Computer Facilities Management Services (NAICS 541513) — U.S. Industry Primer

1. Overview

When a bank, a hospital, or a federal agency decides it no longer wants to run its own computer systems, it hires someone to run them. That "someone" is this industry. NAICS (North American Industry Classification System) code 541513 — Computer Facilities Management Services covers firms that take over the on-site management and day-to-day operation of a client's computer systems and data-processing facilities [1]. In plain terms: you own the machines (or the workloads); they run them for you, often with their own staff sitting in your data center or managing it remotely under contract.

This is the "someone-else-runs-my-IT" business — the operational core of IT (information technology) outsourcing. It is distinct from writing software, designing systems, or providing help-desk support (those are separate codes; see Section 2). It is also completely different from building facilities management (janitorial, HVAC, security guards) — a common naming confusion this primer flags up front [1][37].

Why it matters to an investor. This is a large, mature, contract-driven services business with two crosscurrents pulling in opposite directions. The legacy core — running enterprise data centers and mainframes — is in slow structural decline as workloads move to cloud platforms. At the same time, the AI-driven data-center buildout is creating fresh demand for operating and managing physical compute infrastructure [26][27]. Owners make money on multi-year contracts, billable staff, and labor cost arbitrage, not on selling a product.

Two ways in.

• Public-market investors can buy pure-play and near-pure-play operators (Kyndryl, DXC Technology, Unisys), diversified integrators where this is one segment (IBM, Accenture, Cognizant, Rackspace), federal-facing contractors (Leidos, SAIC, Booz Allen, CACI, GDIT), and offshore majors via ADRs (American Depositary Receipts — foreign shares traded in New York, e.g., Infosys, Wipro, Fujitsu) [6][8][9]. A related but distinct route is data-center ownership (Equinix, Digital Realty, Iron Mountain) — real estate, not core 541513 (Section 4).
• Private investors meet the industry as private-equity-owned platforms (Peraton, ManTech, Ensono, Presidio) and as thousands of small regional MSPs (managed service providers) — a classic roll-up hunting ground [17][18][19].

2. What it is and how it's structured

In scope. Establishments primarily engaged in providing on-site management and operation of clients' computer systems and/or data-processing facilities, including support services [1]. The defining feature is operating someone else's IT under a service contract — keeping the servers running, patched, secured, backed up, and available. A typical provider will run servers, storage, networks, mainframes, and security tools; staff a client's data center or operations center; monitor systems and manage incidents; operate private, public, or hybrid cloud environments; and provide migration, modernization, and disaster-recovery support.

What it explicitly excludes — and where that work is classified instead:

• 541511 — Custom Computer Programming Services: writing and modifying software to order [2].
• 541512 — Computer Systems Design Services: planning and integrating hardware/software systems (this is where much large-scale "IT outsourcing" revenue actually lands) [2].
• 541519 — Other Computer Related Services: IT project management, help desk, and other computer services not elsewhere classified [2].
• 518210 — Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services: providing compute/hosting/colocation at the provider's own facility, rather than managing the client's [2]. This is the key boundary: 541513 runs the customer's systems; 518210 runs the provider's.
• 561210 — Facilities Support Services: operating a client's physical premises (building operations, staffing) — the non-IT "facilities management" that shares the name [37].

The boundaries are blurry in practice. A single outsourcing contract can span design (541512), operations (541513), software (541511), and hosting (518210), and firms self-classify — which is central to the size caveat below.

Ownership mix. At the pure-code level the industry is fragmented: mostly privately held mid-size operators and small MSPs, plus the U.S. arms of global integrators and federal contractors. The U.S. Census counts about 6,374 establishments run by roughly 5,338 firms, averaging about 16 employees per location [3][4]. The SBA (U.S. Small Business Administration) size standard for the industry is $37 million in annual receipts [5] — meaning the overwhelming majority of firms here qualify as "small." The federal data publish no public-versus-private ownership split; government-run and in-house IT operations generally fall outside the code entirely.

