powerful EMP event is possible, but at considerable cost. A data
center operator will need to define the scale and type of the event they intend to protect
against if they want to take focused measures. It may be difficult to justify the expense of
large-scale EMP shielding to protect most (or all) data center equipment through a wide-
reaching nuclear or geomagnetic EMP. The entire population of the affected area will be
competing for fuel and other supplies, and prolonged power outages are likely to outlast
data centers’ fuel storage capacity.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 12

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

These same conditions are likely to affect the users of the applications running in
the data center, leaving them unable to connect. Relying on geographically dispersed
multisite resiliency (stretching over thousands of miles) is likely to prove more effective
as protection.
More localized EMP effects from, for example, a small geomagnetic EMP or an intentional
EMP, will not affect more distant users and competitors, so there may be more economic
justification for maintaining availability through these events.
Because intentional EMP targets a single data center campus and risk can be mitigated
with physical security improvements, operators should aim to match or exceed the EMP
safeguards of their competitors.
Once a data center operator has assessed the EMP risks to a site it wants to mitigate,
and defined the objective of any EMP protection, they can then map which systems
(both the equipment and its connected circuits) require protection to meet this objective.
Key steps include:

• Determine which systems are critical.

• Define the priority of protection of critical systems.
• Identify all sensitive components in a critical system’s equipment and connected
circuits.
• Determine the threshold of disruption or damage to sensitive components using vendor
specifications or testing (or both).
• Select EMP protections appropriate to each component’s vulnerabilities and to the
data center operator’s business objectives (and budget).
Risk assessments, including those for EMP, are best performed periodically as the risk
profile of a data center can change. For example, the risk of loss of utility power from
nuclear or geomagnetic EMP may change (i.e., reduce) if a grid operator increases EMP
protection of its infrastructure, but the related risk of harmonic distortion may remain.
Another example is if a data center’s utility provider is experiencing shorter and more
localized power outages than before, then investing in ensuring a data center can operate
for longer periods on backup resources could be justified.
Awareness of EMP as a risk to data centers is increasing. Best practice in EMP
protection is not well established in the data center industry yet, but a periodic risk
assessment will enable operators to incorporate updated information and guidelines as
they become available.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 13

E M P A N D I T S T H R E AT TO D ATA C E N T E R S

About the author

Jacqueline Davis
Jacqueline Davis is a Research Analyst at Uptime Institute covering global
trends and technologies that underpin critical digital infrastructure. Her
background includes environmental monitoring and data interpretation in
the environmental compliance and health and safety fields.
jdavis@uptimeinstitute.com

About Uptime Institute

Uptime Institute is the Global Digital Infrastructure Authority. Uptime Institute is
Its Tier Standard is the IT industry’s most trusted and headquartered in New York, NY,
adopted global standard for the proper design, construction, with offices in Seattle, London,
and operation of data centers – the backbone of the digital Sao Paulo, Dubai, Singapore,
economy. For over 25 years, the company has served as and Taipei.
the standard for data center reliability, sustainability, and
For more information, please
efficiency, providing customers assurance that their digital visit www.uptimeinstitute.com
infrastructure can perform at a level that is consistent
with their business needs across a wide array of operating
All general queries:
Uptime Institute
conditions. With its data center Tier Standard & Certifications,
405 Lexington Avenue,
Management & Operations reviews, broad range of related
9th Floor, New York,
risk and performance assessments, and accredited
NY 10174, USA
educational curriculum completed by over 10,000 data center
+1 212 505 3030
professionals, Uptime Institute has helped thousands of
info@uptimeinstitute.com
companies, in over 100 countries to optimize critical IT assets
while managing costs, resources, and efficiency.

© 2022 UPTIME INSTITUTE | ALL RIGHTS RESERVED 14