What underwriters look for when assessing datacenter infrastructure

Underwriting infrastructure risk for organisations that depend on third-party datacenter capacity is structurally different from underwriting first-party infrastructure. The organisation being assessed does not own the building, does not operate the network, and typically cannot compel the datacenter operator to provide detailed technical documentation on the schedule that a policy application requires. What the underwriter sees is therefore a combination of the insured's own characterisation of the facility, whatever public information exists about the operator, and whatever the broker has been able to gather in the time available before the renewal deadline.

The gap between what an underwriter would ideally verify and what actually lands on the application is often substantial. Facilities are described by the names their operators use in marketing materials rather than the legal entities that hold the relevant contracts. Certifications are listed without expiry dates or indication of whether the most recent audit covered the specific hall the insured occupies. Carrier counts are taken at face value without checking whether those carriers share a common upstream connection or a common physical path into the building. Operator identity is rarely questioned at all. Each of these gaps is a source of pricing error, and collectively they explain why datacenter-related losses have frequently exceeded modelled expectations in recent large-scale outage events.

The most fundamental question an underwriter can ask about a facility is whether the entity named as the operator actually controls the infrastructure. This matters because the legal entity that holds the compliance certifications, the carrier contracts, and the power agreements is the entity whose operational practices and financial stability determine the real risk profile of the facility. An insured that describes its colocation provider as a well-known branded operator may be occupying space in a building that is operated under a different legal entity, managed by a third party under a services agreement, or in the process of a change of control that the marketing brand has not publicly disclosed.

Independent operator verification uses the same network-level records that internet infrastructure researchers and M&A practitioners rely on. The autonomous system registration names a legal entity and a contact domain. The IP block allocation records name an organisation. The exchange point and carrier cross-connect membership records identify who is actually present in the building as a network participant rather than merely as a commercial tenant. When these records align consistently with the operator name the insured has provided, that is a meaningful positive signal. When they point to a different entity, or when no network-level presence can be confirmed for the claimed operator, that is a flag that warrants a follow-up question before the policy is bound.

Certifications are one of the most commonly misread signals in datacenter underwriting because the scope of what a certificate covers is frequently narrower than what the holder implies. An ISO 27001 certificate covers the scope defined in the certificate itself, which may be limited to a specific management process, a single data hall within a larger campus, or the operator's managed services function rather than the physical infrastructure. A SOC 2 Type II report covers the controls that were in place during the audit period, which may have ended a year or more before the policy application. A Tier III or Tier IV designation from Uptime Institute is meaningful only if it is a Tier Certification of Constructed Facility, not a Design certification, and only for the specific building it covers.

The verification step that most application processes skip is checking the certificate directly against the issuing body's registry rather than accepting the operator's representation. UKAS, ANAB, and other accreditation bodies maintain searchable databases of current certificates. Uptime Institute's Tier Certification registry is publicly accessible. ISO certificate registries vary by certification body but are generally available. Checking these registries takes five minutes and surfaces a meaningful rate of expired, narrowly-scoped, or outright misrepresented certificates that an application-based process would have missed.

The certifications that carry the most underwriting weight for business interruption risk are those that address the physical infrastructure directly: Uptime Tier Certification of Constructed Facility for power and cooling architecture, SOC 2 Type II for operational security controls, and PCI DSS for the specific data environment if payments data is processed. ISO 27001 and ISO 27701 address information security and privacy management respectively and are meaningful for security risk assessment but less directly predictive of the physical availability risk that drives business interruption claims.

Carrier diversity is one of the most significant factors in availability risk and one of the most frequently misassessed. The question is not how many carriers the facility's marketing materials list as available, but how many are independently confirmed as physically present, how their connections enter the building, and whether those connections are genuinely diverse at the physical layer or converge on a common conduit, a common aggregation point, or a common upstream transit provider.

The internet exchange point membership records and autonomous system peering databases provide the most reliable view of which networks are actually present in a facility as active network participants. A carrier that is listed on a facility's availability matrix but that has no confirmed presence in the exchange or autonomous system records for that location is a carrier that may be reachable via a reseller arrangement, a third-party cross-connect to another building, or a commercial listing that has not been updated to reflect a change in physical presence. None of those arrangements provide the same resilience as a carrier with its own equipment in the building.

Physical path diversity is harder to verify through public records but is the factor that determines whether a multi-carrier arrangement provides genuine redundancy. Two carriers that both enter a building through the same underground conduit from the same street provide very little diversity against the most common cause of carrier-level outage, which is physical damage to an access path. The best public indicator of path diversity is the number of distinct entry points documented in the facility's publicly filed materials, supplemented by exchange point records that confirm multiple network participants with independently operated infrastructure.

Sanctions and restricted-party exposure in the datacenter operator's ownership chain has moved from a niche concern to a standard underwriting condition at a significant number of carriers in the past three years, driven primarily by the expansion of sanctions programs affecting infrastructure operators in Eastern Europe and parts of Asia. The practical question for an underwriter is whether the operator that the insured is relying on for a core service is an entity with whom a policy could be bound without triggering the insurer's own sanctions compliance obligations, and whether a loss event that required paying a claim to facilitate continued use of the facility would itself raise a compliance question.

Screening the named operator against restricted-party lists is straightforward. The more difficult question is how deep into the ownership chain the screening obligation runs, and this varies by jurisdiction and by the insurer's own compliance posture. The most conservative approach screens the named operator, its direct parent, and its ultimate beneficial owner, and treats any result that lands within two steps of a restricted party as a condition requiring legal opinion before binding. The more common approach screens the named operator only and treats ownership-chain exposure as a warranty matter rather than a pre-bind condition, which shifts the risk of an undisclosed ownership structure to the insured through the misrepresentation exclusion.

For insureds who want to demonstrate clean operator chains proactively, the most effective approach is to present independent verification of the operator's network identity, a traceable ownership chain to a known ultimate parent, and a current restricted-party screen result as part of the application rather than waiting for the underwriter to raise the question. viabandwidth provides verified operator profiles that include network-confirmed identity, operator confidence tier, and publicly traceable corporate information that can be attached to an application directly.