3. How big it is

Federal statistics for the specific 541513 code (our ground-truth figures; prefer these):

The picture is a labor-intensive professional service — payroll eats roughly 44 cents of every revenue dollar — that is remarkably unconcentrated. The four largest firms hold under 14% of receipts, and the HHI (Herfindahl-Hirschman Index; a market-concentration score where under ~1,500 signals low concentration) is just 80.3, extraordinarily low [4]. Our ground-truth file publishes no NAICS-wide figures for operating margins, contract renewal rates, capacity utilization, or energy use — where a metric is missing we say so; the company and sector data later in this primer are not substitutes for those absent industry totals.

The undercount / classification caveat (important). Two things about these numbers.

First, a methodology point. County Business Patterns and the Economic Census size datasets count only employer establishments with payroll. Government operations, captive in-house IT teams, and tiny nonemployer operators all sit outside these measures [3][4]. That matters here because so much computer-facilities work is done inside the buyer's own organization or by government staff — none of which shows up in the code.

Second, the "market" you picture is bigger. The $23.8 billion is far smaller than the "IT infrastructure outsourcing" market most investors imagine, and the low concentration is misleading, for structural reasons:

• The mega-outsourcers dwarf this figure. Kyndryl alone books roughly $15 billion in global revenue and DXC about $13 billion [6][8] — but most of that is classified in adjacent codes (systems design 541512, hosting 518210) or generated by foreign operations outside U.S. business statistics.
• In-house IT doesn't count. A bank or agency running its own data center with its own employees is classified in its industry, not here. Government IT operations, staffed by federal and state employees, sit outside these statistics altogether — a large offset given how much of this work is government-facing.
• What remains in the 541513 bucket skews toward mid-size specialist operators and the U.S.-registered slices of federal contractors — hence the fragmentation.

So read the $23.8 billion as the pure-play, contracted-out core, not the full economic footprint of "running other people's IT," which is many times larger once adjacent codes and captive operations are included [4].

4. The investable universe

There is no single "541513 stock," and no listed company is a pure proxy. Exposure is spread across pure-plays, diversified integrators, federal contractors, and offshore majors. Revenue figures below are total company unless noted — for most, computer facilities management / infrastructure operations is only a portion of the business.

Core managed-infrastructure and federal-IT operators (closest to 541513):

Adjacent — data-center owners (real estate, not core 541513). Some investors approach the "digital infrastructure" theme through the companies that own the buildings rather than manage the customer's systems. These are colocation and data-center REITs (real estate investment trusts) — classified in 518210/real estate, not 541513 — and their economics are asset-heavy: Equinix (EQIX) [20], Digital Realty (DLR) [21], and Iron Mountain (IRM) [22]. Treat them as a related but distinct bet (Section 5).

Major private / other owners. Peraton (private-equity firm Veritas Capital) and ManTech (Carlyle) are large federal IT operators; Ensono (KKR) is a private managed-infrastructure platform [17]; Presidio (Clayton, Dubilier & Rice, with BC Partners retaining a minority stake) provides cloud, cybersecurity, infrastructure and managed services [18]; World Wide Technology is a privately held systems integrator with managed services across infrastructure, cloud and data centers [19]. On the asset-heavy side sit private data-center platforms: QTS (Blackstone) [23], CyrusOne (KKR and Global Infrastructure Partners) [24], and Flexential (GI Partners and Morgan Stanley Infrastructure Partners) [25]. TCS, HCLTech and Tech Mahindra are India-listed offshore majors not on U.S. exchanges; NTT Data (Japan), Capgemini (France) and the distressed Atos (France) are large non-U.S. integrators. Beneath them all sit thousands of small, privately held regional MSPs — the fragmented long tail that makes up most of the 6,374 U.S. establishments [3].

Bottom line: only a handful of near-pure public plays exist (Kyndryl, DXC, Unisys). Most exposure comes bundled inside larger integrators, federal contractors, or data-center owners, so position sizing should reflect that infrastructure operations is often a minority of the reported business.

