No Front Lines: A Decision Guide for Companies Caught in Conflict

CSIS | Emily Harding, Julia Dickson and Aosheng Pusztaszeri

Iran threatened data centres across the Gulf in March and April 2026, extending the risks of conflict beyond military bases to commercial infrastructure. The CSIS report, No Front Lines: A Decision Guide for Companies Caught in Conflict, examines how businesses face exposure when their services become entangled in warfare. The immediate concern is corporate involvement in conflicts where civilian and military interests intersect.

The report places these risks within an interconnected economy shaped by just-in-time operations and companies' supporting roles in war. It presents a decision guide for executives and boards, using questions to identify knowledge gaps before evaluating risks and mitigation options. It also examines the protections governments can provide when commercial organisations become exposed to conflict. The framework addresses corporate decisions about assisting a party to a conflict and the consequences of those choices. Its final section offers recommendations for the US president on how the White House can assess and reduce risks facing affected companies. The report received project support from the International Committee of the Red Cross, alongside general support.

Comment

The central strategic issue is the expanding exposure of commercial infrastructure during conflict. Data centres provide computing and information services that can support civilian activity and security functions simultaneously. This overlap complicates the distinction between commercial participation in wartime economies and direct involvement in military operations. The CSIS report frames corporate risk as a decision problem shaped by these competing roles.

A second-order consequence concerns the relationship between corporate risk and the reliability of interconnected services. When a business becomes a target or restricts its activities because of conflict exposure, customers and dependent organisations may face disruption beyond the immediate location. The effect could extend across supply chains and digital services, even where the affected company does not operate on a battlefield. Iran's reported threats to Gulf data centres illustrate the type of exposure examined in the report, although the supplied extract does not establish the extent of any resulting disruption.

This problem also complicates the division of responsibility between governments and private enterprise. Corporate boards assess commercial continuity and liability, whereas national authorities weigh security objectives and wider economic consequences. The CSIS framework brings these responsibilities into the same decision process without assuming that commercial and national interests always coincide. Its focus on White House risk assessment reflects the difficulty of managing private-sector exposure when commercial infrastructure acquires strategic significance during conflict.

Strategic Question for Discussion

If commercial data centres remain exposed during conflict, how should governments and corporate boards weigh national security commitments against the risk of disruption to civilian services?

The CSIS framework suggests that neither corporate risk assessments nor government security objectives can be considered in isolation. Gulf data centres illustrate how decisions affecting one commercial operator could carry consequences for a wider network of dependent services. The balance depends on the specific services involved and the degree of exposure established in each case.

Share your assessment in the comments below.

To read in details click here