Colocation Data Center Insurance: Coverage for Operators and Tenants

Colocation is the dominant model in enterprise data center infrastructure — a company leases rack space, cage space, or private suites inside a third-party facility, and the facility operator handles power, cooling, physical security, and network connectivity. The insurance implications for operators and tenants are completely different, and each side routinely misunderstands what the other party’s coverage actually provides.

This guide covers both sides of the colocation insurance equation: what operators need to run a facility, and what tenants need to protect their operations when they’re dependent on infrastructure they don’t own.

Colocation Operator Insurance: The Full Coverage Stack

Running a colocation data center requires a coordinated insurance program across multiple lines. Each coverage addresses a specific risk category, and gaps between them are where operators get hurt.

Property Insurance

Property coverage for colocation facilities needs to address the specific asset mix: the building and infrastructure (power distribution, cooling systems, UPS, generators), the operators’ own equipment, and — critically — how the operator’s policy interacts with tenant equipment that lives in the facility. Most property policies cover property owned by or in the care, custody, and control of the insured. For colocation operators, tenant servers, networking equipment, and storage arrays in their facility raise CCC questions that should be addressed in the policy language.

Equipment values in a modern colocation facility can be enormous. A hyperscale tenant’s GPU cluster may represent hundreds of millions of dollars in equipment value. The operator’s property policy generally should not be structured to cover tenant equipment — tenants should carry their own property coverage — but the policy should be clear about this boundary. Ambiguity creates claims disputes.

Property coverage should be on a replacement cost basis for the facility and equipment, with special attention to: cooling system replacement values (which are substantial and often underestimated), power distribution and UPS replacement costs, and generator replacement. All-risk coverage is standard; open perils form covers causes of loss not specifically excluded rather than only named perils.

General Liability

GL for colocation operators covers bodily injury and property damage claims from third parties — tenant employees injured in the facility, visitors, contractors. The specific exposure to track is the coverage of tenant property damage claims arising from operator operations: if an operator’s cooling system fails and water damages a tenant’s server equipment, the tenant has a property damage claim against the operator’s GL. This scenario should be explicitly addressed in the policy — standard GL policies have equipment in the operator’s “care, custody, and control” exclusions that could complicate the claim.

Technology E&O / Professional Liability

This is the coverage line that colocation operators most often underinsure. Tech E&O covers claims arising from service failures — outages, SLA breaches, data loss from operator error, failure to deliver contracted uptime. When a tenant sues because their operations were disrupted by an operator-caused outage, that’s a tech E&O claim, not a GL claim. The distinction matters because GL policies typically exclude professional services and contractual liability.

For colocation operators with enterprise tenants, tech E&O limits should be sized against the tenants’ actual revenue exposure during an outage period, not just the operator’s own revenue. A tenant generating $1M/hour in revenue who is down for 6 hours has $6M in potential damages — the operator’s tech E&O needs to be sized to address that exposure across the full tenant base.

Cyber Liability

Colocation operators handle tenants’ infrastructure and in many cases have network access that creates shared security exposure. A breach that originates in the operator’s management systems can affect multiple tenants simultaneously. Cyber liability for operators should cover: first-party breach response costs; third-party liability to tenants whose data or systems were affected by a breach in the operator’s environment; regulatory penalties; and crisis management. Non-damage cyber BI — coverage for outages caused by cyberattacks without physical damage — is discussed in our dedicated BI guide and should be included in every operator program.

Environmental Liability

Colocation facilities store significant quantities of diesel fuel for backup generators, use cooling chemicals that require proper disposal, and manage lithium-ion battery arrays. FM Global’s 2026 guidance specifically addressed Li-ion battery disposal as a new environmental exposure category. Pollution legal liability and contractors pollution liability (for maintenance contractors working on these systems) address the environmental gap left by standard GL and property policies.

Tenant Insurance: What You Need When You Don’t Own the Facility

Tenants in colocation facilities have a fundamentally different risk profile than owner-operators. The most important thing to understand: the colocation operator’s insurance does not cover you. Their property policy covers the building and their equipment. Their GL covers their liability. Their cyber covers their breach. When their facility goes down and your operations stop, you need your own coverage to respond.

Property Coverage for Equipment in the Colo

Your servers, storage arrays, networking equipment, and GPU hardware in a third-party facility need to be covered under your own property policy. Most commercial property policies extend coverage to property at locations you don’t own — verify this is explicitly the case in your policy and that the coverage limit is adequate for the full replacement value of equipment in the colocation facility.

For AI-intensive operations, GPU hardware values are substantial and fluctuate with supply chain conditions. Current-generation H100 and H200 GPUs run $30,000–$150,000 each. Coverage at actual cash value (depreciated) rather than replacement cost can create significant gaps if equipment needs to be replaced after a covered loss.

Contingent Business Interruption: The Critical Tenant Coverage

This is the most important and most underinsured coverage for enterprise tenants with significant colocation dependencies. Standard cyber and BI policies cover losses caused by events at your own facilities. When the disruption originates at the colocation provider’s facility — their power failure, their cooling system failure, their cyber incident — your standard policies typically don’t respond.

Contingent business interruption (contingent BI) covers revenue losses caused by disruption at a named supplier’s facility. For data center tenants, the named supplier is the colocation provider. When the provider’s outage causes your operations to stop, contingent BI responds to cover your revenue loss.

Sizing contingent BI requires honest assessment of operational concentration. If 40% of your revenue-generating capacity is in a single colocation facility, that’s 40% of your annual revenue at risk in a total outage. We’ve seen enterprise clients significantly undersize this coverage by using a “catastrophic only” mindset — but partial outages that affect specific tenants while the broader facility operates are common and can be equally damaging.

Cyber Coverage for Tenants

Tenants need their own cyber liability coverage that addresses: their own data breach exposure; first-party BI from cyber events affecting their own systems; and contingent cyber BI from events at the colocation provider. The contingent cyber BI coverage for tenant-side exposure is structurally similar to contingent property BI — it responds when a cyber event at the provider disrupts the tenant’s operations.

The specific policy language to look for: “service interruption coverage” or “contingent extra expense from service providers” within the cyber policy. Policies that don’t explicitly name the colocation provider and confirm coverage for provider-side cyber events will likely not respond when needed.

The Insurance Division of Responsibility in a Colocation Incident

A concrete scenario illustrates how the coverage stack works in practice. A cooling failure at the colocation facility causes servers to overheat. The operator’s cooling system shuts down as a safety measure, taking the facility offline for 14 hours while repairs are made. Equipment belonging to two tenants is damaged by the heat before the shutdown completes.

Here’s how the insurance responds:

• Operator’s property: Covers the cooling system repair cost
• Operator’s BI: Covers operator revenue loss during the 14-hour outage
• Operator’s tech E&O: Responds to tenant claims for the 14-hour service interruption (SLA breach)
• Operator’s GL: Responds to tenant claims for equipment damage caused by the operator’s cooling failure (property damage to tenants’ equipment in the operator’s care)
• Tenant A’s property (own policy): Covers Tenant A’s damaged servers if the GL claim against the operator is disputed or inadequate
• Tenant A’s contingent BI (own policy): Covers Tenant A’s revenue loss during the 14-hour outage — the operator’s BI does not cover tenant revenue loss
• Tenant B’s property (own policy): Same as Tenant A

The critical observation: without contingent BI, tenants A and B recover their equipment costs (through the operator’s GL or their own property policy) but not their revenue loss. For a tenant generating $500K/hour, a 14-hour outage represents $7M in revenue loss — uninsured without contingent BI.