Colocation Data Center Insurance: Coverage Guide for Operators and Tenants

Colocation is the dominant model in data center infrastructure — a facility owner provides the physical space, power, and cooling, while tenants install and own their own servers and equipment. This arrangement splits risk across two parties in ways that create coverage gaps for both. Operators face liability for uptime failures, data loss, and SLA breaches. Tenants face equipment loss, business interruption, and contingent losses from depending on a third-party facility. Standard commercial policies weren’t designed for either side of this relationship.

This guide covers what both colocation operators and their enterprise tenants need to understand about insurance — and where each party’s coverage begins and ends.

The Insurance Boundary in Colocation: What Each Party Owns

The foundational rule in colocation insurance is straightforward: the operator insures the facility, the tenant insures their equipment and operations. In practice, this clean line blurs in several important ways.

The operator’s insurance responsibility covers: the physical building and infrastructure (power distribution, cooling systems, fire suppression, network connectivity), general liability for incidents on the premises, professional liability for service delivery failures, and workers compensation for facility staff. What the operator’s insurance does not cover: the tenants’ servers, storage, and network equipment; losses to tenants resulting from facility downtime; or the tenants’ business operations.

The tenant’s insurance responsibility covers: their own equipment installed in the facility (servers, storage, networking gear), business interruption arising from equipment damage or facility unavailability, data recovery and breach response costs, and liability to their own customers arising from service failures. What the tenant cannot insure through their own policy: the colocation operator’s liability to the tenant for facility failures — that’s the operator’s problem.

Insurance Coverage for Colocation Operators

Property Insurance for the Facility

Colocation facility property insurance covers the building, mechanical and electrical systems, and equipment owned by the operator. Key structuring considerations:

• Tenant improvements and betterments: Equipment installed by tenants that becomes part of the facility (raised flooring, cage systems, custom cable management) has ambiguous ownership — the policy must address these clearly
• Equipment in the operator’s care, custody, or control: Standard property policies cover equipment the operator owns. Tenant equipment in the facility is not the operator’s property, but the operator may face liability if their negligence damages it — addressed through GL with a Care, Custody & Control (CC&C) endorsement
• Business interruption: Structured on revenue from colocation agreements — see our dedicated data center BI guide for structuring guidance
• Mechanical and electrical breakdown: Equipment breakdown coverage for power distribution units, chillers, UPS systems, and generators is essential — standard property policies typically exclude mechanical breakdown as a cause of loss

Technology E&O / Professional Liability

Technology E&O is the most important liability coverage for colocation operators and the one most frequently inadequate or absent. When a facility failure causes tenants to miss SLAs, lose revenue, or suffer business disruption, they may sue the operator for professional negligence in delivering the contracted service. These claims allege the failure to maintain promised uptime, improper maintenance, or inadequate security — professional service failures, not property damage. Standard GL policies typically exclude professional services claims. Tech E&O specifically addresses them.

Tech E&O limits for colocation operators should be sized against the aggregate revenue concentration in the facility. If 20 tenants each generate $5M in annual revenue from computing operations in your facility, a major outage creates $100M in tenant revenue exposure that flows to you through claims. Limits of $5–25M are common for mid-market colocation operators; larger facilities with enterprise tenants warrant higher limits.

Cyber Liability

Colocation operators face cyber liability exposure on two fronts. First, as a custodian of IT infrastructure: if your facility’s network or systems are compromised and that compromise affects tenant operations or tenant data, you face liability from both tenants and potentially from regulators. Second, as a business with your own IT systems, employee data, and operational technology: standard first-party cyber exposure applies to any commercial enterprise.

For colocation operators handling regulated data (healthcare tenants, financial services tenants, government tenants), the regulatory compliance exposure is significant. Even if the operator doesn’t “own” the data, their physical and network infrastructure touches it — a breach originating in a shared facility component can create HIPAA or PCI-DSS exposure for the operator.

General Liability with Care, Custody and Control

Standard GL covers bodily injury and property damage claims from third parties. For colocation operators, the critical GL extension is Care, Custody and Control (CC&C) coverage, which specifically addresses liability for damage to property of others that’s in your possession. Tenant equipment in your facility is in your care, custody, and control — if your maintenance work, power management error, or cooling failure damages tenant servers, CC&C coverage is what responds.

Standard GL policies typically have a CC&C exclusion. The exclusion must be bought back, either through endorsement or through a standalone inland marine policy that specifically covers tenant property in the operator’s facility.

Insurance Coverage for Colocation Tenants

Equipment Insurance

Tenant-owned servers, storage, and network equipment in a colocation facility are business property — covered under a commercial property policy or standalone electronic equipment policy. Key considerations:

• Replacement cost vs. actual cash value: IT equipment depreciates rapidly; an ACV policy on 3-year-old servers may pay significantly less than replacement cost. Replacement cost coverage is worth the premium for high-value compute equipment
• Location of property: The policy must specifically cover equipment at the colocation facility address — property policies default to coverage at named locations; verify your policy explicitly covers equipment at off-premises data center locations
• Transit coverage: Equipment in transit to or from the facility needs coverage during transport — typically addressed through inland marine or a property policy transit extension
• Installation and commissioning: New equipment being installed at the facility may not be covered until it’s fully operational — verify when coverage attaches

Contingent Business Interruption

Contingent BI is the most important coverage for enterprise colocation tenants and the one most frequently inadequate. When the colocation operator’s facility goes down — power failure, cooling system fault, structural damage, cyberattack — the tenant loses the ability to operate systems housed there. That lost revenue is a contingent BI loss: the tenant’s BI arising from a covered loss at a dependent third-party location.

Standard BI policies cover revenue loss from damage to the insured’s own property. Contingent BI extends that protection to cover revenue loss from damage at a dependent location — the colocation facility. Key structuring requirements for tenant contingent BI:

• The colocation facility must be specifically named as a dependent property in the policy
• The trigger must cover non-physical outages (power failure, cyber event) at the dependent location — not just physical property damage there
• The limit must reflect the revenue exposure at that specific facility — if 70% of your processing runs through a single colo, 70% of your BI exposure lives there
• Consider concentration risk: dependence on a single colocation provider creates the same concentration risk as dependence on a single cloud provider

Cyber Liability for Tenants

Enterprise tenants processing sensitive data at a colocation facility need full cyber liability coverage regardless of the colocation operator’s own cyber program. The operator’s insurance covers the operator — not the tenant’s data, not the tenant’s regulatory obligations, and not claims against the tenant from the tenant’s own customers. A healthcare company whose patient data is compromised at a colocation facility has HIPAA obligations that are entirely independent of the facility operator’s insurance situation.

What Colocation Agreements Require: Insurance Provisions

Colocation master service agreements typically include insurance requirements for both parties. Common provisions tenants can expect:

• Commercial general liability of $1–5M per occurrence from the tenant
• Technology E&O or professional liability if the tenant provides technology services to third parties from the facility
• Workers compensation at statutory limits for tenant employees accessing the facility
• Property insurance for tenant-owned equipment at replacement cost
• Naming the operator as additional insured on the tenant’s CGL policy

Operators should audit tenant COIs at contract inception and annually — lapsed tenant coverage creates exposure if a tenant-caused incident damages the facility or other tenants’ equipment.