Fernando Fainzilber is the CISO at Start Campus, leading security for AI-scale sustainable data center infrastructure in Portugal.
On the morning of April 28, 2025, we lost utility power at our data center campus in Sines, Portugal. For the first several minutes, that was not alarming.
Losing grid power is something any modern data center is built to absorb. A fault on the local network or a switching error is routine. When it happens, generators start, load is transferred and the problem’s diagnostic begins. Usually, it’s a problem that is yours and local.
What made this one different arrived from outside the fence. Instabilities in other cities, banks offline, mobile networks off and services failing that had nothing to do with us. That’s when we understood that we were not managing our own incident. We were inside someone else’s.
That gap between losing power and understanding what kind of event we were in is the part of that day I think about most. This is because the plan tells you what to do once you know what’s happening, but not how to find it out when the channels you need in order to classify the event were themselves part of it.
When The Incident Is Bigger Than Your Site
ENTSO-E’s expert panel published its final report on the incident in March 2026. It concluded that the blackout resulted from a mix of oscillations, gaps in voltage and reactive power control, divergent voltage regulation practices and cascading generator disconnections. The panel’s chair was clear that the underlying issue was voltage control rather than renewable generation. Restoration took between 12 and 16 hours.
This duration is what matters if you are responsible for continuity, especially considering this was an accident. In its February 2026 report, Battle-Tested Power Systems, Eurelectric documented a growing pattern of physical sabotage, cyberattacks, aerial intrusions and subsea cable cuts against energy assets and other critical infrastructures. If an accident cascade takes that long to resolve, it is reasonable to plan for a deliberate one taking longer.
Plan For The Duration You Cannot Predict
The point where most continuity plans are misspecified is the disruption’s duration. Autonomy in a data center is the result of arithmetic between critical load, fuel consumption, tank volume and refuelling interval.
Disruption duration is not calculable. That isn’t based on engineering, but inherited from regulation, design standards, cross-dependencies, supply chain and from what has happened before and serves as “expectations.” It is not stress-tested, and you can’t discover it is wrong through analysis. You discover it when you are inside a crisis longer than you thought, and nobody can tell you when it ends.
Our refuelling chain worked properly, since it had been mapped well before the event. Fuel diversification, contracts protected by SLAs, subcontractors identified in advance rather than assumed, and multiple ways to get in touch with the suppliers protected our fuel supply. That work cannot be done during the incident.
Resilience Depends On The Supply Chain Behind You
However, the more important lesson came from another place. In Israel, in the aftermath of October 7 and the period that followed, I saw data centers stop being critical infrastructure. When a state is in a genuine emergency, resources go to what supports survival. Hospitals, emergency services, army and police become the priority. Your place in the “food chain” is reordered by something other than commercial logic.
The question to ask your fuel supplier is not whether they can deliver, but who else they serve, and where you are in the queue when priorities change. Get the same answer from their suppliers. Supply chain resilience must cover every layer that supports the last mile.
Redundancy Fails When Everything Fails Together
Another shift in how I think about continuity came from understanding that large-scale events produce correlated failures. Backups fail for the same reason the primaries did, because the event is national rather than local. Secondary phones fail for the same reason the main one did. Backup suppliers face the same national conditions as the first ones. You can’t staff the operation because people cannot travel either.
One additional phone is not redundancy; satellite phones are. One more fuel contract is not enough; three or four might be. An alternative security provider is not enough; a plan to operate with no security personnel is. Two nights of emergency supplies are not provisioning if the event lasts four days.
If you have one, you have nothing. If you have two, maybe you will have one. If you have three, eventually you will have two.
Planning Has Limits; Preparation Does Not
Control is an illusion that vanishes from your sight when things go beyond what you planned for. As you cannot plan for every scenario, improvisation will always be necessary. The purpose of planning and testing is to minimize improvization, as the less you have to invent under pressure, the more likely you are to succeed.
On the bright side, something we had not planned for surprised me. Nobody knew how long the blackout would last or how it would impact food, water or heating at home. Our people stayed anyway, eventually going to check on their families and coming back. That is not technology, and not something you can plan for. It comes from a work environment where people feel genuinely part of something bigger, which held without having been engineered. What you can plan for is the condition that makes it possible. If people know their families are cared for, they are far more likely to stay.
Provisioning for staff and their dependents belongs in the business continuity plan. Their willingness to stay does not, and should not. The moment you write that in, you have converted goodwill into an obligation.
Ask Better Questions About Continuity
Board members usually ask if the site has backup power or cooling. These questions only confirm the industry basics. Here are better questions: How long does our plan assume the event lasts, and where did that number come from? Who else do our suppliers serve? How would we establish what is actually happening in the first hour, if our normal channels are down?
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?