5. How the money works

Core 541513 is a contract-and-labor business, so the economics look like professional services, not manufacturing or real estate.

Revenue model (asset-light managed operations). Owners sign multi-year managed-services contracts (typically three to seven years) to run a client's systems for a fee. Pricing takes several forms: fixed-price managed services (a set monthly fee to keep everything running), time-and-materials (billable hours), per-unit (per server, per seat, per transaction), and increasingly outcome-based; revenue is recognized over the service period [6][8]. Much of it is annuity-like — it recurs monthly for the contract's life — which makes the business relatively predictable but slow-growing.

The metrics owners and investors actually watch:

• Signings / bookings and backlog — the total contract value newly signed, and the committed future revenue. This is the leading indicator; revenue lags signings by quarters. Kyndryl's record $18.2 billion of FY2025 signings, up 46%, is why investors tolerated a 6% revenue decline that year [7].
• Book-to-bill — signings divided by revenue; above 1.0 means the backlog is growing.
• Billable utilization — the share of paid staff time that is billed to clients. For a labor business, a few points of utilization is the difference between profit and loss.
• Labor cost arbitrage — delivering the work from lower-cost locations (India, the Philippines, Eastern Europe). India-based providers command a large share of the global IT-outsourcing market largely on this basis [16].
• Adjusted EBITDA margin — earnings before interest, taxes, depreciation and amortization, adjusted for one-offs. Margins here are thin: Kyndryl's adjusted EBITDA margin runs around the mid-teens, and DXC's infrastructure work carries low-single-digit segment margins [6][8].
• Revenue per employee (~$230,000 industry-wide) and payroll-to-revenue (~44%) capture how labor-heavy the model is [3][4].

Where the profit leaks. Legacy contracts signed years ago can turn loss-making as costs rise; a chunk of the industry's recent story is mega-outsourcers exiting or repricing unprofitable accounts to lift margins even as revenue shrinks [6][8]. Contracts also carry SLA (service-level agreement) penalties — financial credits owed if uptime or response-time targets are missed — so operational reliability directly protects margin. Taking over a client's data center can also require absorbing assets and staff, temporarily denting returns.

The asset-heavy adjacent model. Investors who approach the theme through data-center owners (Section 4) face different economics: those firms own or lease buildings, power and cooling, and charge recurring fees for space, power and connectivity. Power costs may be passed through, but the owner bears construction, financing, permitting and utilization risk, and the right yardsticks become megawatts energized, capital expenditure per megawatt, pre-leasing, interconnection density, and balance-sheet leverage — not billable utilization [20][21].

6. What drives demand

• The outsourcing / cost cycle. Companies outsource IT operations to cut cost and refocus on their core business, especially when budgets tighten. This is the oldest driver and it is cyclical.
• Hybrid and multi-cloud complexity — a double-edged sword. Moving workloads to Amazon, Microsoft and Google cloud platforms shrinks demand for running legacy on-premises data centers, but creates demand for managing security, data movement, legacy interoperability and compliance across internal systems, private clouds and multiple public clouds. The net effect is a mix shift, not disappearance [6][11].
• The AI data-center boom. Hyperscaler capital spending on data centers is on track to approach $1 trillion a year by 2030, with global capacity projected to roughly double between 2025 and 2030 [27]. The scale shows up in the power grid: the International Energy Agency estimates data centers consumed about 415 terawatt-hours (TWh — a unit of electricity; 1 TWh = 1 billion kilowatt-hours), or roughly 1.5% of global electricity, in 2024, with the United States accounting for about 45% of that [29]; the U.S. Department of Energy projects U.S. data-center electricity use could climb from 176 TWh in 2023 to 325–580 TWh by 2028 [28]. All that physical compute needs operating, cooling, securing and managing — a fresh tailwind for infrastructure operations services. The "services for data center" market is forecast to grow from about $116 billion in 2025 to $321 billion by 2030 (roughly a 23% annual rate) [26].
• Federal IT budgets. Government agencies are heavy outsourcers of computer operations; federal spending and contracting cycles swing a large share of this industry (see Sections 7 and 9).
• Cybersecurity and resilience mandates. Ransomware, outages and third-party risk make continuous monitoring, backup, recovery and secure operations more valuable; legacy-mainframe modernization and disaster-recovery/business-continuity requirements pull work toward specialist operators.
• Regulated workloads. Government, healthcare, financial and defense customers need specialized controls, certifications and auditability, which favors providers with the right accreditations.

