Cybersecurity & Risk Analysis: Securing Critical Infrastructure Supporting Data Centers

Co-Sponsored by Mr. James Elliot & Microsoft

Scenario

Northern Virginia hosts the world’s largest concentration of data centers, which power today’s rapidly growing artificial intelligence (AI) and cloud-based services. These facilities require immense amounts of electricity and water for continuous operations and cooling. Local utilities responsible for providing these services rely on Operational Technology (OT) such as supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), and industrial sensors to manage the infrastructure, pumps, valves, and substations delivering critical resources to both commercial and residential customers.

Many OT systems used throughout the country are decades old and not designed with cybersecurity in mind. As a result, they have become increasingly attractive targets for threat actors. Recent campaigns such as Volt Typhoon (China), Sandworm (Russia), and CyberAv3ngers (Iran) have focused on U.S. critical infrastructure—including water, energy, transportation, and manufacturing. Such threats have the potential to disrupt the data centers industry and government rely on for AI and cloud services, leading to widespread economic losses. Additionally, the unique integration of OT systems in industrial environments could result in physical damage to equipment and create dangerous safety conditions for employees.

Your client, Royal Duke Infrastructure Group, provides electricity and industrial water to several data centers in Loudoun County, Prince William County, and Fairfax County, Virginia. Following recent federal guidance on OT asset security, Royal Duke Infrastructure Group’s leadership has asked your team to develop a Cyber Risk Assessment and Mitigation Plan that identifies vulnerabilities, prioritizes risks, and recommends cost-effective, realistic safeguards to protect critical infrastructure and ensure seamless data center operations.

Challenge

Using credible government, academic, and industry resources, evaluate the major cybersecurity risks facing Royal Duke Infrastructure Group’s operational systems and propose practical, business-oriented strategies to reduce those risks.

TIMELINE

February 16, 2026 (11:59 PM Eastern) - Preliminary submissions due
February 26, 2026 – Finalists notified
March 27, 2026 – Final presentations (during SCLC) and winners announced

PRIZES

First place: $2,000 USD
Second place: $1000 USD
Third place $500 USD

ELIGIBILITY REQUIREMENT

Only teams from current AIS Student Chapters are eligible to complete.

Unsure if your chapter is up-to-date with membership? See the list of current chapters.
Interested in chapter membership? Learn more.

Deliverables

Teams will submit:

A 5–10 minute video presentation (.mp4) summarizing their findings and recommendations
A 1-page professional report (.pdf) documenting key points, data, and visuals that support their analysis.

Deliverables should demonstrate clear understanding of the organization’s context, cyber/OT risks, and feasible recommendations.

Professional Report

Develop a professional, consulting-style report that includes the following sections:

1) Current Situation Summary

a) DescribeRoyal Duke Infrastructure Group’s operational role and dependencies.

b) Explain why OT systems are vulnerable and which cyber threats are most relevant.

c) Include regional context—such as rising electricity demand to support existing and future data centers—and the consequences of service disruptions.

2) Risk Identification

a) Identify at least three realistic OT-related cybersecurity risks.

b) For each risk, explain:

i) How it could occur (a short, realistic scenario)

ii) Potential impact (financial, operational, safety, reputational, etc.)

iii) Likelihood (low, medium, or high)

3) Impact and Cost–Benefit Analysis

a) Estimate the potential business or operational impact of a cyber incident.

b) Recommend at least three safeguards or mitigations, including description, relative cost level, and estimated benefit.

c) Summarize how Royal Duke Infrastructure Group can balance investment, operational reliability, and resilience.

4) Recommendations & Roadmap

a) Prioritize recommendations.

b) Provide a timeline showing accomplishments in the short, mid, and long term.

5) References

a) Include a list of credible, properly formatted sources.

Presentation

Teams will present their findings to a panel of judges representing Royal Duke Infrastructure Group’s executive board. Presentation requirements:

1) Format

a) PowerPoint, Google Slides, Canva, Prezi, or similar presentation platform.

b) Slides should be clear, visually consistent, and properly sourced.

2) Content

a) Overview: Introduce Royal Duke Infrastructure Group’s context and the problem statement.

b) Key Risks: Visualize your top three cyber risks (use icons or simplified risk matrix).

c) Threat Scenarios: Explain realistic attack paths and potential consequences.

d) Recommendations: Present three safeguards with rationale (i.e., cost vs. benefit).

e) Implementation Roadmap: Show timeline of short-, mid-, and long-term actions.

f) Business Impact Summary: Explain expected improvements in risk posture and operational resilience.

3) References

a) Include a list of credible, properly formatted sources.

Evaluation Rubric

Guidelines	Points
Problem Understanding & Context Does the team clearly describe Royal Duke Infrastructure Group’s operational role and dependencies? Do they explain why OT systems are vulnerable and highlight regional or business consequences of service disruptions?	20
Risk Identification & Assesment Are at least three realistic OT cybersecurity risks identified? Does the team explain how each risk could occur (scenario), its potential impact, and likelihood?	20
Mitigation Strategies & Recommendations Are the proposed safeguards practical, cost-effective, and aligned with business goals? Do they explain trade-offs between investment, reliability, and resilience?	20
Presentation Quality & Communication Is the video/pdf concise, professional, and visually consistent? Are ideas communicated clearly, with strong evidence and reasoning?	20
Implementation Roadmap Does the team provide a clear short-, mid-, and long-term roadmap? Does it show how recommendations strengthen resilience and business continuity?	20
Total	100