Government, Defense and Sovereign Data Center Siting: Security, Federal Rules and Data Residency

A commercial data center is sited to win tenants: power, fiber, cost and speed. A government, defense or sovereign facility is sited to satisfy an accreditor. The questions that decide the site are who owns the land and the building, who can enter, which other tenants share the infrastructure, which country’s law applies to the data, and how far the facility sits from threats. Power and land still matter, and the same utility and acreage screening applies, but a parcel that clears every engineering test can still fail on ownership or location rules.

The U.S. federal government is also a smaller builder of its own facilities than it once was. Under the Data Center Optimization Initiative, agencies closed 58 data centers in fiscal year 2021 against a goal of 43.¹¹ GAO’s February 2023 report counted a cumulative $6.6 billion in savings and cost avoidance from fiscal years 2012 through 2021, and found agencies had closed 20 more data centers by August 2022 with 58 others planned for that fiscal year.¹² The result is that much federal demand now reaches the market through cloud providers’ government regions, colocation and contractor-owned buildings, each of which must meet the agency’s rules.

That shifts the siting burden to developers and providers. A site meant for government work has to be screened for the security requirements below before it is marketed, because they affect the building, the land around it and, in some cases, who is allowed to buy it. This guide covers those rules. For using federally owned land itself, see federal land for AI data centers.

The Department of Defense Cloud Computing Security Requirements Guide (SRG) sorts workloads into impact levels. The siting consequences start at Impact Level 5. Microsoft, describing its Azure Government DoD regions when they reached IL5 in 2017, said the regions provide dedicated compute and storage infrastructure for DoD customers only, to meet the physical separation requirement.¹ In practice, IL5 data sits on infrastructure reserved for DoD or other federal customers rather than on shared commercial hardware, and the SRG also restricts where that data may physically be hosted, so confirm the location rules in the current SRG revision with the sponsor.

Above IL5 the work is classified. AWS launched its Secret-West Region in October 2025 as its second U.S. region for Secret-level workloads, built and accredited to Intelligence Community Directive requirements, with services authorized at ICD 503 and DoD SRG Impact Level 6.¹³ Facilities at these levels are dedicated buildings or halls, not shared floors in a multi-tenant colocation building.

For a site, the practical point is that higher tiers want a building, or a defined portion of one, that can be fenced, controlled and staffed independently. That favors parcels with room for a separate secure enclave, a dedicated entrance and, ideally, a dedicated utility feed. The layered perimeter model used by large operators is a starting point, not the whole answer.

Space for sensitive compartmented information is built to the Intelligence Community’s technical specification for SCIF construction and management under ICD/ICS 705. Version 1.5 replaced Version 1.4 and was promulgated to the Intelligence Community in 2020.² The specification governs walls, doors, acoustic ratings, penetrations and alarm systems, and accreditation comes from the sponsoring agency rather than from the builder.²

Radio frequency protection can go further than the base specification. A 2022 analysis in In Compliance Magazine notes that ICD/ICS 705 construction alone will not reach the RF performance required under NSA 94-106, which calls for attenuation as high as 100 dB at 10 GHz, and that a Certified TEMPEST Technical Authority decides on RF shielding based on risk.⁶ A site next to high-power transmitters or busy RF environments can raise that risk and the cost of shielding.

Buildings on or for DoD installations also follow the antiterrorism criteria in UFC 4-010-01. The U.S. Army Corps of Engineers bulletin issuing the December 2018 edition said it superseded the 2013 Change 1, rescinded the separate standoff-distance document UFC 4-010-02, and called the change to the standoff standard the revision’s most significant element.¹⁴ Standoff still drives land needs: the space between roads, parking and the building has to fit inside the parcel along with setbacks and utility yards.

Ownership rules can disqualify a site or a buyer before any design work starts. The Committee on Foreign Investment in the United States (CFIUS) has jurisdiction over certain real estate transactions by foreign persons near listed military installations, within either a 1-mile or a 100-mile radius depending on the installation.¹⁵ Treasury proposed in July 2024 to add 59 installations across 30 states to the list.¹⁵ The final rule, published November 7, 2024, took effect December 9, 2024.³ It added 19 installations to the 100-mile list, including Barksdale, Dover and Little Rock Air Force Bases, and moved eight, including Joint Base San Antonio and Wright-Patterson, from a 1-mile to a 100-mile radius.⁷

States have moved too. MultiState counted 194 bills on foreign land ownership in 38 states in 2025, with 15 states enacting new laws.⁸ Mintz reports that about 36 states had some restriction on foreign ownership of real property by the end of 2025, many focused on farmland, critical infrastructure and military proximity.⁹ Florida’s law, which the Eleventh Circuit upheld on November 4, 2025, bars buyers tied to China, Cuba, Iran, North Korea, Russia, Syria and Venezuela from owning property within 10 miles of military installations or critical infrastructure.⁹

For a seller or developer, this means the buyer’s ownership chain, the investors behind a fund and the location of the nearest listed installation all belong in the due diligence period. It is a question for a CFIUS attorney, not a site engineer.

Outside the U.S. defense system, the same idea appears as sovereignty: the data, the operators and sometimes the billing must stay inside one jurisdiction. In January 2026 AWS made its European Sovereign Cloud generally available, starting with a region in Brandenburg, Germany, that it describes as physically and logically separate from other AWS regions, with technical controls to prevent access from outside the EU.⁴ Amazon said it plans to invest more than €7.8 billion in Germany for the project and to add sovereign Local Zones in Belgium, the Netherlands and Portugal.⁴

Sovereign AI campuses are larger still. Stargate UAE, a collaboration including G42, OpenAI, Oracle, Nvidia, Cisco and SoftBank, was announced in 2025, with OpenAI expecting the first 200 MW to go live in 2026.⁵¹⁰ S&P describes it as a cluster in a planned 5 GW campus, with the first 1 GW due over about three years, and expects the UAE and Saudi Arabia together to add about 2–3 GW of IT power, with Saudi Arabia’s Humain potentially reaching 1.9 GW by 2030.¹⁰

For siting, residency rules narrow the search to one country or region, then to sites that can be operated by approved staff and connected without routing data abroad. That raises the value of domestic power and long-haul fiber that stays inside the border, and can justify sites a pure cost screen would pass over.

Start with the target customer and the highest classification or residency rule they will need, because that sets everything else. Then check the site against the items below. Our methodology covers the engineering screen; these items sit on top of it.

1. 01Ownership: identify the buyer’s and investors’ nationality and check the distance to the nearest installation on the CFIUS list and any state buffer.
2. 02Separation: confirm the parcel can hold a dedicated building or enclave with its own entrance, fencing and utility path for IL5 and above.
3. 03Standoff: lay out roads, parking and building lines against the antiterrorism criteria that apply to the sponsor.
4. 04RF environment: note nearby transmitters and ask whether TEMPEST shielding is likely.
5. 05Residency: for sovereign work, confirm power, fiber and operations can stay inside the jurisdiction.

A site that passes the engineering screen but fails ownership or separation can still suit commercial users. If you want a parcel checked against both, you can get a site reviewed.