Forward-looking judgment. Demand should stay favorable but grow unevenly. AI and hybrid-cloud workloads support the broader infrastructure market; migration to hyperscalers, automation, and selective insourcing can reduce traditional facilities-management labor.

7. Regulation

The industry is not licensed or rate-regulated. There is no permit to run someone's data center. But it operates under a dense compliance overlay driven by the sensitivity of the data being handled — and the burden is usually passed through the customer contract.

• Federal systems. The FISMA (Federal Information Security Modernization Act) makes agencies responsible for protecting systems that contractors operate on their behalf, using the NIST (National Institute of Standards and Technology) 800-53 control baselines [31]. Federal cloud services must pass FedRAMP (Federal Risk and Authorization Management Program — a standardized security authorization for cloud used by agencies) [32]. Defense work adds CMMC (Cybersecurity Maturity Model Certification) and personnel clearances, and contracting runs under the FAR/DFARS (Federal and Defense Federal Acquisition Regulations).
• Healthcare. The HIPAA (Health Insurance Portability and Accountability Act) Security Rule requires administrative, physical and technical safeguards for electronic protected health information, and applies to both covered entities and their business associates [33].
• Financial services. The GLBA (Gramm-Leach-Bliley Act) Safeguards Rule requires financial institutions and their service providers to protect customer information [34].
• Commercial frameworks. Voluntary but market-mandatory standards govern the rest — SOC 2 (a service-organization security/availability audit), ISO 27001, and PCI DSS (payment-card data) [30].
• Public-company disclosure. SEC (Securities and Exchange Commission) rules require public companies to disclose material cybersecurity incidents and annual cybersecurity risk-management information [35].
• Data handling. Privacy regimes — the EU's GDPR (General Data Protection Regulation), U.S. state privacy laws, and data-sovereignty rules — constrain where data can be processed, which matters for offshore delivery.
• Physical infrastructure. Data-center owners (the adjacent group) also face local zoning, building, water, emissions and utility-interconnection permitting — less central to asset-light 541513 providers, critical for the owners.

Compliance is a barrier to entry and a cost center: FedRAMP authorization is expensive and slow, which favors incumbents with existing accreditations and cleared staff.

8. Competitive dynamics and consolidation

A barbell market. At one end, a handful of mega-integrators and federal contractors dominate large enterprise and government deals; at the other, thousands of small MSPs serve mid-market and local clients — hence the low measured concentration in the pure-code statistics (CR4 13.8%, CR8 20.5%, CR20 30.5%, CR50 44.1%, HHI 80.3) [4]. Those figures describe the national category and do not rule out strong local or customer-specific concentration.

Competition rests on reliability and uptime, skilled labor and 24-hour operating coverage, automation and proprietary operational data, certifications and regulated-industry experience, and switching costs inside existing relationships.

The hyperscaler threat. The most disruptive competitors aren't other outsourcers — they're the cloud platforms themselves. When a client moves to Amazon Web Services or Microsoft Azure, the cloud provider effectively becomes the "facilities manager," and the traditional outsourcer's role shrinks to integration and management around the edges. This is the central structural pressure on legacy revenue [8][26].

Offshore labor arbitrage from Indian majors continues to pressure pricing and margins across the board [16]. Automation and AI are now compressing the labor content of operations — the very headcount the business bills for — a threat and an opportunity (lower cost to serve) at once.

