What leaders should ask before funding a resilience project

Dr. Priscilla Johnson · Priska Consulting

A practical checklist for executives, boards, and investment committees before capital is committed to a data center or critical infrastructure resilience project.

Dependency and consequence

• Has the water, energy, and OT/ICS dependency chain for this specific site been mapped, or only assessed discipline by discipline?
• What is the actual consequence of a single-point failure in each system, measured in downtime, cost, and safety, not just in a compliance rating?
• Which proposed investment addresses more than one of these three domains at once, and has that cross-system value been counted?

Water

• Has a data center water assessment or water audit been completed for this site, independent of the developer's own projections?
• What is the site's water source resilience under a drought or utility curtailment scenario?
• Does the water strategy give investors and regulators a verifiable claim, or a marketing claim?

Energy

• Is the cooling and thermal design sized against the utility's actual long-horizon capacity, not just current interconnection agreements?
• What is the backup power and critical-load strategy, and has it been tested rather than assumed?
• Is there a waste heat reuse strategy, and has it been evaluated as a revenue or regulatory opportunity rather than dismissed as unnecessary complexity?

OT/ICS cybersecurity

• Who owns OT/ICS cybersecurity risk at this site, by name, with budget authority, not just by policy?
• Has the control system environment been assessed on its own terms, or has an IT security framework simply been applied to it?
• What is the incident response plan for a control system that cannot simply be taken offline?

Community and regulatory

• Has a community risk or community impact assessment been completed before the public hearing, not in response to one?
• What is the realistic tax incentive position for this project, and has it been substantiated rather than assumed?
• What would have to be true for local opposition to escalate to a moratorium risk, and has that scenario been planned for?

Governance

• Does a single accountable owner exist for resilience across water, energy, and cybersecurity, or does the responsibility sit split across departments with no one owning the whole?
• What decision, exactly, is this funding meant to enable, and what is the cost of not making it this cycle?