STABiLISED ASSETS
Preparing for evolving risk
Once operational, the risk landscape broadens. Data centres as real assets face multiple exposures, but business interruption is the most pertinent. The impact and cost of downtime are widespread and potentially ruinous. Owners must understand their exposure and put measures in place to limit the impact of any loss event.
Managing business interruption and loss of income
Business interruption costs arising from a loss-of-income scenario is one of insurers’ main concerns. In a scenario which tenants gain the right to break their contract with the data owner, preventing renewal of their rental contract, it can trigger payment of a service credit from the owner to tenant – or dissuades new tenants all together.
Conventional programmes cover some of these scenarios. But for ‘non-damage’ events, such as payment of a service credit, cover can be sourced and designed specifically for the risk.
Building understanding, preventing interruption
Inconsistent or interrupted energy supply is a key risk for operators to consider. While responsibility for maintaining server equipment varies by operating model failure of the power supply to monitoring or cooling systems can increase the risk of fire and associated damage to data centre equipment. This in turn can disrupt operations and cause large scale data loss. Some servers shut down automatically if cooling becomes ineffective – and that failure alone can be enough for a tenant to invoke punitive contract conditions.
Where power supply failures are frequent or sustained long term, there’s a growing risk of existing tenants’ departure – and a shrinking ability to source new tenants. Insurers are sensitive to this risk, owing to the typically high sums required to cover long-term lost rental income. Owners have suffered contractual penalties when found to have failed to guarantee energy supply to tenants.
Equipped for success
Both the plant and the equipment inside need sufficient cover. A standard real estate policy will typically respond to property damage from events like fire, but not to sudden, unforeseen mechanical or electrical breakdown of the plant and equipment. With the volume, value and importance of the machinery involved, a specialised engineering insurance policy is strongly recommended. Ideally constructed with limits set to the highest-value item and a total loss aggregate, your critical infrastructure will be comprehensively protected.
Human, digital and natural – a world of hazards
Protecting the security of data centres is a key responsibility for both owners and tenants. Holding vast amounts of diverse and valuable data makes the properties an attractive target for potential threat actors. An owner’s ability to demonstrate resilience to these threats is critical – both to reputation and to potential clients.
Specific threats can include hostile attacks on the physical perimeter and buildings. Exposure is shaped by geography, ownership, tenants and the nature of the data held. Threat actors may impersonate others to gain access and cause physical damage; alternatively, a cyber-attack may aim to cause physical harm – for instance, by hacking cooling and monitoring systems to raise the likelihood of fire or data loss.
Natural hazards also pose a complex threat to data centres, including service disruption and power outages caused by a number of potential events.
Environmental impact
Data centres carry a significant environmental footprint. Servers are highly energy intensive and must be supplied with large volumes of power. Likewise, cooling systems, essential to fire prevention, draw on huge volumes of water.
This footprint poses a risk both to the surrounding natural environment and beyond. In Slough, a town to the west of London, which has the largest concentration of data centres in Europe, there are fears that data centres' huge demands on local power and water supply may cause future shortages for residents. Although designed to draw on wastewater, many have been found to be using drinkable water supply for cooling purposes.
Other environmental risks include fuel leaks, improper wastewater disposal and fire risks spreading to the surrounding structures and community.
Mitigating ecological risk
As the global climate changes and property losses from natural catastrophes become more prevalent, it's more important than ever to ensure that assets are protected and future-proofed against emergent climate risks. Where data centres are concerned, the risk is even more acute – and the loss to insurers and investors is significant.
Flood mitigation, for example, can be integrated throughout the entire project lifecycle, improving an asset's risk profile for insurers and reducing insurance costs. This can prevent interruption to operation, safeguarding tenant income.
Lockton partners with specialist providers to deliver climate risk modelling and analysis for clients – informing investment decisions and safeguarding assets against a more extreme climate. This modelling can, for example, anticipate future wildfire exposure, helping clients avoid building or buying in areas set to become high-risk.
Retro-fit and converted data centres
For retrofit data centres, or those installed within a pre-existing building, location demands extra consideration.
Basements are an increasingly popular choice, but carry a high risk of flood and water leakage – especially in older properties. Going higher still, to upper floors or the roof, means checking the weight-bearing capacity of the floor against the combined weight of the equipment – including anything that may be added later as the property’s needs evolve. Roof installations are exposed to higher risk from storm damage, wind damage, and potential ingress of water.
Insuring data centres
Insurance is available to insure loss of rent, but insurers will typically require extensive information on the property: the operating model (single or multiple clients), on-site fuel storage and historic fuel leaks, and sprinkler and/or gas suppression systems.
Loss of power is typically only insured after 40–60 days and insurers may require a specific damage trigger to respond. Data centres must therefore rely on redundant capacity: generators, batteries or other alternative power supply options.
As the global climate changes, it's more important than ever to ensure assets are protected and future-proofed against emerging climate risks.
Recommendations
There are various steps owners can take to improve the resilience and reassure insurers, including:
- Conduct a risk assessment on the building’s key threats and how attacks are likely to manifest
People, physical and management
- Implement deterrence measures, including visible security personnel and strong security messaging
- Check for physical exposures to the data centre, including wastewater systems and ducting for potential access points
- Conduct role-base risk assessments to identify high-risk positions, and undertake robust pre-appointment screenings of permanent and contract staff
- Train staff and leadership from induction through to exit, and refresh learning regularly
- Monitor and review staff performance to ensure security and people issues are recognised and solved
- Develop and regularly update a crisis plan to be enacted in the event of a potential loss-causing event.
Cyber and mechanical
- Limit access to key control systems
- Run cyber vulnerability assessment (potentially involving tenants) to identify and resolve potential weaknesses
- Segregate or filter power supply to secure any unreliable equipment
- Build redundancy in power generation and supply to protect against a potential power outage, including backup generators and on-site renewables where possible.