Consolidation has been continuous. DXC Technology itself was formed by merging Computer Sciences Corporation with Hewlett Packard Enterprise's services arm; IBM spun its managed-infrastructure unit into Kyndryl in 2021 [6]. Private equity is an active consolidator of federal operators (Peraton, ManTech), managed-infrastructure platforms (Ensono, Presidio) [17][18], and the physical layer via take-privates and joint ventures that share data-center capital (QTS, CyrusOne, Flexential) [23][24][25]. Expect continued roll-ups of the fragmented long tail and portfolio reshaping among the majors — likely selective, favoring scaled operators with trusted compliance, automation, customer density and secured power.

9. Risks

• Structural cloud cannibalization. The legacy on-premises data-center outsourcing core is in secular decline; both Kyndryl and DXC have posted mid-single-digit revenue declines while restructuring toward higher-value work [6][8].
• AI / automation eroding the labor model. If software runs the operations, the billable-headcount revenue base shrinks.
• Thin margins and fixed-price / legacy-contract losses. Low-single-digit to mid-teens margins leave little cushion; labor inflation or underestimated complexity can destroy margins on multi-year contracts before they can be repriced.
• Customer concentration and contract-loss risk. Revenue often hinges on a few very large accounts; hyperscalers and large enterprises have the purchasing power to renegotiate, insource or shift workloads.
• Federal budget risk. Government-exposed players face policy swings. In 2025 the DOGE (Department of Government Efficiency) effort cancelled, cut or restructured an estimated $85+ billion in federal contracts, explicitly targeting large IT integrators including GDIT, IBM, Leidos, SAIC and Booz Allen, and consolidating toward cloud [36]. Near-term federal demand is genuinely uncertain.
• Cybersecurity / breach liability. Operating a client's systems means owning the blast radius when something goes wrong — remediation costs, SLA credits, and a provider's failure becoming the customer's compliance breach.
• FX and offshore wage inflation squeeze globally delivered contracts.
• For the adjacent data-center owners: power and construction risk (utility delays, permitting, equipment shortages, rising interest costs, stranded capacity) and AI obsolescence (higher-density chips and new cooling can strand existing facilities) [20][21].
• Cyclicality. Enterprise IT budgets and large outsourcing decisions can slow in downturns even when long-run demand holds.

10. How to invest and the outlook

Public routes. Separate three exposures and size them by actual business mix:

• Managed infrastructure (closest to 541513): the near-pure operators Kyndryl (KD), DXC Technology (DXC) and Unisys (UIS), which trade primarily on signings momentum, margin recovery and the pace of the legacy-to-modern mix shift, plus diversified exposure via IBM, Accenture (ACN), Cognizant (CTSH) and Rackspace (RXT), where this is one segment of a larger whole [6][8][9].
• Federal IT: Leidos (LDOS), SAIC, Booz Allen (BAH), CACI and General Dynamics (GD, via GDIT) — with the DOGE overhang as the key near-term swing factor [13][14][36].
• Offshore delivery: Infosys (INFY) and Wipro (WIT) ADRs, or Fujitsu (FJTSY) [15][16].
• Adjacent digital infrastructure (real estate, not 541513): the data-center REITs Equinix (EQIX), Digital Realty (DLR) and Iron Mountain (IRM) — a capital-intensity/power bet rather than a labor-services one [20][21][22].

Because no listed company is only 541513, the real work is segment analysis: compare recurring revenue, backlog, retention, contract profitability, customer concentration, capital spending, net debt and cybersecurity track record. Share price, dividend yield and valuation multiples are useful only after adjusting for each company's actual mix of asset-light services, real estate, hardware, consulting and cloud capacity — and should be checked at time of purchase.

Private routes. Private and institutional investors access the industry through private-equity platforms (Veritas Capital's Peraton, Carlyle's ManTech, KKR's Ensono, CD&R's Presidio), infrastructure funds and data-center joint ventures, and through buy-and-build strategies rolling up regional MSPs — a fragmented, cash-generative long tail well suited to consolidation. Direct operators can be bought outright given the low average firm size and the $37 million SBA small-business threshold [5]. Underwriting should focus on contract quality, renewal history, labor intensity, automation, and — for the asset-heavy platforms — power availability, pre-leasing, tenant credit, construction budget, permitting and exit liquidity.

Near-term drivers and outlook (forward-looking). The base case is a two-speed industry. The legacy data-center outsourcing core will likely keep shrinking modestly as cloud migration continues, pressuring reported revenue at the incumbents. Against that, the AI-driven data-center buildout is a real and growing new demand vector for operating and managing physical compute, and the fast-growing "services for data center" market suggests the total opportunity is expanding even as its composition changes [26][27][29]. Winners will be operators that (a) convert record signings backlogs into higher-margin revenue, (b) automate operations faster than pricing erodes, and (c) reposition from legacy hosting toward hybrid-cloud, AI-infrastructure and cyber-resilience work. Federal-facing players carry additional binary risk from the 2025–2026 budget and consolidation cycle [36]. In short: a mature, cash-generative, consolidating industry — not a growth story in aggregate, but with pockets of genuine growth for those on the right side of the cloud and AI transition.

---

Sources

1. U.S. Census Bureau, 2022 NAICS 541513 — Computer Facilities Management Services (definition and scope). https://www.census.gov/naics/?details=541513&input=541513&year=2022
2. U.S. Census Bureau, 2022 NAICS — adjacent computer-services and hosting codes (541511, 541512, 541519, 518210); Sector 54 manual. https://www.census.gov/naics/resources/archives/sect54.html
3. U.S. Census Bureau, County Business Patterns, NAICS 541513 (establishments, employment, payroll), 2023 (Histometrics ingested federal statistics); CBP methodology. https://www.census.gov/programs-surveys/cbp.html · https://www.census.gov/programs-surveys/cbp/technical-documentation/methodology.html
4. U.S. Census Bureau, Economic Census — receipts, firms, concentration (CR4/CR8/CR20/CR50, HHI), NAICS 541513, 2022 (Histometrics ingested federal statistics); Establishment and Firm Size dataset. https://www.census.gov/programs-surveys/economic-census.html · https://api.census.gov/data/2022/ecnsize.html
5. U.S. Small Business Administration, Table of Small Business Size Standards (NAICS 541513: $37 million), 2023. https://www.sba.gov/document/support-table-size-standards
6. Kyndryl Holdings, Inc., Form 10-K, fiscal year ended March 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1867072/000155837025008282/kd-20250331x10k.htm
7. Kyndryl Holdings, Inc., Q4 and Full-Year Fiscal 2025 Results (signings $18.2B), 2025. https://investors.kyndryl.com/news-releases/news-release-details/kyndryl-reports-fourth-quarter-and-full-year-2025-results
8. DXC Technology Co., Form 10-K, fiscal year ended March 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1688568/000168856825000029/dxc-20250331.htm
9. StockAnalysis, Unisys (UIS) Revenue (~$1.95B), 2026. https://stockanalysis.com/stocks/uis/revenue/
10. Rackspace Technology, Form 10-K, fiscal year ended December 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1810019/000181001926000015/rxt-20251231.htm
11. International Business Machines, Technology Lifecycle Services, 2026. https://www.ibm.com/services/technology-lifecycle-services
12. Accenture plc, Form 10-K, fiscal year ended August 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1467373/000146737325000217/acn-20250831.htm
13. Fed-Spend, Top Federal Contractors by Revenue FY2025 (Leidos ~$16.7B), 2025. https://fed-spend.com/blog/who-is-the-highest-paid-government-contractor
14. TBR / Fed-Spend, Federal IT vendor revenue (Booz Allen Hamilton ~$9.8B federal), 2025. https://fed-spend.com/blog/who-is-the-highest-paid-government-contractor
15. Macrotrends, Fujitsu Revenue 2012–2025 (~$23.4B), 2025. https://www.macrotrends.net/stocks/charts/FJTSY/fujitsu/revenue
16. Business Today / eSparkinfo, Indian IT majors and managed-services outsourcing (Infosys, Wipro, TCS, HCLTech), 2025. https://www.businesstoday.in/markets/stocks/story/infosys-wipro-tcs-hcl-tech-key-takeaways-from-accentures-q4-for-indian-it-giants-495795-2025-09-26
17. Charlesbank Capital Partners, Charlesbank to Sell Ensono to KKR, 2021. https://www.charlesbank.com/news/charlesbank-to-sell-ensono-to-kkr/
18. BC Partners, CD&R to Acquire Presidio from BC Partners, 2024. https://www.bcpartners.com/news/cdr-to-acquire-presidio-from-bc-partners/
19. World Wide Technology, Managed Services Overview, 2025–2026. https://www.wwt.com/service/managed-services/overview
20. Equinix, Inc., Form 10-K, fiscal year ended December 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1101239/000110123926000032/eqix-20251231.htm
21. Digital Realty Trust, Inc., Form 10-K, fiscal year ended December 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1494877/000110465926015365/dlr-20251231x10k.htm
22. Iron Mountain Inc., Form 10-K, fiscal year ended December 31, 2025 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1020569/000102056926000013/irm-20251231.htm
23. Blackstone, Behind the Deal: AirTrunk, Data Centers and Blackstone's Digital Infrastructure Strategy (QTS), 2025. https://www.blackstone.com/insights/article/behind-the-deal-airtrunk-data-centers-and-blackstones-digital-infrastructure-strategy/
24. Global Infrastructure Partners, KKR and GIP Complete Acquisition of CyrusOne, 2022. https://www.global-infra.com/news/kkr-and-gip-complete-acquisition-of-cyrusone/
25. Flexential, GI Partners Strategic Investment in Flexential, 2025. https://www.flexential.com/resources/press-release/gi-partners-strategic-investment-in-flexential
26. MarketsandMarkets, Services for Data Center Market — Global Forecast to 2030, 2025. https://www.marketsandmarkets.com/PressReleases/services-for-data-center.asp
27. IoT Analytics / Bain & Company, Data-center infrastructure market — AI-driven capex toward $1 trillion by 2030; capacity doubling 2025–2030, 2025. https://iot-analytics.com/data-center-infrastructure-market/
28. U.S. Department of Energy, Report Evaluating Increase in Electricity Demand from Data Centers (176 TWh in 2023 to 325–580 TWh by 2028), 2024. https://www.energy.gov/articles/doe-releases-new-report-evaluating-increase-electricity-demand-data-centers
29. International Energy Agency, Energy and AI — Executive Summary (data centers ~415 TWh, ~1.5% of global electricity, 2024; U.S. ~45%), 2025. https://www.iea.org/reports/energy-and-ai/executive-summary
30. MindPoint Group / Schellman, FedRAMP, FISMA, and SOC 2 — compliance frameworks for IT services, 2025. https://www.mindpointgroup.com/blog/fedramp-fisma-and-soc-2-whats-the-difference
31. National Institute of Standards and Technology, SP 800-53B Control Baselines; FISMA Implementation Project, 2020 (updated 2025). https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final
32. FedRAMP, Scope of FedRAMP, 2026. https://www.fedramp.gov/2026/scope/
33. U.S. Department of Health and Human Services, The HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/index.html
34. U.S. Federal Trade Commission, Safeguards Rule (Gramm-Leach-Bliley Act). https://www.ftc.gov/legal-library/browse/rules/safeguards-rule
35. U.S. Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, 2023. https://www.sec.gov/rules-regulations/2023/07/s7-09-22
36. GovSpend / Washington Technology, DOGE contract terminations in FY2025 (~$85B+; targeted IT integrators), 2025. https://govspend.com/blog/doge-terminations-in-fy25-what-the-numbers-say-and-whats-still-to-come/
37. U.S. Census Bureau, 2022 NAICS 561210 — Facilities Support Services (physical facilities management, distinct from 541513). https://www.census.gov/naics/?input=561210